|
Log-Analyse und Auswertung: Win32.Downloader.gen & Montera.Toolbar mit Spybot gefundenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
13.09.2013, 10:04 | #1 | |||
| Win32.Downloader.gen & Montera.Toolbar mit Spybot gefunden Hallo! Ich bin zufällig über eure Seite gestolpert. als ich auf der Suche nach Hilfe war. Ich habe mir auch schon ein paar Dinge angeschaut und war beeindruckt von der sehr persönlichen Hilfe! Deshalb wollte ich das hier bei Euch ausprobieren! Ich bastel zwar viel in Netz rum, aber die Ahnung von dem Innenleben meines Computer habe ich nicht. Das vielleicht schon mal als Vorwarnung für Euch, falls ihr mir helft! Zum Thema: Habe die beiden Teile beim Durchlauf mit Spybot gefunden. Defogger hab ich laufen lassen, hat mir aber keine txt ausgegeben. Hier nun der FRST-Editortext: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 13-09-2013 Ran by ******* (administrator) on ******** on 13-09-2013 09:49:39 Running from C:\Users\*********\Downloads Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: German Standard Internet Explorer Version 9 Boot Mode: Normal ==================== Processes (Whitelisted) =================== (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe (Microsoft Corporation) C:\Windows\system32\SLsvc.exe (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe (AVM Berlin) C:\Program Files\1&1\IGDCTRL.EXE () C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE (McAfee, Inc.) C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe () C:\Windows\system32\PSIService.exe (Protexis Inc.) c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe (McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe (McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation) C:\Windows\ehome\ehtray.exe (Google Inc.) C:\Users\*******\AppData\Local\Google\Update\GoogleUpdate.exe (Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe (McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.0.318\SSScheduler.exe (AVM Berlin) C:\Program Files\1&1\FwebProt.exe (OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.exe (Microsoft Corporation) C:\Windows\ehome\ehmsas.exe (Google Inc.) C:\Users\********\AppData\Local\Google\Update\1.3.21.153\GoogleCrashHandler.exe (OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.bin (AVM Berlin) C:\Program Files\1&1\StCenter.EXE (McAfee, Inc.) C:\Program Files\McAfee.com\Agent\mcagent.exe (Microsoft Corporation) C:\Windows\system32\wuauclt.exe (Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe (Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe (Microsoft Corporation) C:\Windows\system32\conime.exe (Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe (Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe (Microsoft Corporation) C:\Windows\System32\mobsync.exe (Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDScan.exe (Google Inc.) C:\Users\*******\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\********\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\*******\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\*******\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\*******\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\*******\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\*******\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\*******\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\*******\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\*******\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\*******\AppData\Local\Google\Chrome\Application\chrome.exe (McAfee, Inc.) c:\PROGRA~1\mcafee\SITEAD~1\saui.exe (Google Inc.) C:\Users\*******\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\*******\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\*******\AppData\Local\Google\Chrome\Application\chrome.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-21] (Microsoft Corporation) HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7625248 2009-07-20] (Realtek Semiconductor) HKLM\...\Run: [mcui_exe] - C:\Program Files\McAfee.com\Agent\mcagent.exe [1278064 2013-03-13] (McAfee, Inc.) HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59240 2011-09-27] (Apple Inc.) HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation) HKLM\...\Run: [SDTray] - C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.) HKLM\...\RunOnce: [ Malwarebytes Anti-Malware ] - C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation) Winlogon\Notify\SDWinLogon: SDWinLogon.dll [X] HKLM\...\Policies\Explorer: [NoControlPanel] 0 HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [125952 2008-01-21] (Microsoft Corporation) HKCU\...\Run: [Google Update] - C:\Users\Nadine Popich\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2011-07-19] (Google Inc.) HKCU\...\Run: [Pando Media Booster] - C:\Program Files\Pando Networks\Media Booster\PMB.exe [3077528 2011-08-03] () HKCU\...\Run: [WMPNSCFG] - C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-21] (Microsoft Corporation) HKCU\...\RunOnce: [Shockwave Updater] - C:\Windows\system32\Adobe\Shockwave 11\SwHelper_1151601.exe -Update -1151601 -"Mozilla/5.0_(Windows;_U;_Windows_NT_6.0;_de;_rv:1.9.2.15)_Gecko/20110303_Firefox/3.6.15_ImageShackToolbar/5.2.4_(_.NET_CLR" -"hxxp://www.bbc.co.uk/gardening/htbg2/virtual_garden/shockwave/garden3.shtml" [468408 2009-07-21] (Adobe Systems, Inc.) HKU\Default\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter HKU\Default User\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter Startup: C:\Users\*******\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL Protect.lnk ShortcutTarget: DSL Protect.lnk -> C:\Program Files\1&1\FwebProt.exe (AVM Berlin) Startup: C:\Users\*******\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe () BootExecute: autocheck autochk * sdnclean.exe ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com HKCU\Software\Microsoft\Internet Explorer\Main,ICQ Search = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://medion.msn.com HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://home.sweetim.com HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com URLSearchHook: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.) URLSearchHook: (No Name) - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - No File URLSearchHook: (No Name) - {40c3cc16-7269-4b32-9531-17f2950fb06f} - No File SearchScopes: HKLM - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2475029 SearchScopes: HKCU - DefaultScope {77E63755-4D4D-45C8-A41B-95B51530E62C} URL = hxxp://go.web.de/suchbox/google?q={searchTerms} SearchScopes: HKCU - {45327B16-694D-45D3-A8CE-1A70BD4129BD} URL = hxxp://go.1und1.de/suchbox/amazon?tag=1und1icon-21&field-keywords={searchTerms} SearchScopes: HKCU - {6552C7DD-90A4-4387-B795-F8F96747DE19} URL = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd SearchScopes: HKCU - {6FEADE84-B2D8-4804-A45C-186C6F16316B} URL = hxxp://go.web.de/suchbox/ebay?query={searchTerms} SearchScopes: HKCU - {75676AC7-9E6C-4658-B5AF-9AD86763C8C9} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=LOL&o=16439&src=crm&q={searchTerms}&locale=&apn_ptnrs=OY&apn_dtid=YYYYYYYYDE&apn_uid=3C4E80DE-834A-483C-876F-29AA76ECE4C3&apn_sauid=0027EF45-FA8E-408B-B033-276B3C2D94BA SearchScopes: HKCU - {77E63755-4D4D-45C8-A41B-95B51530E62C} URL = hxxp://go.web.de/suchbox/google?q={searchTerms} SearchScopes: HKCU - {A8113878-A6DD-4457-898A-8BE6E878D431} URL = hxxp://go.1und1.de/suchbox/1und1suche?su={searchTerms} SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2475029 SearchScopes: HKCU - {DEB7C54E-7B18-4429-ACAF-14ECBAEC8E62} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MEDTDF&pc=MAMD&src=IE-SearchBox BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.) BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.) Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File Toolbar: HKCU -Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.) Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.) Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\PROGRA~1\mcafee\msc\mcsniepl.dll (McAfee, Inc.) Winsock: Catalog5 07 C:\Program Files\1&1\\sarah.dll [24880] (AVM Berlin) Winsock: Catalog9 01 C:\Program Files\1&1\\sarah.dll [24880] (AVM Berlin) Winsock: Catalog9 02 C:\Program Files\1&1\\sarah.dll [24880] (AVM Berlin) Winsock: Catalog9 03 C:\Program Files\1&1\\sarah.dll [24880] (AVM Berlin) Winsock: Catalog9 14 C:\Program Files\1&1\\sarah.dll [24880] (AVM Berlin) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 Chrome: ======= CHR HomePage: about:home CHR RestoreOnStartup: "https://www.google.de/" CHR DefaultSearchURL: (google np) - hxxp://www.google.de/#hl=de&output=search&sclient=psy-ab&q={searchTerms}&oq=start&gs_l=hp.1.0.0l2j0i10j0.55868.57044.0.59638.5.5.0.0.0.0.178.724.0j5.5.0...0.0...1c.DmqGqs4Tml4&pbx=1&bav=on.2,or.r_gc.r_pw.r_qf.&fp=5e7fc900d9a88c5&biw=1024&bih=485 CHR DefaultSuggestURL: (google np) - "suggest_url": "", CHR Plugin: (Remoting Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Users\*******\AppData\Local\Google\Chrome\Application\29.0.1547.66\ppGoogleNaClPluginChrome.dll () CHR Plugin: (Chrome PDF Viewer) - C:\Users\*******\AppData\Local\Google\Chrome\Application\29.0.1547.66\pdf.dll () CHR Plugin: (Shockwave Flash) - C:\Users\*******\AppData\Local\Google\Chrome\User Data\NPAPIFlash\gcswf32.dll No File CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll () CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.) CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin2.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin3.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin4.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin5.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin6.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin7.dll (Apple Inc.) CHR Plugin: (CANON iMAGE GATEWAY Album Plugin Utility) - C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.) CHR Plugin: (Picasa) - C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.) CHR Plugin: (Java(TM) Platform SE 6 U31) - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll No File CHR Plugin: (McAfee SiteAdvisor) - C:\Program Files\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.) CHR Plugin: (Pando Web Plugin) - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll No File CHR Plugin: (Google Update) - C:\Users\*******\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll No File CHR Plugin: (Move Media Player 7) - C:\Users\*******\AppData\Roaming\Move Networks\plugins\071802000001\npqmp071802000001.dll (Move Networks) CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll No File CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) CHR Plugin: (McAfee SecurityCenter) - c:\progra~1\mcafee\msc\npmcsn~1.dll () CHR Extension: (Entanglement Web App) - C:\Users\*******\AppData\Local\Google\Chrome\User Data\Default\Extensions\aciahcmjmecflokailenpkdchphgkefd\3.4.9_0 CHR Extension: (AddThis - Share & Bookmark (new)) - C:\Users\*******\AppData\Local\Google\Chrome\User Data\Default\Extensions\cgbogdmdefihhljhfeiklfiedefalcde\3.0.2_0 CHR Extension: (Add to Amazon Wish List) - C:\Users\*******\AppData\Local\Google\Chrome\User Data\Default\Extensions\ciagpekplgpbepdgggflgmahnjgiaced\1.0.0.10_0 CHR Extension: (Google Search) - C:\Users\*******\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0 CHR Extension: (Rebecca Taylor) - C:\Users\*******\AppData\Local\Google\Chrome\User Data\Default\Extensions\eahpkkfpjpdcfdkbpeoibdhfadicnhdj\3_0 CHR Extension: (Gmail Offline) - C:\Users\NADINE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejidjjhkpiempkbhmpbfngldlkglhimk\1.20_0 CHR Extension: (Google Calendar) - C:\Users\*******\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjicmeblgpmajnghnpcppodonldlgfn\4.5.3_0 CHR Extension: (Add to Feedly) - C:\Users\*******\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejkjjleifeeaccajkekdcckflfpenoen\0.2_0 CHR Extension: (SiteAdvisor) - C:\Users\*******\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.6.2.1341_0 CHR Extension: (CHIP Online) - C:\Users\*******\AppData\Local\Google\Chrome\User Data\Default\Extensions\fhjmdobefakhdbfdpnnopoaldabldbgd\1.5_0 CHR Extension: (AdBlock) - C:\Users\*******\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.6.7_0 CHR Extension: (Feedly - News, Blogs and Youtube) - C:\Users\*******\AppData\Local\Google\Chrome\User Data\Default\Extensions\hipbfijinpcgfogaopmgehiegacbhmob\18.1_0 CHR Extension: (Chrome to Mobile) - C:\Users\*******\AppData\Local\Google\Chrome\User Data\Default\Extensions\idknbmbdnapjicclomlijcgfpikmndhd\2_0 CHR Extension: (WEB.DE MailCheck) - C:\Users\*******\AppData\Local\Google\Chrome\User Data\Default\Extensions\jaogepninmlbinccpbiakcgiolijlllo\1.2_0 CHR Extension: (Evernote Web) - C:\Users\*******\AppData\Local\Google\Chrome\User Data\Default\Extensions\lbfehkoinhhcknnbdgnnmjhiladcgbol\1.0.7_0 CHR Extension: (Ghostery) - C:\Users\*******\AppData\Local\Google\Chrome\User Data\Default\Extensions\mlomiejdfkolichcflejclcbmpeaniij\5.0.0_0 CHR Extension: (Email Backgrounds, Email Stationery) - C:\Users\*******\AppData\Local\Google\Chrome\User Data\Default\Extensions\nepmejfbdnfgkkeklbhejggabembdfmo\1_0 CHR Extension: (RSS Subscription Extension (by Google)) - C:\Users\*******\AppData\Local\Google\Chrome\User Data\Default\Extensions\nlbjncdgjeocebhnmkbbbdekmmmcbfjd\2.2.2_0 CHR Extension: (Chrome In-App Payments service) - C:\Users\*******\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0 CHR HKLM\...\Chrome\Extension: [bcjagnifjocnddgeknajocbkkhlgibem] - C:\Program Files\Chrome\surfcanyon.crx CHR HKLM\...\Chrome\Extension: [dhkplhfnhceodhffomolpfigojocbpcb] - C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonChrome.crx CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files\McAfee\SiteAdvisor\McChPlg.crx CHR HKLM\...\Chrome\Extension: [ngnjhfpfhadncgafgbneeljaginimmmk] - C:\Users\*******\AppData\Local\Temp\tbch.crx CHR StartMenuInternet: Google Chrome - C:\Users\*******\AppData\Local\Google\Chrome\Application\chrome.exe ========================== Services (Whitelisted) ================= R2 IGDCTRL; C:\Program Files\1&1\IGDCTRL.EXE [87344 2007-10-25] (AVM Berlin) R2 IJPLMSVC; C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [103808 2008-01-22] () R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation) R2 McAfee SiteAdvisor Service; C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe [167784 2012-08-31] (McAfee, Inc.) S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.) R2 McMPFSvc; C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe [167784 2012-08-31] (McAfee, Inc.) R2 mcmscsvc; C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe [167784 2012-08-31] (McAfee, Inc.) R2 McNaiAnn; C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe [167784 2012-08-31] (McAfee, Inc.) R2 McNASvc; C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe [167784 2012-08-31] (McAfee, Inc.) S3 McODS; C:\Program Files\McAfee\VirusScan\mcods.exe [279488 2013-02-25] (McAfee, Inc.) R2 McProxy; C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe [167784 2012-08-31] (McAfee, Inc.) R2 McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe [203840 2013-02-19] (McAfee, Inc.) R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [169320 2013-02-19] (McAfee, Inc.) R2 mfevtp; C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe [172416 2013-02-19] (McAfee, Inc.) R2 MSK80Service; C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe [167784 2012-08-31] (McAfee, Inc.) R2 ProtexisLicensing; C:\Windows\system32\PSIService.exe [177704 2007-06-05] () R2 SDScannerService; C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe [1817560 2013-05-16] (Safer-Networking Ltd.) R2 SDUpdateService; C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe [1033688 2013-05-16] (Safer-Networking Ltd.) R2 SDWSCService; C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2013-05-15] (Safer-Networking Ltd.) ==================== Drivers (Whitelisted) ==================== R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [60920 2013-02-19] (McAfee, Inc.) R0 CLFS; C:\Windows\System32\CLFS.sys [245736 2009-04-10] (Microsoft Corporation) S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [146872 2012-04-20] (McAfee, Inc.) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation) R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [133416 2013-02-19] (McAfee, Inc.) R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [235264 2013-02-19] (McAfee, Inc.) S3 mfebopk; C:\Windows\System32\drivers\mfebopk.sys [65928 2013-02-19] (McAfee, Inc.) R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [363080 2013-02-19] (McAfee, Inc.) R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [565888 2013-02-19] (McAfee, Inc.) S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [92632 2013-02-19] (McAfee, Inc.) R1 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [210608 2013-02-19] (McAfee, Inc.) R3 netr28u; C:\Windows\System32\DRIVERS\netr28u.sys [554496 2007-09-21] (Ralink Technology Corp.) R1 StarOpen; C:\Windows\System32\Drivers\StarOpen.sys [5632 2006-07-24] () S3 EagleNT; \??\C:\Windows\system32\drivers\EagleNT.sys [x] S3 EagleXNt; \??\C:\Windows\system32\drivers\EagleXNt.sys [x] S3 IpInIp; system32\DRIVERS\ipinip.sys [x] S3 massfilter; system32\drivers\massfilter.sys [x] U3 mfeavfk01; No ImagePath S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x] S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x] S3 Profos; \??\C:\Program Files\BullGuard Ltd\BullGuard\antirootkit\profos.sys [x] S3 Trufos; \??\C:\Program Files\BullGuard Ltd\BullGuard\antirootkit\trufos.sys [x] S3 XDva389; \??\C:\Windows\system32\XDva389.sys [x] S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [x] S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [x] S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-09-13 09:49 - 2013-09-13 09:49 - 00000000 ____D C:\FRST 2013-09-13 09:48 - 2013-09-13 09:48 - 01082459 _____ (Farbar) C:\Users\*******\Downloads\FRST.exe 2013-09-13 09:39 - 2013-09-13 09:40 - 00000488 _____ C:\Users\*******Downloads\defogger_disable.log 2013-09-13 09:39 - 2013-09-13 09:39 - 00000000 _____ C:\Users\*******\defogger_reenable 2013-09-13 09:38 - 2013-09-13 09:38 - 00050477 _____ C:\Users\*******\Downloads\Defogger.exe 2013-09-13 07:49 - 2013-09-13 08:47 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy 2013-09-13 07:49 - 2013-09-13 07:49 - 00000644 _____ C:\Windows\Tasks\Check for updates (Spybot - Search & Destroy).job 2013-09-13 07:49 - 2013-09-13 07:49 - 00000616 _____ C:\Windows\Tasks\Refresh immunization (Spybot - Search & Destroy).job 2013-09-13 07:49 - 2013-09-13 07:49 - 00000446 _____ C:\Windows\Tasks\Scan the system (Spybot - Search & Destroy).job 2013-09-13 07:48 - 2013-09-13 08:44 - 00000000 ____D C:\Program Files\Spybot - Search & Destroy 2 2013-09-13 07:48 - 2013-09-13 07:48 - 00001962 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk 2013-09-13 07:48 - 2009-01-25 13:14 - 00015224 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean.exe 2013-09-12 03:04 - 2013-07-31 12:30 - 12335104 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2013-09-12 03:04 - 2013-07-31 12:05 - 09738752 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2013-09-12 03:04 - 2013-07-31 12:00 - 01800704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2013-09-12 03:04 - 2013-07-31 11:53 - 01104896 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2013-09-12 03:04 - 2013-07-31 11:52 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2013-09-12 03:04 - 2013-07-31 11:52 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2013-09-12 03:04 - 2013-07-31 11:51 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2013-09-12 03:04 - 2013-07-31 11:49 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2013-09-12 03:04 - 2013-07-31 11:48 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2013-09-12 03:04 - 2013-07-31 11:48 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2013-09-12 03:04 - 2013-07-31 11:48 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2013-09-12 03:04 - 2013-07-31 11:47 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2013-09-12 03:04 - 2013-07-31 11:46 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2013-09-12 03:04 - 2013-07-31 11:45 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2013-09-12 03:04 - 2013-07-31 11:45 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2013-09-12 03:04 - 2013-07-31 11:42 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2013-09-11 09:12 - 2013-08-08 03:45 - 02049536 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2013-09-11 09:12 - 2013-07-16 06:35 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\themeui.dll 2013-09-11 08:19 - 2013-09-11 08:20 - 00476024 _____ (1&1 Mail & Media GmbH) C:\Users\*******\Downloads\WEB.DE_MailCheck_chrome_setup.exe 2013-09-10 08:49 - 2013-09-10 08:49 - 00160640 _____ C:\Users\*******\Downloads\limit-login-attempts.1.7.1.zip 2013-09-09 10:46 - 2013-09-09 10:46 - 00012576 _____ C:\Users\*******\Downloads\130909_Konto ******* _ Aus.zip 2013-09-09 10:46 - 2013-09-09 10:46 - 00012319 _____ C:\Users\*******\Downloads\130909_Konto ******* _ Aus (1).zip 2013-09-09 10:38 - 2013-09-09 10:38 - 00018468 _____ C:\Users\*******\Downloads\130909_Konto ******* _ Aus.zip 2013-09-09 10:38 - 2013-09-09 10:38 - 00012417 _____ C:\Users\*******\Downloads\130909_Konto ******* _ Au.zip 2013-09-07 18:59 - 2013-09-07 18:59 - 00037888 _____ C:\Users\*******\Downloads\GuV_leer.xls 2013-09-03 10:33 - 2013-09-03 10:34 - 00000000 ____D C:\Users\*******\Downloads\Diverses 2013-09-03 10:32 - 2013-09-03 10:33 - 00000000 ____D C:\Users\*******\Downloads\Rico Diverses 2013-09-03 08:15 - 2013-09-04 07:44 - 00000000 ____D C:\Users\*******\AppData\Roaming\Google 2013-09-02 07:46 - 2013-09-02 07:46 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe 2013-08-29 08:41 - 2013-09-13 07:43 - 00000910 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2013-08-29 08:40 - 2013-09-13 07:43 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware 2013-08-29 08:40 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2013-08-27 23:36 - 2013-08-02 06:09 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL 2013-08-27 10:12 - 2013-08-27 10:14 - 00000000 ____D C:\Users\*******\Documents\Arbeit 2013-08-26 07:24 - 2013-09-13 09:25 - 00675532 _____ C:\Windows\WindowsUpdate.log 2013-08-24 12:38 - 2013-08-24 12:38 - 01412416 _____ C:\Users\*******\Documents\Meine Änderungen des Themes.odp 2013-08-24 09:46 - 2013-08-24 09:46 - 00000000 ____D C:\Users\*******\AppData\Local\Monotype_Inc 2013-08-23 18:37 - 2013-08-23 18:37 - 00000000 ____D C:\Users\*******\AppData\Roaming\BlogDesk 2013-08-23 14:13 - 2013-08-23 14:13 - 00000872 _____ C:\Users\*******\Desktop\Notepad++.lnk 2013-08-23 14:13 - 2013-08-23 14:13 - 00000000 ____D C:\Users\*******\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Notepad++ 2013-08-23 14:12 - 2013-08-23 16:35 - 00000000 ____D C:\Users\*******\AppData\Roaming\Notepad++ 2013-08-23 14:12 - 2013-08-23 14:13 - 00000000 ____D C:\Program Files\Notepad++ 2013-08-22 18:25 - 2013-08-22 18:25 - 00000000 ____D C:\Program Files\FileZilla FTP Client 2013-08-22 18:24 - 2013-08-23 09:27 - 00000000 ____D C:\Users\*******\AppData\Roaming\FileZilla 2013-08-22 18:21 - 2013-08-22 18:25 - 00001789 _____ C:\Users\Public\Desktop\FileZilla Client.lnk 2013-08-22 18:08 - 2013-08-22 18:08 - 00000000 ___HD C:\Users\*******\skyfonts-google 2013-08-22 17:21 - 2013-08-25 20:20 - 00000000 ____D C:\Users\*******\AppData\Roaming\Monotype 2013-08-22 17:21 - 2013-08-22 17:21 - 00001791 _____ C:\Users\Public\Desktop\SkyFonts.lnk 2013-08-22 17:21 - 2013-08-22 17:21 - 00000000 ____D C:\Program Files\Monotype 2013-08-22 09:46 - 2013-08-22 09:47 - 00000266 ____H C:\Users\*******\.picasa.ini 2013-08-20 15:13 - 2013-08-20 15:13 - 00001166 _____ C:\Users\Public\Desktop\WEB.DE Club SmartFax.lnk 2013-08-15 08:04 - 2013-08-15 08:04 - 00000000 ____D C:\Users\*******\AppData\Local\Chromium 2013-08-14 08:26 - 2013-08-23 17:57 - 00000568 ____H C:\Users\*******\Downloads\.picasa.ini 2013-08-14 03:58 - 2013-07-17 21:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2013-08-14 03:58 - 2013-07-10 11:47 - 00783360 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll 2013-08-14 03:58 - 2013-07-09 14:10 - 01205168 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll 2013-08-14 03:58 - 2013-07-08 06:55 - 03603904 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe 2013-08-14 03:58 - 2013-07-08 06:55 - 03551680 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2013-08-14 03:58 - 2013-07-08 06:20 - 00172544 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll 2013-08-14 03:58 - 2013-07-08 06:16 - 00992768 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll 2013-08-14 03:58 - 2013-07-08 06:16 - 00133120 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll 2013-08-14 03:58 - 2013-07-08 06:16 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll 2013-08-14 03:58 - 2013-07-05 06:53 - 00905664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys 2013-08-14 03:58 - 2013-06-15 15:22 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\icaapi.dll 2013-08-14 03:58 - 2013-06-15 13:23 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys ==================== One Month Modified Files and Folders ======= 2013-09-13 09:49 - 2013-09-13 09:49 - 00000000 ____D C:\FRST 2013-09-13 09:48 - 2013-09-13 09:48 - 01082459 _____ (Farbar) C:\Users\*******\Downloads\FRST.exe 2013-09-13 09:47 - 2006-11-02 14:47 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 2013-09-13 09:47 - 2006-11-02 14:47 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 2013-09-13 09:40 - 2013-09-13 09:39 - 00000488 _____ C:\Users\*******\Downloads\defogger_disable.log 2013-09-13 09:39 - 2013-09-13 09:39 - 00000000 _____ C:\Users\*******\defogger_reenable 2013-09-13 09:39 - 2009-12-27 17:09 - 00000000 ____D C:\Users\******* 2013-09-13 09:38 - 2013-09-13 09:38 - 00050477 _____ C:\Users\*******\Downloads\Defogger.exe 2013-09-13 09:25 - 2013-08-26 07:24 - 00675532 _____ C:\Windows\WindowsUpdate.log 2013-09-13 09:09 - 2010-09-27 08:13 - 00000000 ____D C:\Users\*******\AppData\Roaming\FRITZ! 2013-09-13 08:47 - 2013-09-13 07:49 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy 2013-09-13 08:44 - 2013-09-13 07:48 - 00000000 ____D C:\Program Files\Spybot - Search & Destroy 2 2013-09-13 07:49 - 2013-09-13 07:49 - 00000644 _____ C:\Windows\Tasks\Check for updates (Spybot - Search & Destroy).job 2013-09-13 07:49 - 2013-09-13 07:49 - 00000616 _____ C:\Windows\Tasks\Refresh immunization (Spybot - Search & Destroy).job 2013-09-13 07:49 - 2013-09-13 07:49 - 00000446 _____ C:\Windows\Tasks\Scan the system (Spybot - Search & Destroy).job 2013-09-13 07:48 - 2013-09-13 07:48 - 00001962 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk 2013-09-13 07:43 - 2013-08-29 08:41 - 00000910 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2013-09-13 07:43 - 2013-08-29 08:40 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware 2013-09-12 07:39 - 2011-01-08 19:27 - 00000000 ____D C:\Users\*******\AppData\Local\PMB Files 2013-09-12 07:08 - 2009-08-11 11:47 - 00035669 _____ C:\ProgramData\nvModes.dat 2013-09-12 07:08 - 2009-08-11 11:47 - 00035669 _____ C:\ProgramData\nvModes.001 2013-09-12 03:31 - 2006-11-02 12:33 - 01560144 _____ C:\Windows\system32\PerfStringBackup.INI 2013-09-12 03:24 - 2006-11-02 15:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2013-09-12 03:24 - 2006-11-02 14:47 - 00359560 _____ C:\Windows\system32\FNTCACHE.DAT 2013-09-12 03:21 - 2006-11-02 15:01 - 00032530 _____ C:\Windows\Tasks\SCHEDLGU.TXT 2013-09-12 03:04 - 2013-08-07 03:03 - 00000000 ____D C:\Windows\system32\MRT 2013-09-12 03:01 - 2006-11-02 12:24 - 76725432 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe 2013-09-11 08:20 - 2013-09-11 08:19 - 00476024 _____ (1&1 Mail & Media GmbH) C:\Users\*******\Downloads\WEB.DE_MailCheck_chrome_setup.exe 2013-09-10 08:49 - 2013-09-10 08:49 - 00160640 _____ C:\Users\*******\Downloads\limit-login-attempts.1.7.1.zip 2013-09-09 10:46 - 2013-09-09 10:46 - 00012576 _____ C:\Users\*******\Downloads\130909_Konto ******* _ Aus.zip 2013-09-09 10:46 - 2013-09-09 10:46 - 00012319 _____ C:\Users\*******\Downloads\130909_Konto ******* _ Aus (1).zip 2013-09-09 10:38 - 2013-09-09 10:38 - 00018468 _____ C:\Users\*******\Downloads\130909_Konto ******* _ Aus.zip 2013-09-09 10:38 - 2013-09-09 10:38 - 00012417 _____ C:\Users\*******\Downloads\130909_Konto ******* _ Au.zip 2013-09-07 18:59 - 2013-09-07 18:59 - 00037888 _____ C:\Users\*******\Downloads\GuV_leer.xls 2013-09-04 07:44 - 2013-09-03 08:15 - 00000000 ____D C:\Users\*******\AppData\Roaming\Google 2013-09-03 10:34 - 2013-09-03 10:33 - 00000000 ____D C:\Users\*******\Downloads\Diverses 2013-09-03 10:33 - 2013-09-03 10:32 - 00000000 ____D C:\Users\*******\Downloads\Rico Diverses 2013-09-03 10:33 - 2013-08-06 09:58 - 00000000 ____D C:\Users\*******\Downloads\Tupperzwischenlager 2013-09-03 08:15 - 2012-07-24 12:36 - 00000808 _____ C:\Users\Public\Desktop\CCleaner.lnk 2013-09-03 08:15 - 2011-01-13 13:36 - 00000000 ____D C:\ProgramData\Google 2013-09-03 08:15 - 2010-11-30 17:54 - 00000000 ____D C:\Users\*******\AppData\Local\Google 2013-09-03 08:15 - 2009-12-31 13:38 - 00000000 ____D C:\Program Files\CCleaner 2013-09-03 08:14 - 2010-11-30 17:54 - 00000000 ____D C:\Program Files\Google 2013-09-02 09:46 - 2011-09-28 12:34 - 00000000 ____D C:\ProgramData\CanonIJPLM 2013-09-02 07:47 - 2013-06-29 20:42 - 00262144 _____ C:\Windows\system32\config\ELAM 2013-09-02 07:46 - 2013-09-02 07:46 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe 2013-08-31 03:19 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\Microsoft.NET 2013-08-28 12:18 - 2013-07-03 08:50 - 00000000 ____D C:\Users\*******\Documents\TUPPERWARE 2013-08-27 10:19 - 2013-07-19 08:55 - 00000000 ____D C:\Users\*******\Downloads\WORDPRESS 2013-08-27 10:14 - 2013-08-27 10:12 - 00000000 ____D C:\Users\*******Documents\Arbeit 2013-08-27 10:13 - 2013-08-07 07:59 - 00000000 ____D C:\Users\*******\Documents\******* 2013-08-27 10:13 - 2013-07-03 08:50 - 00000000 ____D C:\Users\*******\Documents\Übersichten Kontoauszüge 2013-08-25 20:20 - 2013-08-22 17:21 - 00000000 ____D C:\Users\*******\AppData\Roaming\Monotype 2013-08-24 12:38 - 2013-08-24 12:38 - 01412416 _____ C:\Users\*******\Documents\Meine Änderungen des Themes.odp 2013-08-24 09:46 - 2013-08-24 09:46 - 00000000 ____D C:\Users\*******\AppData\Local\Monotype_Inc 2013-08-23 19:07 - 2009-12-27 17:28 - 00003584 _____ C:\Users\*******\AppData\Local\******* 2013-08-23 18:37 - 2013-08-23 18:37 - 00000000 ____D C:\Users\******* 2013-08-23 18:37 - 2006-11-02 13:18 - 00000000 ____D C:\Program Files\Common Files\microsoft shared 2013-08-23 17:57 - 2013-08-14 08:26 - 00000568 ____H C:\Users\*******\Downloads\.picasa.ini 2013-08-23 16:35 - 2013-08-23 14:12 - 00000000 ____D C:\Users\*******\AppData\Roaming\Notepad++ 2013-08-23 14:13 - 2013-08-23 14:13 - 00000872 _____ C:\Users\*******\Desktop\Notepad++.lnk 2013-08-23 14:13 - 2013-08-23 14:13 - 00000000 ____D C:\Users\*******\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Notepad++ 2013-08-23 14:13 - 2013-08-23 14:12 - 00000000 ____D C:\Program Files\Notepad++ 2013-08-23 09:27 - 2013-08-22 18:24 - 00000000 ____D C:\Users\N*******\AppData\Roaming\FileZilla 2013-08-22 18:25 - 2013-08-22 18:25 - 00000000 ____D C:\Program Files\FileZilla FTP Client 2013-08-22 18:25 - 2013-08-22 18:21 - 00001789 _____ C:\Users\Public\Desktop\FileZilla Client.lnk 2013-08-22 18:08 - 2013-08-22 18:08 - 00000000 ___HD C:\Users\*******\skyfonts-google 2013-08-22 17:59 - 2013-07-03 08:51 - 00000000 ____D C:\Users\*******\Downloads\Schriftstile 2013-08-22 17:21 - 2013-08-22 17:21 - 00001791 _____ C:\Users\Public\Desktop\SkyFonts.lnk 2013-08-22 17:21 - 2013-08-22 17:21 - 00000000 ____D C:\Program Files\Monotype 2013-08-22 17:18 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\system32\de-DE 2013-08-22 09:47 - 2013-08-22 09:46 - 00000266 ____H C:\Users\*******\.picasa.ini 2013-08-22 09:43 - 2012-07-21 16:41 - 00000000 ___SD C:\Users\*******\Google Drive 2013-08-21 03:07 - 2010-09-07 18:10 - 00000000 ____D C:\Program Files\McAfee 2013-08-20 15:13 - 2013-08-20 15:13 - 00001166 _____ C:\Users\Public\Desktop\WEB.DE Club SmartFax.lnk 2013-08-15 08:17 - 2010-04-07 12:10 - 00000000 ____D C:\Windows\Minidump 2013-08-15 08:04 - 2013-08-15 08:04 - 00000000 ____D C:\Users\*******\AppData\Local\Chromium 2013-08-15 03:46 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\rescache 2013-08-14 10:17 - 2013-07-03 08:50 - 00000000 ____D C:\Users\*******\Documents\Geschenke und Gutscheine 2012 ==================== Bamital & volsnap Check ================= C:\Windows\explorer.exe => MD5 is legit C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-09-13 03:34 ==================== End Of Log ============================ Und nun der Addition-Editortext Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 13-09-2013 Ran by ******* at 2013-09-13 09:50:58 Running from C:\Users\*******\Downloads Boot Mode: Normal ========================================================== ==================== Installed Programs ======================= 7-Zip 4.65 Adobe Flash Player 11 ActiveX (Version: 11.8.800.94) Adobe Flash Player 11 Plugin (Version: 11.1.102.55) Adobe Reader X (10.1.7) - Deutsch (Version: 10.1.7) Adobe Shockwave Player 11.5 (Version: 11.5.1.601) Apple Application Support (Version: 2.1.5) Apple Software Update (Version: 2.1.3.127) Canon iP3600 series Benutzerregistrierung Canon iP3600 series Printer Driver Canon Utilities Easy-PhotoPrint EX Canon Utilities My Printer Canon Utilities Solution Menu CCleaner (Version: 4.05) Compatibility Pack für 2007 Office System (Version: 12.0.6612.1000) Corel Graphics - Windows Shell Extension (Version: 15.2.0.686) Corel Graphics - Windows Shell Extension (Version: 15.2.686) CorelDRAW Essentials 4 - Content (Version: 4.0) CorelDRAW Essentials 4 - Draw (Version: 4.0) CorelDRAW Essentials 4 - Extra Content CorelDRAW Essentials 4 - Extra Content (Version: 4.0) CorelDRAW Essentials 4 - Filters (Version: 4.0) CorelDRAW Essentials 4 - ICA (Version: 4.0) CorelDRAW Essentials 4 - IPM - No VBA (Version: 4.0) CorelDRAW Essentials 4 - Lang BR (Version: 4.0) CorelDRAW Essentials 4 - Lang DE (Version: 4.0) CorelDRAW Essentials 4 - Lang EN (Version: 4.0) CorelDRAW Essentials 4 - Lang ES (Version: 4.0) CorelDRAW Essentials 4 - Lang FR (Version: 4.0) CorelDRAW Essentials 4 - Lang IT (Version: 4.0) CorelDRAW Essentials 4 - Lang NL (Version: 4.0) CorelDRAW Essentials 4 - PHOTO-PAINT (Version: 4.0) CorelDRAW Essentials 4 (Version: 4.0) CorelDRAW Graphics Suite X5 - Capture (Version: 15.3) CorelDRAW Graphics Suite X5 - Common (Version: 15.3) CorelDRAW Graphics Suite X5 - Connect (Version: 15.3) CorelDRAW Graphics Suite X5 - Custom Data (Version: 15.3) CorelDRAW Graphics Suite X5 - DE (Version: 15.3) CorelDRAW Graphics Suite X5 - Draw (Version: 15.3) CorelDRAW Graphics Suite X5 - Filters (Version: 15.3) CorelDRAW Graphics Suite X5 - FontNav (Version: 15.3) CorelDRAW Graphics Suite X5 - IPM (Version: 15.3) CorelDRAW Graphics Suite X5 - PHOTO-PAINT (Version: 15.3) CorelDRAW Graphics Suite X5 - Photozoom Plugin (Version: 15.3) CorelDRAW Graphics Suite X5 - Redist (Version: 15.3) CorelDRAW Graphics Suite X5 - Setup Files (Version: 15.3) CorelDRAW Graphics Suite X5 - VBA (Version: 15.3) CorelDRAW Graphics Suite X5 - VideoBrowser (Version: 15.3) CorelDRAW Graphics Suite X5 - VSTA (Version: 15.3) CorelDRAW Graphics Suite X5 - WT (Version: 15.3) CorelDRAW Graphics Suite X5 (Version: 15.3) CorelDRAW(R) Graphics Suite X5 (Version: 15.2.0.686) DHTML Editing Component (Version: 6.02.0001) FileZilla Client 3.7.3 (Version: 3.7.3) FRITZ!Box starter (Version: 2.04.02) Google Chrome (HKCU Version: 29.0.1547.66) Google Toolbar for Internet Explorer (Version: 1.0.0) Google Toolbar for Internet Explorer (Version: 7.5.4413.1752) Google Update Helper (Version: 1.3.21.153) Hotfix für Microsoft Visual Studio 2007 Tools for Applications - ENU (KB947789) (Version: 1) Inkjet Printer/Scanner Extended Survey Program Java 7 Update 25 (Version: 7.0.250) Java Auto Updater (Version: 2.1.9.5) Java(TM) 6 Update 22 (Version: 6.0.220) L&H TTS3000 Deutsch Malwarebytes Anti-Malware Version 1.75.0.1300 (Version: 1.75.0.1300) McAfee Internet Security Suite (Version: 11.6.511) McAfee Security Scan Plus (Version: 3.0.318.3) Microsoft .NET Framework 3.5 Language Pack SP1 - DEU Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729) Microsoft .NET Framework 3.5 SP1 Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319) Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319) Microsoft .NET Framework 4 Extended (Version: 4.0.30319) Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319) Microsoft Office PowerPoint Viewer 2007 (German) (Version: 12.0.6612.1000) Microsoft Silverlight (Version: 5.1.20513.0) Microsoft SQL Server 2005 Compact Edition [DEU] (Version: 3.1.0000) Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053) Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001) Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218 (Version: 9.0.21022.218) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (Version: 10.0.30319) Microsoft Visual Studio Tools for Applications 2.0 - ENU (Version: 9.0.30729) Microsoft Visual Studio Tools for Applications 2.0 Language Pack - DEU (Version: 9.0.30729) Microsoft Visual Studio Tools for Applications 2.0 Runtime (Version: 9.0.30729) Microsoft Visual Studio Tools for Applications 2.0 Runtime Language Pack - DEU (Version: 9.0.30729) Microsoft_VC100_CRT_SP1_x86 (Version: 10.0.40219.1) Move Media Player MSVC80_x86 (Version: 1.0.1.0) MSVC80_x86_v2 (Version: 1.0.3.0) MSVC90_x86 (Version: 1.0.1.2) MSXML 4.0 SP2 (KB927978) (Version: 4.20.9841.0) MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0) MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0) Notepad++ (Version: 6.4.5) NVIDIA Display Control Panel (Version: 6.14.11.9745) NVIDIA Drivers (Version: 1.10.59.37) NVIDIA PhysX (Version: 9.09.0428) OpenOffice.org 3.3 (Version: 3.3.9567) Pando Media Booster (Version: 2.3.6.0) Picasa 3 (Version: 3.9) PVSonyDll (Version: 1.00.0001) QuickTime (Version: 7.71.80.42) Realtek High Definition Audio Driver (Version: 6.0.1.5898) SAMSUNG USB Driver for Mobile Phones (Version: 1.4.103.0) SF-Kalender 11.01 (Version: 11.01.000) Shared C Run-time for x86 (Version: 10.0.0) SkyFonts™ (Version: 3.0.3.33) Spelling Dictionaries Support For Adobe Reader 9 (Version: 9.0.0) Spybot - Search & Destroy (Version: 2.1.21) Update for Microsoft .NET Framework 3.5 SP1 (KB2836940) (Version: 1) Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1) Update for Microsoft .NET Framework 4 Extended (KB2468871) (Version: 1) Update for Microsoft .NET Framework 4 Extended (KB2533523) (Version: 1) Update for Microsoft .NET Framework 4 Extended (KB2600217) (Version: 1) Update for Microsoft .NET Framework 4 Extended (KB2836939) (Version: 1) Visual Basic for Applications (R) Core - English (Version: 6.4.99.69) Visual Basic for Applications (R) Core - German (Version: 6.4.99.69) Visual Basic for Applications (R) Core (Version: 6.4.99.69) VLC media player 1.1.11 (Version: 1.1.11) WEB.DE Club SmartFax (Version: 2.00.235) XP Codec Pack ==================== Restore Points ========================= 22-08-2013 15:19:34 Installed SkyFonts™ 23-08-2013 01:00:13 Windows Update 23-08-2013 16:36:35 Installed DHTML Editing Component 24-08-2013 12:15:24 Geplanter Prüfpunkt 26-08-2013 08:24:37 Geplanter Prüfpunkt 26-08-2013 22:10:46 Geplanter Prüfpunkt 27-08-2013 22:00:06 Geplanter Prüfpunkt 28-08-2013 01:00:11 Windows Update 31-08-2013 01:00:11 Windows Update 02-09-2013 09:58:49 Geplanter Prüfpunkt 02-09-2013 22:00:03 Geplanter Prüfpunkt 04-09-2013 09:36:43 Geplanter Prüfpunkt 04-09-2013 22:00:03 Geplanter Prüfpunkt 06-09-2013 09:02:57 Geplanter Prüfpunkt 07-09-2013 09:44:35 Geplanter Prüfpunkt 09-09-2013 11:45:53 Geplanter Prüfpunkt 10-09-2013 10:52:48 Geplanter Prüfpunkt 11-09-2013 10:46:51 Geplanter Prüfpunkt 12-09-2013 01:00:22 Windows Update 12-09-2013 22:07:28 Geplanter Prüfpunkt 13-09-2013 01:00:11 Windows Update ==================== Hosts content: ========================== 2006-11-02 12:23 - 2006-09-18 23:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts 127.0.0.1 localhost ::1 localhost ==================== Scheduled Tasks (whitelisted) ============= Task: {167640BD-46CE-4BE2-910A-18658E644488} - System32\Tasks\{D545F623-B94F-42A8-9549-18263836AA8C} => C:\Program Files\Skype\Phone\Skype.exe Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM Task: {320124A7-D70F-41DE-A9D1-D5E8E19D5D91} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-21] (Microsoft Corporation) Task: {57B126D9-225A-48C6-A05B-CA53DB4A5901} - System32\Tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3} => C:\Users\NADINE~1\AppData\Local\Temp\Qph.exe Task: {7F90F4D9-FCF8-44ED-8A9E-43500C59EBBE} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\schtasks.exe [2008-01-21] (Microsoft Corporation) Task: {8C30AC10-7E5E-436B-B73B-972593ECB3F1} - System32\Tasks\Microsoft\Windows\Defrag\ManualDefrag => C:\Windows\system32\defrag.exe [2008-01-21] (Microsoft Corp.) Task: {9C568330-FADB-4AE4-AF53-CDD6E7D87470} - System32\Tasks\User_Feed_Synchronization-{F727A845-B766-466A-84E1-865F9EAFDA03} => C:\Windows\system32\msfeedssync.exe [2011-06-13] (Microsoft Corporation) Task: {A61555D3-7840-45C1-A5A9-0D49851DE37A} - System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\OptinNotification => C:\Windows\System32\wsqmcons.exe [2008-01-21] (Microsoft Corporation) Task: {A728AE6B-5AB8-4223-AD3E-E6341441A01C} - System32\Tasks\Microsoft\Windows\PLA\System\ConvertLogEntries => C:\Windows\system32\pla.dll [2008-01-21] (Microsoft Corporation) Task: {D31659FC-B1F6-4050-907A-1AD18202EC4D} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-08-21] (Piriform Ltd) Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-21] () Task: {EF890D7D-E2EE-461D-AC3D-DA3D1C42DFC9} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.) Task: C:\Windows\Tasks\Check for updates (Spybot - Search & Destroy).job => C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1ce7f6d31d887c0.job => C:\Program Files\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2375695433-3522556619-247360529-1000Core1ce7f427aa20290.job => C:\Users\Nadine Popich\AppData\Local\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\Refresh immunization (Spybot - Search & Destroy).job => C:\Program Files\Spybot - Search & Destroy 2\SDImmunize.exe Task: C:\Windows\Tasks\Scan the system (Spybot - Search & Destroy).job => C:\Program Files\Spybot - Search & Destroy 2\SDScan.exe ==================== Loaded Modules (whitelisted) ============= 2009-08-11 10:57 - 2010-04-03 22:55 - 09386600 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dum.dll 2013-09-13 07:48 - 2013-05-16 10:55 - 00113496 _____ () C:\Program Files\Spybot - Search & Destroy 2\snlThirdParty150.bpl 2013-09-13 07:48 - 2013-05-16 10:55 - 03643800 _____ (Project JEDI) C:\Program Files\Spybot - Search & Destroy 2\Jcl150.bpl 2013-09-13 07:48 - 2013-05-16 10:55 - 00416600 _____ () C:\Program Files\Spybot - Search & Destroy 2\DEC150.bpl 2012-06-18 17:24 - 2012-06-18 17:24 - 00260096 _____ () C:\Program Files\Notepad++\NppShell_05.dll 2007-10-25 17:09 - 2007-10-25 17:09 - 00024880 _____ (AVM Berlin) C:\Program Files\1&1\sarah.dll 2007-10-25 17:08 - 2007-10-25 17:08 - 00066864 _____ (AVM Berlin) C:\Program Files\1&1\block.dll 2006-11-02 14:35 - 2006-11-02 14:35 - 00116736 _____ (Microsoft Corporation) C:\Windows\eHome\ehProxy.dll 2013-07-12 22:57 - 2013-07-12 22:57 - 00853896 ____T (Google Inc.) C:\Users\*******\AppData\Local\Google\Update\1.3.21.153\goopdate.dll 2007-10-25 17:09 - 2007-10-25 17:09 - 00075056 _____ (AVM Berlin) C:\Program Files\1&1\fireapi.dll 2007-10-25 17:08 - 2007-10-25 17:08 - 00032560 _____ (AVM Berlin) C:\Program Files\1&1\avmufc.dll 2007-10-25 17:08 - 2007-10-25 17:08 - 00271664 _____ (AVM Berlin) C:\Program Files\1&1\avmcsock.dll 2007-10-25 17:09 - 2007-10-25 17:09 - 00061744 _____ (AVM Berlin) C:\Program Files\1&1\igdapi.dll 2011-01-17 17:19 - 2011-03-08 19:10 - 00985088 _____ () C:\Program Files\OpenOffice.org 3\program\libxml2.dll 2013-09-13 07:48 - 2013-05-16 10:55 - 00161112 _____ () C:\Program Files\Spybot - Search & Destroy 2\snlFileFormats150.bpl 2013-09-13 07:48 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files\Spybot - Search & Destroy 2\sqlite3.dll 2013-09-04 17:59 - 2013-09-02 22:34 - 47074256 _____ (Google Inc.) C:\Users\*******\AppData\Local\Google\Chrome\Application\29.0.1547.66\chrome.dll 2013-09-04 17:59 - 2013-09-02 22:35 - 09962960 _____ (The ICU Project) C:\Users\*******\AppData\Local\Google\Chrome\Application\29.0.1547.66\icudt.dll 2013-09-04 17:59 - 2013-09-02 22:35 - 04053456 _____ () C:\Users\*******\AppData\Local\Google\Chrome\Application\29.0.1547.66\pdf.dll 2013-09-04 17:59 - 2013-09-02 22:35 - 00410576 _____ () C:\Users\*******\AppData\Local\Google\Chrome\Application\29.0.1547.66\ppGoogleNaClPluginChrome.dll 2013-09-04 17:59 - 2013-09-02 22:35 - 02110928 _____ (Google Inc.) C:\Users\*******\AppData\Local\Google\Chrome\Application\29.0.1547.66\libpeerconnection.dll 2013-09-04 17:59 - 2013-09-02 22:35 - 01604560 _____ () C:\Users\*******\AppData\Local\Google\Chrome\Application\29.0.1547.66\ffmpegsumo.dll 2013-08-24 09:54 - 2013-08-24 09:54 - 00141752 _____ (McAfee, Inc.) C:\Users\*******\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.6.2.1341_0\McChPlg.dll 2013-09-04 17:59 - 2013-09-02 20:46 - 03231688 _____ (Microsoft Corporation) C:\Users\*******\AppData\Local\Google\Chrome\Application\29.0.1547.66\D3DCompiler_46.dll 2013-09-04 17:59 - 2013-09-02 22:35 - 00709584 _____ () C:\Users\*******\AppData\Local\Google\Chrome\Application\29.0.1547.66\libglesv2.dll 2013-09-04 17:59 - 2013-09-02 22:35 - 00099792 _____ () C:\Users\*******\AppData\Local\Google\Chrome\Application\29.0.1547.66\libegl.dll ==================== Alternate Data Streams (whitelisted) ========== ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (09/12/2013 03:24:30 AM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (09/11/2013 07:27:40 AM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (09/10/2013 07:15:52 AM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (09/09/2013 08:18:39 PM) (Source: Windows Search Service) (User: ) Description: Eintrag <C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\MCAFEE\MCAFEE INTERNET SECURITY SUITE.LNK> in der Hash-Zuordnung kann nicht aktualisiert werden. Kontext: Anwendung, SystemIndex Katalog Details: Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f) Error: (09/09/2013 08:18:39 PM) (Source: Windows Search Service) (User: ) Description: Eintrag <C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\MCAFEE\MCAFEE INTERNET SECURITY SUITE.LNK> in der Hash-Zuordnung kann nicht aktualisiert werden. Kontext: Anwendung, SystemIndex Katalog Details: Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f) Error: (09/09/2013 08:18:39 PM) (Source: Windows Search Service) (User: ) Description: Eintrag <C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\MCAFEE\MCAFEE INTERNET SECURITY SUITE.LNK> in der Hash-Zuordnung kann nicht aktualisiert werden. Kontext: Anwendung, SystemIndex Katalog Details: Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f) Error: (09/09/2013 08:18:39 PM) (Source: Windows Search Service) (User: ) Description: Eintrag <C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\MCAFEE\MCAFEE INTERNET SECURITY SUITE.LNK> in der Hash-Zuordnung kann nicht aktualisiert werden. Kontext: Anwendung, SystemIndex Katalog Details: Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f) Error: (09/09/2013 00:20:25 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (09/09/2013 07:35:14 AM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (09/08/2013 09:17:57 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 System errors: ============= Error: (09/12/2013 03:24:32 AM) (Source: Service Control Manager) (User: ) Description: i8042prt Error: (09/12/2013 03:24:08 AM) (Source: Microsoft-Windows-TaskScheduler) (User: NT-AUTORITÄT) Description: 2147942402 Error: (09/11/2013 07:27:40 AM) (Source: Service Control Manager) (User: ) Description: i8042prt Error: (09/11/2013 07:26:01 AM) (Source: Microsoft-Windows-TaskScheduler) (User: NT-AUTORITÄT) Description: 2147942402 Error: (09/10/2013 07:15:52 AM) (Source: Service Control Manager) (User: ) Description: i8042prt Error: (09/10/2013 07:14:15 AM) (Source: Microsoft-Windows-TaskScheduler) (User: NT-AUTORITÄT) Description: 2147942402 Error: (09/09/2013 00:20:25 PM) (Source: Service Control Manager) (User: ) Description: i8042prt Error: (09/09/2013 00:18:48 PM) (Source: Microsoft-Windows-TaskScheduler) (User: NT-AUTORITÄT) Description: 2147942402 Error: (09/09/2013 07:35:14 AM) (Source: Service Control Manager) (User: ) Description: i8042prt Error: (09/09/2013 07:33:36 AM) (Source: Microsoft-Windows-TaskScheduler) (User: NT-AUTORITÄT) Description: 2147942402 Microsoft Office Sessions: ========================= Error: (09/12/2013 03:24:30 AM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (09/11/2013 07:27:40 AM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (09/10/2013 07:15:52 AM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (09/09/2013 08:18:39 PM) (Source: Windows Search Service)(User: ) Description: Kontext: Anwendung, SystemIndex Katalog Details: Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f) C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\MCAFEE\MCAFEE INTERNET SECURITY SUITE.LNK Error: (09/09/2013 08:18:39 PM) (Source: Windows Search Service)(User: ) Description: Kontext: Anwendung, SystemIndex Katalog Details: Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f) C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\MCAFEE\MCAFEE INTERNET SECURITY SUITE.LNK Error: (09/09/2013 08:18:39 PM) (Source: Windows Search Service)(User: ) Description: Kontext: Anwendung, SystemIndex Katalog Details: Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f) C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\MCAFEE\MCAFEE INTERNET SECURITY SUITE.LNK Error: (09/09/2013 08:18:39 PM) (Source: Windows Search Service)(User: ) Description: Kontext: Anwendung, SystemIndex Katalog Details: Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f) C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\MCAFEE\MCAFEE INTERNET SECURITY SUITE.LNK Error: (09/09/2013 00:20:25 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (09/09/2013 07:35:14 AM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (09/08/2013 09:17:57 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 CodeIntegrity Errors: =================================== Date: 2011-03-22 12:33:37.833 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\PROGRA~1\McAfee\SITEAD~1\sahook.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2011-03-22 12:33:37.768 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\PROGRA~1\McAfee\SITEAD~1\sahook.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2011-03-21 14:14:25.996 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\PROGRA~1\McAfee\SITEAD~1\sahook.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2011-03-21 14:14:25.992 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\PROGRA~1\McAfee\SITEAD~1\sahook.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2010-06-24 15:38:44.476 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\SweetIM\Messenger\mgAdaptersProxy.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2010-06-24 15:38:44.308 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\SweetIM\Messenger\mgAdaptersProxy.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2010-05-12 10:06:32.362 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\SweetIM\Messenger\mgAdaptersProxy.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2010-05-12 10:06:32.200 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\SweetIM\Messenger\mgAdaptersProxy.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2010-03-17 21:00:50.923 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\BullGuard Ltd\BullGuard\Antispam\PluginHook.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2010-03-17 21:00:50.636 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\BullGuard Ltd\BullGuard\Antispam\PluginHook.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. ==================== Memory info =========================== Percentage of memory in use: 72% Total physical RAM: 3070.39 MB Available physical RAM: 850.69 MB Total Pagefile: 6354.93 MB Available Pagefile: 3245.68 MB Total Virtual: 2047.88 MB Available Virtual: 1922.51 MB ==================== Drives ================================ Drive c: (BOOT) (Fixed) (Total:576.17 GB) (Free:442.73 GB) NTFS ==>[Drive with boot components (obtained from BCD)] Drive d: (RECOVER) (Fixed) (Total:19.99 GB) (Free:4.1 GB) FAT32 ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 596 GB) (Disk ID: F98D6E74) Partition 1: (Active) - (Size=576 GB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=20 GB) - (Type=OF Extended) ==================== End Of Log ============================ Der Log-File von Spybot - Search & Destroy Code:
ATTFilter Search results from Spybot - Search & Destroy 13.09.2013 09:07:15 Scan took 00:19:38. 47 items found. Babylon.Toolbar: [SBI $B04483F7] Root class (Registry Key, nothing done) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr Babylon.Toolbar: [SBI $B04483F7] Root class (Registry Key, nothing done) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr.1 Babylon.Toolbar: [SBI $B04483F7] Root class (Registry Key, nothing done) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr.1 Babylon.Toolbar: [SBI $B04483F7] Root class (Registry Key, nothing done) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr Babylon.Toolbar: [SBI $5FA838EA] Settings (Registry Key, nothing done) HKEY_LOCAL_MACHINE\SOFTWARE\Google\chrome\Extensions\dhkplhfnhceodhffomolpfigojocbpcb W3i.IQ5.fraud: [SBI $467B1F92] Settings (Registry Key, nothing done) HKEY_LOCAL_MACHINE\SOFTWARE\Freeze.com W3i.IQ5.fraud: [SBI $678078F9] Settings (Registry Key, nothing done) HKEY_LOCAL_MACHINE\SOFTWARE\W3i SweetIM: [SBI $17116D02] IE start page (Registry Change, nothing done) HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Start Page SweetIM: [SBI $17116D02] IE start page (Registry Change, nothing done) HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Start Page Montera.Toolbar: [SBI $C595B0E4] Settings (Registry Key, nothing done) HKEY_CLASSES_ROOT\AppID\{09C554C3-109B-483C-A06B-F14172F1A947} Montera.Toolbar: [SBI $2212EF94] Settings (Registry Key, nothing done) HKEY_CLASSES_ROOT\AppID\escort.DLL Win32.Downloader.gen: [SBI $E6AD2227] Program directory (Directory, nothing done) C:\Users\Nadine Popich\AppData\Local\Conduit\ Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done) HKEY_USERS\S-1-5-21-2375695433-3522556619-247360529-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done) HKEY_USERS\.DEFAULT\Software\Microsoft\Direct3D\MostRecentApplication\Name MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done) HKEY_USERS\S-1-5-21-2375695433-3522556619-247360529-1000\Software\Microsoft\Direct3D\MostRecentApplication\Name MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done) HKEY_USERS\S-1-5-18\Software\Microsoft\Direct3D\MostRecentApplication\Name MS DirectInput: [SBI $9A063C91] Most recent application (Registry Change, nothing done) HKEY_USERS\S-1-5-21-2375695433-3522556619-247360529-1000\Software\Microsoft\DirectInput\MostRecentApplication\Name MS DirectInput: [SBI $7B184199] Most recent application ID (Registry Change, nothing done) HKEY_USERS\S-1-5-21-2375695433-3522556619-247360529-1000\Software\Microsoft\DirectInput\MostRecentApplication\Id MS DirectInput: [SBI $6533916A] Last mapped application ID (Registry Change, nothing done) HKEY_USERS\S-1-5-21-2375695433-3522556619-247360529-1000\Software\Microsoft\DirectInput\MostRecentMapperApplication\ID MS DirectInput: [SBI $31B11F6A] Last mapped application (Registry Change, nothing done) HKEY_USERS\S-1-5-21-2375695433-3522556619-247360529-1000\Software\Microsoft\DirectInput\MostRecentMapperApplication\Name MS Office 12.0: [SBI $31A61065] Internet history (Registry Value, nothing done) HKEY_USERS\S-1-5-21-2375695433-3522556619-247360529-1000\Software\Microsoft\Office\12.0\Common\Internet\UseRWHlinkNavigation Windows.OpenWith: [SBI $F7204896] Open with list - .AVI extension (Registry Key, nothing done) HKEY_USERS\S-1-5-21-2375695433-3522556619-247360529-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AVI\OpenWithList Windows.OpenWith: [SBI $A1C94E79] Open with list - .BMP extension (Registry Key, nothing done) HKEY_USERS\S-1-5-21-2375695433-3522556619-247360529-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.BMP\OpenWithList Windows.OpenWith: [SBI $63036C95] Open with list - .CAB extension (Registry Key, nothing done) HKEY_USERS\S-1-5-21-2375695433-3522556619-247360529-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.CAB\OpenWithList Windows.OpenWith: [SBI $9E8D5C8A] Open with list - .CDA extension (Registry Key, nothing done) HKEY_USERS\S-1-5-21-2375695433-3522556619-247360529-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.CDA\OpenWithList Windows.OpenWith: [SBI $7681FFE3] Open with list - .CDR extension (Registry Key, nothing done) HKEY_USERS\S-1-5-21-2375695433-3522556619-247360529-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.CDR\OpenWithList Windows.OpenWith: [SBI $951FC477] Open with list - .CDT extension (Registry Key, nothing done) HKEY_USERS\S-1-5-21-2375695433-3522556619-247360529-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.CDT\OpenWithList Windows.OpenWith: [SBI $ECC28BDF] Open with list - .CSV extension (Registry Key, nothing done) HKEY_USERS\S-1-5-21-2375695433-3522556619-247360529-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.CSV\OpenWithList Windows Explorer: [SBI $AA0766B5] Stream history (Registry Key, nothing done) HKEY_USERS\S-1-5-21-2375695433-3522556619-247360529-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU Windows Explorer: [SBI $2026AFB6] User Assistant history IE (Registry Key, nothing done) HKEY_USERS\S-1-5-21-2375695433-3522556619-247360529-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count Windows Explorer: [SBI $6107D172] User Assistant history files (Registry Key, nothing done) HKEY_USERS\S-1-5-21-2375695433-3522556619-247360529-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count Windows Explorer: [SBI $D20DA0AD] Recent file global history (Registry Key, nothing done) HKEY_USERS\S-1-5-21-2375695433-3522556619-247360529-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs Windows Media SDK: [SBI $37AAEDE6] Computer name (Registry Change, nothing done) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows Media\WMSDK\General\ComputerName Windows Media SDK: [SBI $37AAEDE6] Computer name (Registry Change, nothing done) HKEY_USERS\S-1-5-21-2375695433-3522556619-247360529-1000\Software\Microsoft\Windows Media\WMSDK\General\ComputerName Windows Media SDK: [SBI $37AAEDE6] Computer name (Registry Change, nothing done) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows Media\WMSDK\General\ComputerName Windows Media SDK: [SBI $CAA58B6E] Unique ID (Registry Change, nothing done) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows Media\WMSDK\General\UniqueID Windows Media SDK: [SBI $CAA58B6E] Unique ID (Registry Change, nothing done) HKEY_USERS\S-1-5-21-2375695433-3522556619-247360529-1000\Software\Microsoft\Windows Media\WMSDK\General\UniqueID Windows Media SDK: [SBI $CAA58B6E] Unique ID (Registry Change, nothing done) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows Media\WMSDK\General\UniqueID Windows Media SDK: [SBI $BACCD0DA] Volume serial number (Registry Value, nothing done) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows Media\WMSDK\General\VolumeSerialNumber Windows Media SDK: [SBI $BACCD0DA] Volume serial number (Registry Value, nothing done) HKEY_USERS\S-1-5-21-2375695433-3522556619-247360529-1000\Software\Microsoft\Windows Media\WMSDK\General\VolumeSerialNumber Windows Media SDK: [SBI $BACCD0DA] Volume serial number (Registry Value, nothing done) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows Media\WMSDK\General\VolumeSerialNumber Cookie: [SBI $49804B54] Browser: Cookie (4) (Browser: Cookie, nothing done) Cache: [SBI $49804B54] Browser: Cache (136) (Browser: Cache, nothing done) Cookie: [SBI $49804B54] Browser: Cookie (106) (Browser: Cookie, nothing done) Verlauf: [SBI $49804B54] Browser: History (283) (Browser: History, nothing done) --- Spybot - Search & Destroy version: 2.1.18.131 DLL (build: 20130516) --- 2013-05-16 blindman.exe (2.1.18.151) 2013-05-16 explorer.exe (2.1.18.177) 2013-05-16 SDBootCD.exe (2.1.18.109) 2013-05-16 SDCleaner.exe (2.1.18.110) 2013-05-16 SDDelFile.exe (2.1.18.94) 2013-06-18 SDDisableProxy.exe 2013-05-16 SDFiles.exe (2.1.18.135) 2013-03-20 SDFileScanHelper.exe (2.1.16.1) 2013-05-16 SDFSSvc.exe (2.1.18.208) 2013-05-16 SDHookHelper.exe (2.1.18.2) 2013-05-16 SDHookInst32.exe (2.1.18.2) 2013-05-16 SDImmunize.exe (2.1.18.130) 2013-05-16 SDLogReport.exe (2.1.18.107) 2013-05-16 SDOnAccess.exe (2.1.18.4) 2013-05-16 SDPESetup.exe (2.1.18.3) 2013-05-16 SDPEStart.exe (2.1.18.86) 2013-05-16 SDPhoneScan.exe (2.1.18.28) 2013-05-16 SDPRE.exe (2.1.18.22) 2013-05-16 SDPrepPos.exe (2.1.18.10) 2013-05-16 SDQuarantine.exe (2.1.18.103) 2013-05-16 SDRootAlyzer.exe (2.1.18.116) 2013-05-16 SDSBIEdit.exe (2.1.18.39) 2013-05-16 SDScan.exe (2.1.18.177) 2013-05-16 SDScript.exe (2.1.18.53) 2013-05-16 SDSettings.exe (2.1.18.136) 2013-05-16 SDShell.exe (2.1.18.2) 2013-05-16 SDShred.exe (2.1.18.107) 2013-05-16 SDSysRepair.exe (2.1.18.101) 2013-05-16 SDTools.exe (2.1.18.150) 2013-07-25 SDTray.exe (2.1.21.129) 2013-05-16 SDUpdate.exe (2.1.18.91) 2013-05-16 SDUpdSvc.exe (2.1.18.76) 2013-07-10 SDWelcome.exe (2.1.21.129) 2013-05-15 SDWSCSvc.exe (2.1.18.2) 2013-06-19 spybotsd2-translation-frx.exe 2013-09-13 unins000.exe (51.1052.0.0) 1999-12-02 xcacls.exe 2012-08-23 borlndmm.dll (10.0.2288.42451) 2012-09-05 DelZip190.dll (1.9.0.107) 2012-09-10 libeay32.dll (1.0.0.4) 2012-09-10 libssl32.dll (1.0.0.4) 2013-05-16 SDAdvancedCheckLibrary.dll (2.1.18.98) 2013-05-16 SDAV.dll 2013-05-16 SDECon32.dll (2.1.18.113) 2013-04-05 SDEvents.dll (2.1.16.2) 2013-05-16 SDFileScanLibrary.dll (2.1.18.12) 2013-05-16 SDHook32.dll (2.1.18.2) 2013-05-16 SDImmunizeLibrary.dll (2.1.18.2) 2013-05-16 SDLicense.dll (2.1.18.0) 2013-05-16 SDLists.dll (2.1.18.4) 2013-05-16 SDResources.dll (2.1.18.7) 2013-05-16 SDScanLibrary.dll (2.1.18.131) 2013-05-16 SDTasks.dll (2.1.18.15) 2013-05-16 SDWinLogon.dll (2.1.18.0) 2012-08-23 sqlite3.dll 2012-09-10 ssleay32.dll (1.0.0.4) 2013-05-16 Tools.dll (2.1.18.36) 2012-12-18 Includes\Adware.sbi (*) 2013-09-11 Includes\AdwareC.sbi (*) 2010-08-13 Includes\Cookies.sbi (*) 2012-11-14 Includes\Dialer.sbi (*) 2012-11-14 Includes\DialerC.sbi (*) 2012-11-14 Includes\HeavyDuty.sbi (*) 2012-11-14 Includes\Hijackers.sbi (*) 2012-11-14 Includes\HijackersC.sbi (*) 2013-09-10 Includes\iPhone.sbi (*) 2013-06-25 Includes\Keyloggers.sbi (*) 2012-12-18 Includes\KeyloggersC.sbi (*) 2013-05-29 Includes\Malware.sbi (*) 2013-09-11 Includes\MalwareC.sbi (*) 2012-11-14 Includes\PUPS.sbi (*) 2013-09-10 Includes\PUPSC.sbi (*) 2012-11-14 Includes\Security.sbi (*) 2012-11-14 Includes\SecurityC.sbi (*) 2013-05-22 Includes\Spyware.sbi (*) 2013-08-06 Includes\SpywareC.sbi (*) 2011-06-07 Includes\Tracks.sbi (*) 2012-11-19 Includes\Tracks.uti (*) 2013-01-16 Includes\Trojans.sbi (*) 2013-05-13 Includes\TrojansC-02.sbi (*) 2013-07-31 Includes\TrojansC-03.sbi (*) 2013-09-10 Includes\TrojansC-04.sbi (*) 2013-05-08 Includes\TrojansC-05.sbi (*) 2013-08-06 Includes\TrojansC.sbi (*) Zitat:
Zitat:
Dann sollte ich ja mal das booten im abgesicherten Modus probieren, aber da bin ich mir total unsicher, da folgendes kam: Zitat:
Wäre nett, wenn mir jemand sagen könnte, was ich verändern oder machen soll, wenn es möglich ist! Noch eine Frage im Nachhinein, woher weiß ich ob ich in all den Logdateien alle meine Kennungen weggenommen habe? Oder kann jetzt jeder Hinz und Kunz mich ausspionieren und so was? Danke schon mal!
__________________ Ich bin ein Neuling und habe doch gar nicht so viel Ahnung! Bitte bedenkt das! Das wäre nett! schon mal im voraus! Geändert von Nicht-Elfe (13.09.2013 um 10:24 Uhr) |
13.09.2013, 10:47 | #2 |
/// the machine /// TB-Ausbilder | Win32.Downloader.gen & Montera.Toolbar mit Spybot gefunden hi,
__________________Downloade Dir bitte Malwarebytes Anti-Malware
Downloade Dir bitte AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ |
13.09.2013, 12:47 | #3 |
| Win32.Downloader.gen & Montera.Toolbar mit Spybot gefunden Hallo!
__________________Ich danke schon mal für die schnelle Antwort! Habe hoffentlich nichts vergessen! Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.09.13.04 Windows Vista Service Pack 2 x86 NTFS Internet Explorer 9.0.8112.16421 ********* :: ********* [Administrator] 13.09.2013 12:32:14 mbam-log-2013-09-13 (12-32-14).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 219196 Laufzeit: 4 Minute(n), 56 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Code:
ATTFilter # AdwCleaner v3.003 - Bericht erstellt am 13/09/2013 um 12:40:33 # Updated 07/09/2013 von Xplode # Betriebssystem : Windows Vista (TM) Home Premium Service Pack 2 (32 bits) # Benutzername : *********** # Gestartet von : C:\Users\**********\Desktop\adwcleaner.exe # Option : Suchen ***** [ Dienste ] ***** ***** [ Dateien / Ordner ] ***** Ordner Gefunden C:\Users\*********\AppData\LocalLow\Conduit Ordner Gefunden C:\Users\*********\AppData\LocalLow\SweetIM Ordner Gefunden C:\Users\*********\AppData\Local\Temp\OCS ***** [ Verknüpfungen ] ***** ***** [ Registrierungsdatenbank ] ***** Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\PriceGong Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19} Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B} Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\conduitEngine Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\grusskartencenter.com Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\grusskartencenter.com Schlüssel Gefunden : HKCU\Software\OCS Schlüssel Gefunden : HKCU\Software\Softonic Schlüssel Gefunden : HKCU\Software\YahooPartnerToolbar Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947} Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\escort.DLL Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Conduit.Engine Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Prod.cap Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Toolbar.CT2319825 Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Toolbar.CT2475029 Schlüssel Gefunden : HKLM\Software\Conduit Schlüssel Gefunden : HKLM\SOFTWARE\Google\Chrome\Extensions\bcjagnifjocnddgeknajocbkkhlgibem Schlüssel Gefunden : HKLM\SOFTWARE\Google\Chrome\Extensions\dhkplhfnhceodhffomolpfigojocbpcb Schlüssel Gefunden : HKLM\Software\ICQ\ICQToolbar Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EEE6C367-6118-11DC-9C72-001320C79847} Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B} Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search] Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}] Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{40C3CC16-7269-4B32-9531-17F2950FB06F}] Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{A1E75A0E-4397-4BA8-BB50-E19FB66890F4}] Wert Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{855F3B16-6D32-4FE6-8A56-BBB695989046}] ***** [ Browser ] ***** -\\ Internet Explorer v9.0.8112.16506 Einstellung Gefunden : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search] - hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd Einstellung Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page] - hxxp://home.sweetim.com -\\ Google Chrome v [ Datei : C:\Users\*********\AppData\Local\Google\Chrome\User Data\Default\preferences ] ************************* AdwCleaner[R0].txt - [3385 octets] - [13/09/2013 12:40:33] ########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [3445 octets] ########## Code:
ATTFilter Junkware Removal Tool (JRT) by Thisisu Version: 6.0.0 (09.12.2013:1) OS: Windows Vista (TM) Home Premium x86 Ran by ********* on 13.09.2013 at 12:59:49,17 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\protector_dll.protectorbho Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\protector_dll.protectorbho.1 Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-2375695433-3522556619-247360529-1000\Software\SweetIM Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{75676AC7-9E6C-4658-B5AF-9AD86763C8C9} ~~~ Files ~~~ Folders Successfully deleted: [Folder] "C:\Windows\system32\ai_recyclebin" Successfully deleted: [Empty Folder] C:\Users\ ********* \appdata\local\{0009A2BE-64E3-4D77-95A2-6AA177E91C4E} Successfully deleted: [Empty Folder] C:\Users\ ********* \appdata\local\{01CBDD71-812F-4D63-AA30-3D1927211B56} Successfully deleted: [Empty Folder] C:\Users\ ********* \appdata\local\{0214AF38-4198-41BB-BEB6-C156D65CF93E} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{023CABA2-5F83-4F0C-B2F1-D050D0ABDA03} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{02CE99AC-A758-4C7C-A98D-D2086EC8D690} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{04E5E395-2575-40F4-8B41-992476B4ED5D} Successfully deleted: [Empty Folder] C:\Users\********* appdata\local\{06B52DF6-679A-41C5-80C0-322138BBAB11} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{07E0EBCF-03FF-4296-9789-7422E4F517C4} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{0A519A9D-890C-4690-B256-C979963778C5} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{0AC4AD7B-BA34-421C-85C8-440B0A18D6E6} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{0B8E5A76-8443-4B69-886B-4C5C4AB12416} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{1090DDE5-9FAE-4F2B-B336-33935DEA3FF2} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{12AB9CC2-3624-4E1D-8D10-7EC7007AFB1F} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{1D3AFCD0-E2C1-45B0-A6B8-525EF24739C8} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{1D4EF285-965C-4B1C-ADD1-7BBDE4FA78FE} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{1E7AB8D1-4693-4490-A937-530F5A734897} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{1F077221-1FDD-48C4-B855-CE5C91CA6C0D} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{1FF2C205-6FD5-47C8-990A-33064B8C5D7C} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{2127FC19-5D9E-41D9-9C3B-86C4AF8F8D5D} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{22E9D174-E391-41A9-A728-F5DF1940314F} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{27FCEE81-06F0-4FE3-88FB-C6403DC012D3} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{28C41F6D-41F0-467B-8E78-001F60CAAD03} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{2965410C-FF71-421F-BB37-492C333B8BB3} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{2A70BA10-6D2D-418D-9305-48C01535A3C3} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{2E6DA13D-F1B1-47D4-BA17-E64814EAD7EB} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{32E3B133-6AA0-4E91-8FD5-E138DD3FB66D} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{34458BF3-3E08-432A-A342-E253CC058D18} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{3592B113-0794-4461-B3D6-71208BCEACA9} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{3B20A935-8EC7-4665-8A66-C04034BAB7BD} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{3BB419D5-B661-4EDB-A3E9-01A26D9ABCED} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{3C29F982-2FC6-42BA-89E8-A8FEA60EAA20} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{3D358603-4E58-4975-B165-6116EF9AF2D8} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{3D779380-4F5E-47AD-AD14-0AAED2D7B78E} Successfully deleted: [Empty Folder] C:\Users********* \appdata\local\{3EE1A75C-0370-40E0-B81A-A1D842757377} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{3EEC459F-CB86-44F3-AACB-46EE5E3C35DA} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{3FFEC3BD-BE63-4303-BB01-72F4A5697ACC} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{414FADC8-6D53-4044-9B8F-EB24331359CE} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{4167D7A6-8DAC-4816-97E5-279BC90B5540} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{43D34395-A723-4C95-BA60-A469D364C75B} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{43DDE4FE-762B-4D53-9EFB-6C7D9703D9EF} Successfully deleted: [Empty Folder] C:\Users\********* appdata\local\{47A7F2F5-D6B2-4090-B213-28EDD3450A2A} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{4A693585-1FFE-483B-AB6D-B3615AC2FA46} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{4A7D9908-902A-402A-A07E-FEC31A637E59} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{4C707428-C436-459C-8EC7-6ECAA9B82C45} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{4EB50AF3-422F-4BDB-96C8-A6F28E658051} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{4FF1095F-936C-49D4-AFBF-62D5481BBE39} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{50BCCC1C-105E-493E-AE12-6349E4BA3CC8} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{52805A9F-A5D7-4E6F-BEC8-4A5DE5281AB2} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{5697EBE6-EF5A-4D76-9871-A4F85B7E92BF} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{5A786280-F004-48F0-ADA1-94464E2FBF64} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{5BEE21BA-9D30-40AE-B5D0-A5EFADFEA172} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{5BF5B5A4-4DC3-4061-9E5A-857F9D6D8D4B} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{5C65F193-AF4B-46CA-8143-C588CACC9A61} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{5CEF4FE9-ABB8-4598-8CCE-3E567D029A30} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{5FD7AF9F-F0E4-48A1-A082-CBDAEC7679AF} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{5FFAD5CF-9598-4D38-B5E7-C8D5B40D43BA} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{61B5EEAD-DB56-42DC-899B-9CB6E646EB18} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{6259304E-8ACF-452E-930C-E346840C0BBE} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{632AEA1F-70BB-4CE5-8D89-8D019FA2ED4D} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{6ACDA711-5AE6-4259-910D-6C9597FBAAFC} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{6B814611-7935-43F8-9D95-518AB55739C0} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{6C1B7330-7587-4622-8759-8D1BDDB73189} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{6C8B1CC2-CEF4-4E6C-9B25-C6621B6FF220} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{6E165CEB-7D24-4877-9A81-5568D8F8C7F2} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{6F8CB35D-7FF5-43CB-93BE-CB22478BFE80} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{71D186C8-8C92-4EB1-9A7C-75A176F1CD07} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{752A8C2A-8B72-4056-BA34-9D00BAB21FA1} Successfully deleted: [Empty Folder] C:\Users\******** \appdata\local\{78E5F872-776E-4895-ADB3-2005792E84BA} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{79D1021A-6C59-48CE-969D-615205C3EB31} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{7A2ABACE-8F6C-4627-8ECD-3AAF658063BF} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{7BA5AF50-3821-4865-A952-F49DFBAA406C} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{7C815284-CB19-4B43-9AE3-0B054F0A5FF7} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{7D7B819C-0A65-4F1B-A315-4B266BC0B358} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{7E802D21-8FEB-4BCC-BBD2-9CD294751D25} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{8280B45C-30E4-4768-80A9-83AE9727D7E1} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{82B3F5F9-CA8E-4CFD-845F-69E3FA56B3AB} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{83940037-9E4B-4A19-B8B5-982496A9EE1D} Successfully deleted: [Empty Folder] C:\Users\********* appdata\local\{84B4B1F8-8FDF-4EA9-885A-51E02BB92B30} Successfully deleted: [Empty Folder] C:\Users\N********* \appdata\local\{85618E8D-9DF7-43BF-8F92-5D542D8F6555} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{86CC5FE7-CF75-406D-A984-22977EA8AF7F} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{883829DD-9D75-4559-B761-B900F6910B16} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{89E8C72D-834D-4F44-9A0A-0CDDBCF1ADE0} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{8B7D386D-C8BD-4610-AB5B-6C3C6AC98892} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{8B7ECABF-757E-4909-8F6E-731880EF26FD} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{8BFBB3FD-C4ED-4DF3-A4EA-A81F5ED6EA30} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{8E839CC3-388E-4F29-A433-790980FFD63B} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{93ADFFED-660F-45CB-BB31-6D1E812364A5} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{958D6635-0F2E-42A4-8A5E-CC8E74632D0B} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{986393EA-6E2B-45A2-AB5C-EB4F6266D866} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{9A6C2E69-549F-4475-A66B-36651123A5FA} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{9AC91C9A-3393-43CE-A1ED-11FA818DE6A6} Successfully deleted: [Empty Folder] C:\Users\********* Successfully deleted: [Empty Folder] C:\Users\********* appdata\local\{9B65B307-482F-4892-93BD-3C25EBA56E53} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{9C709C2E-53EA-408E-8C0B-EB7DAB5E9368} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{9FA03B26-4DDD-41F1-A23C-355D8B00CA4B} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{A048A6D8-51A1-4F6B-AB5C-AE02E142A8F8} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{A2F95E75-08F3-43B7-989A-613A1A195C72} Successfully deleted: [Empty Folder] C:\Users********* \appdata\local\{A3EC4867-6312-4C3C-AA2B-CA6756CEEF34} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{A49734EE-A712-4236-9044-CEF809203022} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{A4FA4881-B9A2-4937-BB12-5B297EB38FC6} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{A62005B3-67A2-4592-BE76-6751113B858B} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{A81F0251-DB6F-4427-9C16-72C8CC0DFE38} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{A844735A-9D3D-43A7-8EBC-B30CB3D715E1} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{A9E2B4EB-9AD0-451D-959B-4F58D9ED1E88} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{ABF231CC-9641-41C7-9DF4-32BD178704D4} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{AF549564-2587-4AB0-AC5C-7FA868C9077B} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{B01B7994-8F15-4E52-AB24-335C6C91A1CD} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{B0ED3D42-AEC4-4837-9D9F-CD6BE45DA8AB} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{B1CF0239-D5C3-4A9B-AB23-9A03CBBA6041} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{B24C3770-2444-4275-96BB-5132E86D11DB} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{B36B321B-511F-4A73-8EEB-74AED2F0D7F9} Successfully deleted: [Empty Folder] C:\Users\********* appdata\local\{B419DA4D-010E-4D0E-BB84-747C8DDC14A9} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{B70D01C2-B0CA-4DD0-AB98-BFB343364337} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{B7C9630C-76B5-46C2-AA2F-C69CC097A790} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{B942726C-15F5-46CF-B5B7-4BFEACEDF972} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{B970AF11-BE27-4A08-AE31-C2B7749CEEB5} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{BCFBD416-39E2-463A-B150-AA6B2F209549} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{BD6A886F-9825-48F6-8331-B031AA811843} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{BD76E943-6F5A-44C3-8CD6-897533D34E18} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{BF2242DF-A91F-4BC1-9488-212ADB715DA7} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{BF7B6121-A717-4825-A1D5-3BBBD99CF77F} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{C0241366-AAC7-4C97-9AA3-8A441ED107E6} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{C14D5955-ACB3-4CE1-A3EC-750C246DC3ED} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{C2AE8507-0F91-46E8-9358-2975ED69B795} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{C475FFA8-3762-45D2-947E-11E805F6E64A} Successfully deleted: [Empty Folder] C:\Users********* \appdata\local\{C57865CB-C0D7-41B2-8ED1-3E0D14FC7547} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{C63FA7A2-7E6A-413D-8A14-B8E203DA0CF4} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{C8671393-2658-4F6E-A24A-02C2C1238502} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{CAA5F85B-F87C-4B35-BEBB-F1D0DFB058BD} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{D08B2D0F-D4F8-4A48-A51B-D285043978CF} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{D23772D2-EF71-43BC-B626-98C9A934BE9D} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{D283EACC-54B6-4C67-9B66-5EAD46536419} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{D3280C36-CE19-4C83-B91A-372BC0F4E74A} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{D3574B25-5FEF-4D5C-8C84-CF81539F9E1F} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{D81B4D2C-ED38-42F4-B215-C1B8164646E9} Successfully deleted: [Empty Folder] C:\Users********* \appdata\local\{DB035400-6CEC-44D0-8C78-ABE0E880C9DF} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{DB339958-696E-4DCE-9436-A34AEA1F7C2D} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{DD834A8F-BFE8-4593-A57C-11B8D37BCAD9} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{DDEEBA34-93E2-4784-9CBD-5BD5A67DE5A3} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{DF78A57A-B58D-422D-8CAC-A5EB2789C3D8} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{E2B04290-1C10-442F-AE9C-03F0BA6F5576} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{E4AB86BF-430F-49B5-A19C-6B7DBA4CCCF3} Successfully deleted: [Empty Folder] C:\Users\*********\appdata\local\{E83486E1-2413-4C89-B23D-D9BB3D356495} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{E8F8F824-FECF-44D0-8B52-EEF2E16A9669} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{EB4A89EF-FCCF-4B88-98C1-27839ED85694} Successfully deleted: [Empty Folder] C:\Users\********* appdata\local\{ECCE1A12-DB7C-4A22-8107-5A346215AB2A} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{EDABEBB9-4D57-4EE4-8257-8441EFB346E5} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{F0BCE7D6-4C75-43EE-98EA-A9824934B961} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{F2806AF5-3D1F-4955-B198-198D0830B44D} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{F455CCEF-1291-4506-ACFD-53B69D5A302B} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{F5B160BB-1CC7-4454-8035-AF883046ED39} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{F9788FC4-2C55-4C68-AE15-56649A7CF1A2} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{FA6F4447-D824-431F-80B5-5DCA14384661} Successfully deleted: [Empty Folder] C:\Users\********* appdata\local\{FD24DD2A-0101-44BB-8AE8-763F4C99BFF1} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{FD3FFAFD-3CA9-48ED-8830-41936883A22E} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{FDB0605D-6B5A-4300-92B4-25EFC78E52DC} Successfully deleted: [Empty Folder] C:\Users\********* \appdata\local\{FDC4F4CD-7CF3-4C0C-8E5B-083A933EA5A4} ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 13.09.2013 at 13:02:49,93 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 13-09-2013 Ran by ********* (administrator) on ********* on 13-09-2013 13:06:04 Running from C:\Users\*********\Downloads Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: German Standard Internet Explorer Version 9 Boot Mode: Normal ==================== Processes (Whitelisted) =================== (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe (Microsoft Corporation) C:\Windows\system32\SLsvc.exe (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe (AVM Berlin) C:\Program Files\1&1\IGDCTRL.EXE () C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE (McAfee, Inc.) C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe () C:\Windows\system32\PSIService.exe (Protexis Inc.) c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe (Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe (McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe (McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe (Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe (Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe (Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (McAfee, Inc.) C:\Program Files\McAfee.com\Agent\mcagent.exe (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe (Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation) C:\Windows\ehome\ehtray.exe (Google Inc.) C:\Users\*********\AppData\Local\Google\Update\GoogleUpdate.exe () C:\Program Files\Pando Networks\Media Booster\PMB.exe (Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe (McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.0.318\SSScheduler.exe (AVM Berlin) C:\Program Files\1&1\FwebProt.exe (Google Inc.) C:\Users\*********\AppData\Local\Google\Update\1.3.21.153\GoogleCrashHandler.exe (OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.exe (Microsoft Corporation) C:\Windows\ehome\ehmsas.exe (OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.bin (Microsoft Corporation) C:\Windows\system32\werfault.exe (AVM Berlin) C:\Program Files\1&1\StCenter.EXE (McAfee, Inc.) C:\Program Files\Common Files\McAfee\Core\mchost.exe (Microsoft Corporation) C:\Windows\system32\wuauclt.exe (Microsoft Corporation) C:\Windows\system32\conime.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-21] (Microsoft Corporation) HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7625248 2009-07-20] (Realtek Semiconductor) HKLM\...\Run: [mcui_exe] - C:\Program Files\McAfee.com\Agent\mcagent.exe [1278064 2013-03-13] (McAfee, Inc.) HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59240 2011-09-27] (Apple Inc.) HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation) HKLM\...\Run: [SDTray] - C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.) Winlogon\Notify\SDWinLogon: SDWinLogon.dll [X] HKLM\...\Policies\Explorer: [NoControlPanel] 0 HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [125952 2008-01-21] (Microsoft Corporation) HKCU\...\Run: [Google Update] - C:\Users\Nadine Popich\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2011-07-19] (Google Inc.) HKCU\...\Run: [Pando Media Booster] - C:\Program Files\Pando Networks\Media Booster\PMB.exe [3077528 2011-08-03] () HKCU\...\Run: [WMPNSCFG] - C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-21] (Microsoft Corporation) HKCU\...\RunOnce: [Shockwave Updater] - C:\Windows\system32\Adobe\Shockwave 11\SwHelper_1151601.exe -Update -1151601 -"Mozilla/5.0_(Windows;_U;_Windows_NT_6.0;_de;_rv:1.9.2.15)_Gecko/20110303_Firefox/3.6.15_ImageShackToolbar/5.2.4_(_.NET_CLR" -"hxxp://www.bbc.co.uk/gardening/htbg2/virtual_garden/shockwave/garden3.shtml" [468408 2009-07-21] (Adobe Systems, Inc.) HKU\Default\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter HKU\Default User\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter Startup: C:\Users\*********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL Protect.lnk ShortcutTarget: DSL Protect.lnk -> C:\Program Files\1&1\FwebProt.exe (AVM Berlin) Startup: C:\Users\*********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe () BootExecute: autocheck autochk * sdnclean.exe ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://medion.msn.com HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com URLSearchHook: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.) SearchScopes: HKLM - DefaultScope value is missing. SearchScopes: HKCU - {45327B16-694D-45D3-A8CE-1A70BD4129BD} URL = hxxp://go.1und1.de/suchbox/amazon?tag=1und1icon-21&field-keywords={searchTerms} SearchScopes: HKCU - {6FEADE84-B2D8-4804-A45C-186C6F16316B} URL = hxxp://go.web.de/suchbox/ebay?query={searchTerms} SearchScopes: HKCU - {77E63755-4D4D-45C8-A41B-95B51530E62C} URL = hxxp://go.web.de/suchbox/google?q={searchTerms} SearchScopes: HKCU - {A8113878-A6DD-4457-898A-8BE6E878D431} URL = hxxp://go.1und1.de/suchbox/1und1suche?su={searchTerms} SearchScopes: HKCU - {DEB7C54E-7B18-4429-ACAF-14ECBAEC8E62} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MEDTDF&pc=MAMD&src=IE-SearchBox BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.) BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.) Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File Toolbar: HKCU -Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.) Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.) Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\PROGRA~1\mcafee\msc\mcsniepl.dll (McAfee, Inc.) Winsock: Catalog5 07 C:\Program Files\1&1\\sarah.dll [24880] (AVM Berlin) Winsock: Catalog9 01 C:\Program Files\1&1\\sarah.dll [24880] (AVM Berlin) Winsock: Catalog9 02 C:\Program Files\1&1\\sarah.dll [24880] (AVM Berlin) Winsock: Catalog9 03 C:\Program Files\1&1\\sarah.dll [24880] (AVM Berlin) Winsock: Catalog9 14 C:\Program Files\1&1\\sarah.dll [24880] (AVM Berlin) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 Chrome: ======= CHR HomePage: about:home CHR RestoreOnStartup: "https://www.google.de/" CHR DefaultSearchURL: (google np) - hxxp://www.google.de/#hl=de&output=search&sclient=psy-ab&q={searchTerms}&oq=start&gs_l=hp.1.0.0l2j0i10j0.55868.57044.0.59638.5.5.0.0.0.0.178.724.0j5.5.0...0.0...1c.DmqGqs4Tml4&pbx=1&bav=on.2,or.r_gc.r_pw.r_qf.&fp=5e7fc900d9a88c5&biw=1024&bih=485 CHR DefaultSuggestURL: (google np) - "suggest_url": "", CHR Plugin: (Remoting Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Users\*********\AppData\Local\Google\Chrome\Application\29.0.1547.66\ppGoogleNaClPluginChrome.dll () CHR Plugin: (Chrome PDF Viewer) - C:\Users\Nadine Popich\AppData\Local\Google\Chrome\Application\29.0.1547.66\pdf.dll () CHR Plugin: (Shockwave Flash) - C:\Users\Nadine Popich\AppData\Local\Google\Chrome\User Data\NPAPIFlash\gcswf32.dll No File CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll () CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.) CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin2.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin3.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin4.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin5.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin6.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin7.dll (Apple Inc.) CHR Plugin: (CANON iMAGE GATEWAY Album Plugin Utility) - C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.) CHR Plugin: (Picasa) - C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.) CHR Plugin: (Java(TM) Platform SE 6 U31) - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll No File CHR Plugin: (McAfee SiteAdvisor) - C:\Program Files\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.) CHR Plugin: (Pando Web Plugin) - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll No File CHR Plugin: (Google Update) - C:\Users\Nadine Popich\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll No File CHR Plugin: (Move Media Player 7) - C:\Users\Nadine Popich\AppData\Roaming\Move Networks\plugins\071802000001\npqmp071802000001.dll (Move Networks) CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll No File CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) CHR Plugin: (McAfee SecurityCenter) - c:\progra~1\mcafee\msc\npmcsn~1.dll () CHR Extension: (Entanglement Web App) - C:\Users\NADINE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aciahcmjmecflokailenpkdchphgkefd\3.4.9_0 CHR Extension: (AddThis - Share & Bookmark (new)) - C:\Users\NADINE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\cgbogdmdefihhljhfeiklfiedefalcde\3.0.2_0 CHR Extension: (Add to Amazon Wish List) - C:\Users\NADINE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\ciagpekplgpbepdgggflgmahnjgiaced\1.0.0.10_0 CHR Extension: (Google Search) - C:\Users\NADINE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0 CHR Extension: (Rebecca Taylor) - C:\Users\NADINE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\eahpkkfpjpdcfdkbpeoibdhfadicnhdj\3_0 CHR Extension: (Gmail Offline) - C:\Users\NADINE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejidjjhkpiempkbhmpbfngldlkglhimk\1.20_0 CHR Extension: (Google Calendar) - C:\Users\NADINE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjicmeblgpmajnghnpcppodonldlgfn\4.5.3_0 CHR Extension: (Add to Feedly) - C:\Users\NADINE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejkjjleifeeaccajkekdcckflfpenoen\0.2_0 CHR Extension: (SiteAdvisor) - C:\Users\NADINE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.6.2.1341_0 CHR Extension: (CHIP Online) - C:\Users\NADINE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\fhjmdobefakhdbfdpnnopoaldabldbgd\1.5_0 CHR Extension: (AdBlock) - C:\Users\NADINE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.6.7_0 CHR Extension: (Feedly - News, Blogs and Youtube) - C:\Users\NADINE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\hipbfijinpcgfogaopmgehiegacbhmob\18.1_0 CHR Extension: (Chrome to Mobile) - C:\Users\NADINE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\idknbmbdnapjicclomlijcgfpikmndhd\2_0 CHR Extension: (WEB.DE MailCheck) - C:\Users\NADINE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\jaogepninmlbinccpbiakcgiolijlllo\1.2_0 CHR Extension: (Evernote Web) - C:\Users\NADINE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\lbfehkoinhhcknnbdgnnmjhiladcgbol\1.0.7_0 CHR Extension: (Ghostery) - C:\Users\NADINE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\mlomiejdfkolichcflejclcbmpeaniij\5.0.0_0 CHR Extension: (Email Backgrounds, Email Stationery) - C:\Users\NADINE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nepmejfbdnfgkkeklbhejggabembdfmo\1_0 CHR Extension: (RSS Subscription Extension (by Google)) - C:\Users\NADINE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nlbjncdgjeocebhnmkbbbdekmmmcbfjd\2.2.2_0 CHR Extension: (Chrome In-App Payments service) - C:\Users\NADINE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0 CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files\McAfee\SiteAdvisor\McChPlg.crx CHR HKLM\...\Chrome\Extension: [ngnjhfpfhadncgafgbneeljaginimmmk] - C:\Users\NADINE~1\AppData\Local\Temp\tbch.crx CHR StartMenuInternet: Google Chrome - C:\Users\*********\AppData\Local\Google\Chrome\Application\chrome.exe ========================== Services (Whitelisted) ================= R2 IGDCTRL; C:\Program Files\1&1\IGDCTRL.EXE [87344 2007-10-25] (AVM Berlin) R2 IJPLMSVC; C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [103808 2008-01-22] () R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation) R2 McAfee SiteAdvisor Service; C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe [167784 2012-08-31] (McAfee, Inc.) S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.) R2 McMPFSvc; C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe [167784 2012-08-31] (McAfee, Inc.) R2 mcmscsvc; C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe [167784 2012-08-31] (McAfee, Inc.) R2 McNaiAnn; C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe [167784 2012-08-31] (McAfee, Inc.) R2 McNASvc; C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe [167784 2012-08-31] (McAfee, Inc.) S3 McODS; C:\Program Files\McAfee\VirusScan\mcods.exe [279488 2013-02-25] (McAfee, Inc.) R2 McProxy; C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe [167784 2012-08-31] (McAfee, Inc.) R2 McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe [203840 2013-02-19] (McAfee, Inc.) R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [169320 2013-02-19] (McAfee, Inc.) R2 mfevtp; C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe [172416 2013-02-19] (McAfee, Inc.) R2 MSK80Service; C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe [167784 2012-08-31] (McAfee, Inc.) R2 ProtexisLicensing; C:\Windows\system32\PSIService.exe [177704 2007-06-05] () R2 SDScannerService; C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe [1817560 2013-05-16] (Safer-Networking Ltd.) R2 SDUpdateService; C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe [1033688 2013-05-16] (Safer-Networking Ltd.) R2 SDWSCService; C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2013-05-15] (Safer-Networking Ltd.) ==================== Drivers (Whitelisted) ==================== R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [60920 2013-02-19] (McAfee, Inc.) R0 CLFS; C:\Windows\System32\CLFS.sys [245736 2009-04-10] (Microsoft Corporation) S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [146872 2012-04-20] (McAfee, Inc.) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation) R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [133416 2013-02-19] (McAfee, Inc.) R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [235264 2013-02-19] (McAfee, Inc.) S3 mfebopk; C:\Windows\System32\drivers\mfebopk.sys [65928 2013-02-19] (McAfee, Inc.) R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [363080 2013-02-19] (McAfee, Inc.) R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [565888 2013-02-19] (McAfee, Inc.) S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [92632 2013-02-19] (McAfee, Inc.) R1 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [210608 2013-02-19] (McAfee, Inc.) R3 netr28u; C:\Windows\System32\DRIVERS\netr28u.sys [554496 2007-09-21] (Ralink Technology Corp.) R1 StarOpen; C:\Windows\System32\Drivers\StarOpen.sys [5632 2006-07-24] () S3 EagleNT; \??\C:\Windows\system32\drivers\EagleNT.sys [x] S3 EagleXNt; \??\C:\Windows\system32\drivers\EagleXNt.sys [x] S3 IpInIp; system32\DRIVERS\ipinip.sys [x] S3 massfilter; system32\drivers\massfilter.sys [x] U3 mfeavfk01; No ImagePath S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x] S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x] S3 Profos; \??\C:\Program Files\BullGuard Ltd\BullGuard\antirootkit\profos.sys [x] S3 Trufos; \??\C:\Program Files\BullGuard Ltd\BullGuard\antirootkit\trufos.sys [x] S3 XDva389; \??\C:\Windows\system32\XDva389.sys [x] S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [x] S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [x] S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-09-13 13:02 - 2013-09-13 13:05 - 00019112 _____ C:\Users\*********\Desktop\JRT.txt 2013-09-13 12:59 - 2013-09-13 12:59 - 00000000 ____D C:\Windows\ERUNT 2013-09-13 12:52 - 2013-09-13 12:52 - 00003525 _____ C:\Users\*********\Desktop\AdwCleaner[R0].txt 2013-09-13 12:40 - 2013-09-13 12:57 - 00000000 ____D C:\AdwCleaner 2013-09-13 12:29 - 2013-09-13 12:29 - 00000910 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2013-09-13 12:29 - 2013-09-13 12:29 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware 2013-09-13 12:29 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2013-09-13 12:27 - 2013-09-13 12:27 - 01029509 _____ (Thisisu) C:\Users\*********\Desktop\JRT.exe 2013-09-13 12:25 - 2013-09-13 12:25 - 01037278 _____ C:\Users\v\Desktop\adwcleaner.exe 2013-09-13 12:24 - 2013-09-13 12:24 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\*********\Downloads\mbam-setup-1.75.0.1300.exe 2013-09-13 10:02 - 2013-09-13 10:02 - 00377856 _____ C:\Users\*********\Downloads\sit5ry09.exe 2013-09-13 09:50 - 2013-09-13 09:51 - 00025561 _____ C:\Users\*********\Downloads\Addition.txt 2013-09-13 09:49 - 2013-09-13 09:49 - 00000000 ____D C:\FRST 2013-09-13 09:48 - 2013-09-13 09:48 - 01082459 _____ (Farbar) C:\Users\*********\Downloads\FRST.exe 2013-09-13 09:39 - 2013-09-13 09:40 - 00000488 _____ C:\Users\*********Downloads\defogger_disable.log 2013-09-13 09:39 - 2013-09-13 09:39 - 00000000 _____ C:\Users\*********\defogger_reenable 2013-09-13 09:38 - 2013-09-13 09:38 - 00050477 _____ C:\Users\*********\Downloads\Defogger.exe 2013-09-13 07:49 - 2013-09-13 12:18 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy 2013-09-13 07:49 - 2013-09-13 07:49 - 00000644 _____ C:\Windows\Tasks\Check for updates (Spybot - Search & Destroy).job 2013-09-13 07:49 - 2013-09-13 07:49 - 00000616 _____ C:\Windows\Tasks\Refresh immunization (Spybot - Search & Destroy).job 2013-09-13 07:49 - 2013-09-13 07:49 - 00000446 _____ C:\Windows\Tasks\Scan the system (Spybot - Search & Destroy).job 2013-09-13 07:48 - 2013-09-13 08:44 - 00000000 ____D C:\Program Files\Spybot - Search & Destroy 2 2013-09-13 07:48 - 2013-09-13 07:48 - 00001962 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk 2013-09-13 07:48 - 2009-01-25 13:14 - 00015224 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean.exe 2013-09-12 03:04 - 2013-07-31 12:30 - 12335104 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2013-09-12 03:04 - 2013-07-31 12:05 - 09738752 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2013-09-12 03:04 - 2013-07-31 12:00 - 01800704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2013-09-12 03:04 - 2013-07-31 11:53 - 01104896 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2013-09-12 03:04 - 2013-07-31 11:52 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2013-09-12 03:04 - 2013-07-31 11:52 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2013-09-12 03:04 - 2013-07-31 11:51 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2013-09-12 03:04 - 2013-07-31 11:49 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2013-09-12 03:04 - 2013-07-31 11:48 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2013-09-12 03:04 - 2013-07-31 11:48 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2013-09-12 03:04 - 2013-07-31 11:48 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2013-09-12 03:04 - 2013-07-31 11:47 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2013-09-12 03:04 - 2013-07-31 11:46 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2013-09-12 03:04 - 2013-07-31 11:45 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2013-09-12 03:04 - 2013-07-31 11:45 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2013-09-12 03:04 - 2013-07-31 11:42 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2013-09-11 09:12 - 2013-08-08 03:45 - 02049536 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2013-09-11 09:12 - 2013-07-16 06:35 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\themeui.dll 2013-09-11 08:19 - 2013-09-11 08:20 - 00476024 _____ (1&1 Mail & Media GmbH) C:\Users\Nadine Popich\Downloads\WEB.DE_MailCheck_chrome_setup.exe 2013-09-10 08:49 - 2013-09-10 08:49 - 00160640 _____ C:\Users\*********\Downloads\limit-login-attempts.1.7.1.zip 2013-09-07 18:59 - 2013-09-07 18:59 - 00037888 _____ C:\Users\*********\Downloads\GuV_leer.xls 2013-09-03 10:33 - 2013-09-03 10:34 - 00000000 ____D C:\Users\*********\Downloads\Diverses 2013-09-03 10:32 - 2013-09-03 10:33 - 00000000 ____D C:\Users\*********\Downloads\Rico Diverses 2013-09-03 08:15 - 2013-09-04 07:44 - 00000000 ____D C:\Users\*********\AppData\Roaming\Google 2013-09-02 07:46 - 2013-09-02 07:46 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe 2013-08-27 23:36 - 2013-08-02 06:09 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL 2013-08-27 10:12 - 2013-08-27 10:14 - 00000000 ____D C:\Users\*********\Documents\Arbeit 2013-08-26 07:24 - 2013-09-13 13:00 - 00689243 _____ C:\Windows\WindowsUpdate.log 2013-08-24 12:38 - 2013-08-24 12:38 - 01412416 _____ C:\Users\*********\Documents\Meine Änderungen des Themes.odp 2013-08-24 09:46 - 2013-08-24 09:46 - 00000000 ____D C:\Users\*********AppData\Local\Monotype_Inc 2013-08-23 18:37 - 2013-08-23 18:37 - 00000000 ____D C:\Users\*********\AppData\Roaming\BlogDesk 2013-08-23 14:13 - 2013-08-23 14:13 - 00000872 _____ C:\Users\*********\Desktop\Notepad++.lnk 2013-08-23 14:13 - 2013-08-23 14:13 - 00000000 ____D C:\Users\*********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Notepad++ 2013-08-23 14:12 - 2013-08-23 16:35 - 00000000 ____D C:\Users\*********\AppData\Roaming\Notepad++ 2013-08-23 14:12 - 2013-08-23 14:13 - 00000000 ____D C:\Program Files\Notepad++ 2013-08-22 18:25 - 2013-08-22 18:25 - 00000000 ____D C:\Program Files\FileZilla FTP Client 2013-08-22 18:24 - 2013-08-23 09:27 - 00000000 ____D C:\Users\*********AppData\Roaming\FileZilla 2013-08-22 18:21 - 2013-08-22 18:25 - 00001789 _____ C:\Users\Public\Desktop\FileZilla Client.lnk 2013-08-22 18:08 - 2013-08-22 18:08 - 00000000 ___HD C:\Users\*********\skyfonts-google 2013-08-22 17:21 - 2013-08-25 20:20 - 00000000 ____D C:\Users\*********\AppData\Roaming\Monotype 2013-08-22 17:21 - 2013-08-22 17:21 - 00001791 _____ C:\Users\Public\Desktop\SkyFonts.lnk 2013-08-22 17:21 - 2013-08-22 17:21 - 00000000 ____D C:\Program Files\Monotype 2013-08-22 09:46 - 2013-08-22 09:47 - 00000266 ____H C:\Users\*********\.picasa.ini 2013-08-20 15:13 - 2013-08-20 15:13 - 00001166 _____ C:\Users\Public\Desktop\WEB.DE Club SmartFax.lnk 2013-08-15 08:04 - 2013-08-15 08:04 - 00000000 ____D C:\Users\*********\AppData\Local\Chromium 2013-08-14 08:26 - 2013-08-23 17:57 - 00000568 ____H C:\Users\*********\Downloads\.picasa.ini 2013-08-14 03:58 - 2013-07-17 21:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2013-08-14 03:58 - 2013-07-10 11:47 - 00783360 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll 2013-08-14 03:58 - 2013-07-09 14:10 - 01205168 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll 2013-08-14 03:58 - 2013-07-08 06:55 - 03603904 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe 2013-08-14 03:58 - 2013-07-08 06:55 - 03551680 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2013-08-14 03:58 - 2013-07-08 06:20 - 00172544 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll 2013-08-14 03:58 - 2013-07-08 06:16 - 00992768 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll 2013-08-14 03:58 - 2013-07-08 06:16 - 00133120 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll 2013-08-14 03:58 - 2013-07-08 06:16 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll 2013-08-14 03:58 - 2013-07-05 06:53 - 00905664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys 2013-08-14 03:58 - 2013-06-15 15:22 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\icaapi.dll 2013-08-14 03:58 - 2013-06-15 13:23 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys ==================== One Month Modified Files and Folders ======= 2013-09-13 13:06 - 2011-01-08 19:27 - 00000000 ____D C:\Users\*********\AppData\Local\PMB Files 2013-09-13 13:05 - 2013-09-13 13:02 - 00019112 _____ C:\Users\*********\Desktop\JRT.txt 2013-09-13 13:02 - 2006-11-02 12:33 - 01560144 _____ C:\Windows\system32\PerfStringBackup.INI 2013-09-13 13:00 - 2013-08-26 07:24 - 00689243 _____ C:\Windows\WindowsUpdate.log 2013-09-13 12:59 - 2013-09-13 12:59 - 00000000 ____D C:\Windows\ERUNT 2013-09-13 12:57 - 2013-09-13 12:40 - 00000000 ____D C:\AdwCleaner 2013-09-13 12:56 - 2009-08-11 11:47 - 00035669 _____ C:\ProgramData\nvModes.dat 2013-09-13 12:56 - 2009-08-11 11:47 - 00035669 _____ C:\ProgramData\nvModes.001 2013-09-13 12:56 - 2006-11-02 15:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2013-09-13 12:56 - 2006-11-02 14:47 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 2013-09-13 12:56 - 2006-11-02 14:47 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 2013-09-13 12:55 - 2006-11-02 15:01 - 00032530 _____ C:\Windows\Tasks\SCHEDLGU.TXT 2013-09-13 12:52 - 2013-09-13 12:52 - 00003525 _____ C:\Users\*********\Desktop\AdwCleaner[R0].txt 2013-09-13 12:29 - 2013-09-13 12:29 - 00000910 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2013-09-13 12:29 - 2013-09-13 12:29 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware 2013-09-13 12:27 - 2013-09-13 12:27 - 01029509 _____ (Thisisu) C:\Users\*********\Desktop\JRT.exe 2013-09-13 12:25 - 2013-09-13 12:25 - 01037278 _____ C:\Users\*********\Desktop\adwcleaner.exe 2013-09-13 12:24 - 2013-09-13 12:24 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Nadine Popich\Downloads\mbam-setup-1.75.0.1300.exe 2013-09-13 12:23 - 2013-07-03 08:51 - 00000000 ____D C:\Users\*********\Downloads\NUTZTIER-Arche 2013-09-13 12:23 - 2013-07-03 08:51 - 00000000 ____D C:\Users\*********\Downloads\Konto 2013-09-13 12:18 - 2013-09-13 07:49 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy 2013-09-13 10:37 - 2010-09-27 08:13 - 00000000 ____D C:\Users\*********\AppData\Roaming\FRITZ! 2013-09-13 10:02 - 2013-09-13 10:02 - 00377856 _____ C:\Users\*********\Downloads\sit5ry09.exe 2013-09-13 09:51 - 2013-09-13 09:50 - 00025561 _____ C:\Users\*********\Downloads\Addition.txt 2013-09-13 09:49 - 2013-09-13 09:49 - 00000000 ____D C:\FRST 2013-09-13 09:48 - 2013-09-13 09:48 - 01082459 _____ (Farbar) C:\Users\*********\Downloads\FRST.exe 2013-09-13 09:40 - 2013-09-13 09:39 - 00000488 _____ C:\Users\*********\Downloads\defogger_disable.log 2013-09-13 09:39 - 2013-09-13 09:39 - 00000000 _____ C:\Users\*********\defogger_reenable 2013-09-13 09:39 - 2009-12-27 17:09 - 00000000 ____D C:\Users\********* 2013-09-13 09:38 - 2013-09-13 09:38 - 00050477 _____ C:\Users\*********\Downloads\Defogger.exe 2013-09-13 08:44 - 2013-09-13 07:48 - 00000000 ____D C:\Program Files\Spybot - Search & Destroy 2 2013-09-13 07:49 - 2013-09-13 07:49 - 00000644 _____ C:\Windows\Tasks\Check for updates (Spybot - Search & Destroy).job 2013-09-13 07:49 - 2013-09-13 07:49 - 00000616 _____ C:\Windows\Tasks\Refresh immunization (Spybot - Search & Destroy).job 2013-09-13 07:49 - 2013-09-13 07:49 - 00000446 _____ C:\Windows\Tasks\Scan the system (Spybot - Search & Destroy).job 2013-09-13 07:48 - 2013-09-13 07:48 - 00001962 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk 2013-09-12 03:24 - 2006-11-02 14:47 - 00359560 _____ C:\Windows\system32\FNTCACHE.DAT 2013-09-12 03:04 - 2013-08-07 03:03 - 00000000 ____D C:\Windows\system32\MRT 2013-09-12 03:01 - 2006-11-02 12:24 - 76725432 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe 2013-09-11 08:20 - 2013-09-11 08:19 - 00476024 _____ (1&1 Mail & Media GmbH) C:\Users\*********\Downloads\WEB.DE_MailCheck_chrome_setup.exe 2013-09-10 08:49 - 2013-09-10 08:49 - 00160640 _____ C:\Users\*********\Downloads\limit-login-attempts.1.7.1.zip 2013-09-07 18:59 - 2013-09-07 18:59 - 00037888 _____ C:\Users\*********\Downloads\GuV_leer.xls 2013-09-04 07:44 - 2013-09-03 08:15 - 00000000 ____D C:\Users\*********\AppData\Roaming\Google 2013-09-03 10:34 - 2013-09-03 10:33 - 00000000 ____D C:\Users\*********\Downloads\Diverses 2013-09-03 10:33 - 2013-09-03 10:32 - 00000000 ____D C:\Users\*********\Downloads\Rico Diverses 2013-09-03 10:33 - 2013-08-06 09:58 - 00000000 ____D C:\Users\*********\Downloads\Tupperzwischenlager 2013-09-03 08:15 - 2012-07-24 12:36 - 00000808 _____ C:\Users\Public\Desktop\CCleaner.lnk 2013-09-03 08:15 - 2011-01-13 13:36 - 00000000 ____D C:\ProgramData\Google 2013-09-03 08:15 - 2010-11-30 17:54 - 00000000 ____D C:\Users\*********\AppData\Local\Google 2013-09-03 08:15 - 2009-12-31 13:38 - 00000000 ____D C:\Program Files\CCleaner 2013-09-03 08:14 - 2010-11-30 17:54 - 00000000 ____D C:\Program Files\Google 2013-09-02 09:46 - 2011-09-28 12:34 - 00000000 ____D C:\ProgramData\CanonIJPLM 2013-09-02 07:47 - 2013-06-29 20:42 - 00262144 _____ C:\Windows\system32\config\ELAM 2013-09-02 07:46 - 2013-09-02 07:46 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe 2013-08-31 03:19 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\Microsoft.NET 2013-08-28 12:18 - 2013-07-03 08:50 - 00000000 ____D C:\Users\*********\Documents\TUPPERWARE 2013-08-27 10:19 - 2013-07-19 08:55 - 00000000 ____D C:\Users\*********\Downloads\WORDPRESS 2013-08-27 10:14 - 2013-08-27 10:12 - 00000000 ____D C:\Users\*********\Documents\Arbeit 2013-08-27 10:13 - 2013-08-07 07:59 - 00000000 ____D C:\Users\*********\Documents\********* 2013-08-27 10:13 - 2013-07-03 08:50 - 00000000 ____D C:\Users\*********\Documents\Übersichten Kontoauszüge 2013-08-25 20:20 - 2013-08-22 17:21 - 00000000 ____D C:\Users\*********\AppData\Roaming\Monotype 2013-08-24 12:38 - 2013-08-24 12:38 - 01412416 _____ C:\Users\*********\Documents\Meine Änderungen des Themes.odp 2013-08-24 09:46 - 2013-08-24 09:46 - 00000000 ____D C:\Users\*********\AppData\Local\Monotype_Inc 2013-08-23 19:07 - 2009-12-27 17:28 - 00003584 _____ C:\Users\*********\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2013-08-23 18:37 - 2013-08-23 18:37 - 00000000 ____D C:\Users\*********\AppData\Roaming\BlogDesk 2013-08-23 18:37 - 2006-11-02 13:18 - 00000000 ____D C:\Program Files\Common Files\microsoft shared 2013-08-23 17:57 - 2013-08-14 08:26 - 00000568 ____H C:\Users\*********\Downloads\.picasa.ini 2013-08-23 16:35 - 2013-08-23 14:12 - 00000000 ____D C:\Users\*********\AppData\Roaming\Notepad++ 2013-08-23 14:13 - 2013-08-23 14:13 - 00000872 _____ C:\Users\*********\Desktop\Notepad++.lnk 2013-08-23 14:13 - 2013-08-23 14:13 - 00000000 ____D C:\Users\*********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Notepad++ 2013-08-23 14:13 - 2013-08-23 14:12 - 00000000 ____D C:\Program Files\Notepad++ 2013-08-23 09:27 - 2013-08-22 18:24 - 00000000 ____D C:\Users\*********\AppData\Roaming\FileZilla 2013-08-22 18:25 - 2013-08-22 18:25 - 00000000 ____D C:\Program Files\FileZilla FTP Client 2013-08-22 18:25 - 2013-08-22 18:21 - 00001789 _____ C:\Users\Public\Desktop\FileZilla Client.lnk 2013-08-22 18:08 - 2013-08-22 18:08 - 00000000 ___HD C:\Users\Nadine Popich\skyfonts-google 2013-08-22 17:59 - 2013-07-03 08:51 - 00000000 ____D C:\Users\Nadine Popich\Downloads\Schriftstile 2013-08-22 17:21 - 2013-08-22 17:21 - 00001791 _____ C:\Users\Public\Desktop\SkyFonts.lnk 2013-08-22 17:21 - 2013-08-22 17:21 - 00000000 ____D C:\Program Files\Monotype 2013-08-22 17:18 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\system32\de-DE 2013-08-22 09:47 - 2013-08-22 09:46 - 00000266 ____H C:\Users\*********\.picasa.ini 2013-08-22 09:43 - 2012-07-21 16:41 - 00000000 ___SD C:\Users\*********\Google Drive 2013-08-21 03:07 - 2010-09-07 18:10 - 00000000 ____D C:\Program Files\McAfee 2013-08-20 15:13 - 2013-08-20 15:13 - 00001166 _____ C:\Users\Public\Desktop\WEB.DE Club SmartFax.lnk 2013-08-15 08:17 - 2010-04-07 12:10 - 00000000 ____D C:\Windows\Minidump 2013-08-15 08:04 - 2013-08-15 08:04 - 00000000 ____D C:\Users\*********\AppData\Local\Chromium 2013-08-15 03:46 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\rescache 2013-08-14 10:17 - 2013-07-03 08:50 - 00000000 ____D C:\Users\*********\Documents\Geschenke und Gutscheine 2012 Files to move or delete: ==================== C:\Users\*********\AppData\Local\Temp\Quarantine.exe ==================== Bamital & volsnap Check ================= C:\Windows\explorer.exe => MD5 is legit C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-09-13 13:02 ==================== End Of Log ============================ --- --- --- --- --- --- --- --- --- --- --- --- So, ich hoffe Das ist alles...kann langsam meinen Namen nicht mehr sehen...:-)))))
__________________ |
13.09.2013, 19:24 | #4 |
/// the machine /// TB-Ausbilder | Win32.Downloader.gen & Montera.Toolbar mit Spybot gefundenESET Online Scanner
Downloade Dir bitte SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
14.09.2013, 07:14 | #5 | |
| Win32.Downloader.gen & Montera.Toolbar mit Spybot gefunden Hallo! Hier schon mal das eine Log von Eset: Code:
ATTFilter ESETSmartInstaller@High as downloader log: all ok # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6920 # api_version=3.0.2 # EOSSerial=b5ddd55b778e0f4688127b0f1fcdde7f # engine=15118 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=false # unsafe_checked=false # antistealth_checked=true # utc_time=2013-09-13 10:41:38 # local_time=2013-09-14 12:41:38 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1033 # osver=6.0.6002 NT Service Pack 2 # compatibility_mode=5122 16777213 100 100 6580529 127898294 0 0 # compatibility_mode=5892 16776638 100 100 95252139 216644826 0 0 # scanned=149103 # found=0 # cleaned=0 # scan_time=6493 Zitat:
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 13-09-2013 04 Ran by *********** (administrator) on *********** on 14-09-2013 08:25:51 Running from C:\Users\***********\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8NSV9MDJ Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: German Standard Internet Explorer Version 9 Boot Mode: Normal ==================== Processes (Whitelisted) =================== (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe (Microsoft Corporation) C:\Windows\system32\SLsvc.exe (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe (AVM Berlin) C:\Program Files\1&1\IGDCTRL.EXE () C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE (McAfee, Inc.) C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe () C:\Windows\system32\PSIService.exe (Protexis Inc.) c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe (Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe (McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe (McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe (Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe (Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe (Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation) C:\Windows\ehome\ehtray.exe (Google Inc.) C:\Users\***********\AppData\Local\Google\Update\GoogleUpdate.exe (Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe (McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.0.318\SSScheduler.exe (AVM Berlin) C:\Program Files\1&1\FwebProt.exe (Google Inc.) C:\Users\***********\AppData\Local\Google\Update\1.3.21.153\GoogleCrashHandler.exe (OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.exe (Microsoft Corporation) C:\Windows\ehome\ehmsas.exe (OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.bin (Microsoft Corporation) C:\Windows\system32\werfault.exe (AVM Berlin) C:\Program Files\1&1\StCenter.EXE (Microsoft Corporation) C:\Windows\system32\conime.exe (McAfee, Inc.) C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.) C:\Program Files\Common Files\McAfee\Core\mchost.exe (Microsoft Corporation) C:\Windows\System32\mobsync.exe (Google Inc.) C:\Users\***********AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\***********\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\***********\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\***********\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\***********\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\***********\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\***********\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\***********\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\***********\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\***********\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\***********\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\***********\AppData\Local\Google\Chrome\Application\chrome.exe (Google) C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-21] (Microsoft Corporation) HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7625248 2009-07-20] (Realtek Semiconductor) HKLM\...\Run: [mcui_exe] - C:\Program Files\McAfee.com\Agent\mcagent.exe [1278064 2013-03-13] (McAfee, Inc.) HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59240 2011-09-27] (Apple Inc.) HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation) HKLM\...\Run: [SDTray] - C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.) Winlogon\Notify\SDWinLogon: SDWinLogon.dll [X] HKLM\...\Policies\Explorer: [NoControlPanel] 0 HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [125952 2008-01-21] (Microsoft Corporation) HKCU\...\Run: [Google Update] - C:\Users\***********\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2011-07-19] (Google Inc.) HKCU\...\Run: [Pando Media Booster] - C:\Program Files\Pando Networks\Media Booster\PMB.exe [3077528 2011-08-03] () HKCU\...\Run: [WMPNSCFG] - C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-21] (Microsoft Corporation) HKCU\...\RunOnce: [Shockwave Updater] - C:\Windows\system32\Adobe\Shockwave 11\SwHelper_1151601.exe -Update -1151601 -"Mozilla/5.0_(Windows;_U;_Windows_NT_6.0;_de;_rv:1.9.2.15)_Gecko/20110303_Firefox/3.6.15_ImageShackToolbar/5.2.4_(_.NET_CLR" -"hxxp://www.bbc.co.uk/gardening/htbg2/virtual_garden/shockwave/garden3.shtml" [468408 2009-07-21] (Adobe Systems, Inc.) HKU\Default\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter HKU\Default User\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter Startup: C:\Users\***********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL Protect.lnk ShortcutTarget: DSL Protect.lnk -> C:\Program Files\1&1\FwebProt.exe (AVM Berlin) Startup: C:\Users\***********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe () BootExecute: autocheck autochk * sdnclean.exe ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://medion.msn.com HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com URLSearchHook: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.) SearchScopes: HKLM - DefaultScope value is missing. SearchScopes: HKCU - DefaultScope {77E63755-4D4D-45C8-A41B-95B51530E62C} URL = hxxp://go.web.de/suchbox/google?q={searchTerms} SearchScopes: HKCU - {45327B16-694D-45D3-A8CE-1A70BD4129BD} URL = hxxp://go.1und1.de/suchbox/amazon?tag=1und1icon-21&field-keywords={searchTerms} SearchScopes: HKCU - {6FEADE84-B2D8-4804-A45C-186C6F16316B} URL = hxxp://go.web.de/suchbox/ebay?query={searchTerms} SearchScopes: HKCU - {77E63755-4D4D-45C8-A41B-95B51530E62C} URL = hxxp://go.web.de/suchbox/google?q={searchTerms} SearchScopes: HKCU - {A8113878-A6DD-4457-898A-8BE6E878D431} URL = hxxp://go.1und1.de/suchbox/1und1suche?su={searchTerms} SearchScopes: HKCU - {DEB7C54E-7B18-4429-ACAF-14ECBAEC8E62} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MEDTDF&pc=MAMD&src=IE-SearchBox BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.) BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.) Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File Toolbar: HKCU -Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.) Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.) Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\PROGRA~1\mcafee\msc\mcsniepl.dll (McAfee, Inc.) Winsock: Catalog5 07 C:\Program Files\1&1\\sarah.dll [24880] (AVM Berlin) Winsock: Catalog9 01 C:\Program Files\1&1\\sarah.dll [24880] (AVM Berlin) Winsock: Catalog9 02 C:\Program Files\1&1\\sarah.dll [24880] (AVM Berlin) Winsock: Catalog9 03 C:\Program Files\1&1\\sarah.dll [24880] (AVM Berlin) Winsock: Catalog9 14 C:\Program Files\1&1\\sarah.dll [24880] (AVM Berlin) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 Chrome: ======= CHR HomePage: about:home CHR RestoreOnStartup: "https://www.google.de/" CHR DefaultSearchURL: (google np) - hxxp://www.google.de/#hl=de&output=search&sclient=psy-ab&q={searchTerms}&oq=start&gs_l=hp.1.0.0l2j0i10j0.55868.57044.0.59638.5.5.0.0.0.0.178.724.0j5.5.0...0.0...1c.DmqGqs4Tml4&pbx=1&bav=on.2,or.r_gc.r_pw.r_qf.&fp=5e7fc900d9a88c5&biw=1024&bih=485 CHR DefaultSuggestURL: (google np) - "suggest_url": "", CHR Plugin: (Remoting Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Users\***********\AppData\Local\Google\Chrome\Application\29.0.1547.66\ppGoogleNaClPluginChrome.dll () CHR Plugin: (Chrome PDF Viewer) - C:\Users\***********\AppData\Local\Google\Chrome\Application\29.0.1547.66\pdf.dll () CHR Plugin: (Shockwave Flash) - C:\Users\***********\AppData\Local\Google\Chrome\User Data\NPAPIFlash\gcswf32.dll No File CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll () CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.) CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin2.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin3.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin4.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin5.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin6.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files\QuickTime\plugins\npqtplugin7.dll (Apple Inc.) CHR Plugin: (CANON iMAGE GATEWAY Album Plugin Utility) - C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.) CHR Plugin: (Picasa) - C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.) CHR Plugin: (Java(TM) Platform SE 6 U31) - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll No File CHR Plugin: (McAfee SiteAdvisor) - C:\Program Files\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.) CHR Plugin: (Pando Web Plugin) - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll No File CHR Plugin: (Google Update) - C:\Users\***********\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll No File CHR Plugin: (Move Media Player 7) - C:\Users\***********\AppData\Roaming\Move Networks\plugins\071802000001\npqmp071802000001.dll (Move Networks) CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll No File CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) CHR Plugin: (McAfee SecurityCenter) - c:\progra~1\mcafee\msc\npmcsn~1.dll () CHR Extension: (Entanglement Web App) - C:\Users\***********\AppData\Local\Google\Chrome\User Data\Default\Extensions\aciahcmjmecflokailenpkdchphgkefd\3.4.9_0 CHR Extension: (AddThis - Share & Bookmark (new)) - C:\Users\***********\AppData\Local\Google\Chrome\User Data\Default\Extensions\cgbogdmdefihhljhfeiklfiedefalcde\3.0.2_0 CHR Extension: (Add to Amazon Wish List) - C:\Users\***********\AppData\Local\Google\Chrome\User Data\Default\Extensions\ciagpekplgpbepdgggflgmahnjgiaced\1.0.0.10_0 CHR Extension: (Google Search) - C:\Users\***********\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0 CHR Extension: (Rebecca Taylor) - C:\Users\***********\AppData\Local\Google\Chrome\User Data\Default\Extensions\eahpkkfpjpdcfdkbpeoibdhfadicnhdj\3_0 CHR Extension: (Gmail Offline) - C:\Users\***********\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejidjjhkpiempkbhmpbfngldlkglhimk\1.20_0 CHR Extension: (Google Calendar) - C:\Users\***********\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjicmeblgpmajnghnpcppodonldlgfn\4.5.3_0 CHR Extension: (Add to Feedly) - C:\Users\NADINE~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejkjjleifeeaccajkekdcckflfpenoen\0.2_0 CHR Extension: (SiteAdvisor) - C:\Users\***********\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.6.2.1341_0 CHR Extension: (CHIP Online) - C:\Users\***********\AppData\Local\Google\Chrome\User Data\Default\Extensions\fhjmdobefakhdbfdpnnopoaldabldbgd\1.5_0 CHR Extension: (AdBlock) - C:\Users\***********\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.6.7_0 CHR Extension: (Feedly - News, Blogs and Youtube) - C:\Users\***********\AppData\Local\Google\Chrome\User Data\Default\Extensions\hipbfijinpcgfogaopmgehiegacbhmob\18.1_0 CHR Extension: (Chrome to Mobile) - C:\Users\***********\AppData\Local\Google\Chrome\User Data\Default\Extensions\idknbmbdnapjicclomlijcgfpikmndhd\2_0 CHR Extension: (WEB.DE MailCheck) - C:\Users\***********\AppData\Local\Google\Chrome\User Data\Default\Extensions\jaogepninmlbinccpbiakcgiolijlllo\1.2_0 CHR Extension: (Evernote Web) - C:\Users\***********\AppData\Local\Google\Chrome\User Data\Default\Extensions\lbfehkoinhhcknnbdgnnmjhiladcgbol\1.0.7_0 CHR Extension: (Ghostery) - C:\Users\***********\AppData\Local\Google\Chrome\User Data\Default\Extensions\mlomiejdfkolichcflejclcbmpeaniij\5.0.0_0 CHR Extension: (Email Backgrounds, Email Stationery) - C:\Users\***********\AppData\Local\Google\Chrome\User Data\Default\Extensions\nepmejfbdnfgkkeklbhejggabembdfmo\1_0 CHR Extension: (RSS Subscription Extension (by Google)) - C:\Users\***********\AppData\Local\Google\Chrome\User Data\Default\Extensions\nlbjncdgjeocebhnmkbbbdekmmmcbfjd\2.2.2_0 CHR Extension: (Chrome In-App Payments service) - C:\Users\***********\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0 CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files\McAfee\SiteAdvisor\McChPlg.crx CHR HKLM\...\Chrome\Extension: [ngnjhfpfhadncgafgbneeljaginimmmk] - C:\Users\***********\AppData\Local\Temp\tbch.crx CHR StartMenuInternet: Google Chrome - C:\Users\***********\AppData\Local\Google\Chrome\Application\chrome.exe ========================== Services (Whitelisted) ================= R2 IGDCTRL; C:\Program Files\1&1\IGDCTRL.EXE [87344 2007-10-25] (AVM Berlin) R2 IJPLMSVC; C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [103808 2008-01-22] () R2 McAfee SiteAdvisor Service; C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe [167784 2012-08-31] (McAfee, Inc.) S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.) R2 McMPFSvc; C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe [167784 2012-08-31] (McAfee, Inc.) R2 mcmscsvc; C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe [167784 2012-08-31] (McAfee, Inc.) R2 McNaiAnn; C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe [167784 2012-08-31] (McAfee, Inc.) R2 McNASvc; C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe [167784 2012-08-31] (McAfee, Inc.) S3 McODS; C:\Program Files\McAfee\VirusScan\mcods.exe [279488 2013-02-25] (McAfee, Inc.) R2 McProxy; C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe [167784 2012-08-31] (McAfee, Inc.) R2 McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe [203840 2013-02-19] (McAfee, Inc.) R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [169320 2013-02-19] (McAfee, Inc.) R2 mfevtp; C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe [172416 2013-02-19] (McAfee, Inc.) R2 MSK80Service; C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe [167784 2012-08-31] (McAfee, Inc.) R2 ProtexisLicensing; C:\Windows\system32\PSIService.exe [177704 2007-06-05] () R2 SDScannerService; C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe [1817560 2013-05-16] (Safer-Networking Ltd.) R2 SDUpdateService; C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe [1033688 2013-05-16] (Safer-Networking Ltd.) R2 SDWSCService; C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2013-05-15] (Safer-Networking Ltd.) ==================== Drivers (Whitelisted) ==================== R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [60920 2013-02-19] (McAfee, Inc.) R0 CLFS; C:\Windows\System32\CLFS.sys [245736 2009-04-10] (Microsoft Corporation) S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [146872 2012-04-20] (McAfee, Inc.) R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [133416 2013-02-19] (McAfee, Inc.) R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [235264 2013-02-19] (McAfee, Inc.) S3 mfebopk; C:\Windows\System32\drivers\mfebopk.sys [65928 2013-02-19] (McAfee, Inc.) R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [363080 2013-02-19] (McAfee, Inc.) R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [565888 2013-02-19] (McAfee, Inc.) R3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [92632 2013-02-19] (McAfee, Inc.) R1 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [210608 2013-02-19] (McAfee, Inc.) R3 netr28u; C:\Windows\System32\DRIVERS\netr28u.sys [554496 2007-09-21] (Ralink Technology Corp.) R1 StarOpen; C:\Windows\System32\Drivers\StarOpen.sys [5632 2006-07-24] () S3 EagleNT; \??\C:\Windows\system32\drivers\EagleNT.sys [x] S3 EagleXNt; \??\C:\Windows\system32\drivers\EagleXNt.sys [x] S3 IpInIp; system32\DRIVERS\ipinip.sys [x] S3 massfilter; system32\drivers\massfilter.sys [x] U3 mfeavfk01; No ImagePath S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x] S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x] S3 Profos; \??\C:\Program Files\BullGuard Ltd\BullGuard\antirootkit\profos.sys [x] S3 Trufos; \??\C:\Program Files\BullGuard Ltd\BullGuard\antirootkit\trufos.sys [x] S3 XDva389; \??\C:\Windows\system32\XDva389.sys [x] S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [x] S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [x] S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-09-14 08:20 - 2013-09-14 08:20 - 00891144 _____ C:\Users\***********\Desktop\SecurityCheck.exe 2013-09-13 22:48 - 2013-09-13 22:48 - 02347384 _____ (ESET) C:\Users\***********\Desktop\esetsmartinstaller_enu.exe 2013-09-13 17:50 - 2013-09-13 17:50 - 00000414 _____ C:\Users\***********\Desktop\Download.lnk 2013-09-13 17:44 - 2013-09-13 17:44 - 13376285 _____ C:\Users\***********\Desktop\Tupperware Profi-Chef.mp4 2013-09-13 13:07 - 2013-09-13 13:07 - 00037920 _____ C:\Users\***********\Downloads\FRST.txt 2013-09-13 12:59 - 2013-09-13 12:59 - 00000000 ____D C:\Windows\ERUNT 2013-09-13 12:40 - 2013-09-13 12:57 - 00000000 ____D C:\AdwCleaner 2013-09-13 12:29 - 2013-09-14 08:15 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware 2013-09-13 12:27 - 2013-09-13 12:27 - 01029509 _____ (Thisisu) C:\Users\***********\Desktop\JRT.exe 2013-09-13 12:25 - 2013-09-13 12:25 - 01037278 _____ C:\Users\***********\Desktop\adwcleaner.exe 2013-09-13 12:24 - 2013-09-13 12:24 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\***********\Downloads\mbam-setup-1.75.0.1300.exe 2013-09-13 10:02 - 2013-09-13 10:02 - 00377856 _____ C:\Users\***********\Downloads\sit5ry09.exe 2013-09-13 09:50 - 2013-09-13 09:51 - 00025561 _____ C:\Users\***********\Downloads\Addition.txt 2013-09-13 09:49 - 2013-09-13 09:49 - 00000000 ____D C:\FRST 2013-09-13 09:39 - 2013-09-13 09:40 - 00000488 _____ C:\Users\***********\Downloads\defogger_disable.log 2013-09-13 09:39 - 2013-09-13 09:39 - 00000000 _____ C:\Users\***********\defogger_reenable 2013-09-13 09:38 - 2013-09-13 09:38 - 00050477 _____ C:\Users\***********\Downloads\Defogger.exe 2013-09-13 07:49 - 2013-09-13 12:18 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy 2013-09-13 07:49 - 2013-09-13 07:49 - 00000644 _____ C:\Windows\Tasks\Check for updates (Spybot - Search & Destroy).job 2013-09-13 07:49 - 2013-09-13 07:49 - 00000616 _____ C:\Windows\Tasks\Refresh immunization (Spybot - Search & Destroy).job 2013-09-13 07:49 - 2013-09-13 07:49 - 00000446 _____ C:\Windows\Tasks\Scan the system (Spybot - Search & Destroy).job 2013-09-13 07:48 - 2013-09-13 08:44 - 00000000 ____D C:\Program Files\Spybot - Search & Destroy 2 2013-09-13 07:48 - 2013-09-13 07:48 - 00001962 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk 2013-09-13 07:48 - 2009-01-25 13:14 - 00015224 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean.exe 2013-09-12 03:04 - 2013-07-31 12:30 - 12335104 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2013-09-12 03:04 - 2013-07-31 12:05 - 09738752 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2013-09-12 03:04 - 2013-07-31 12:00 - 01800704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2013-09-12 03:04 - 2013-07-31 11:53 - 01104896 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2013-09-12 03:04 - 2013-07-31 11:52 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2013-09-12 03:04 - 2013-07-31 11:52 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2013-09-12 03:04 - 2013-07-31 11:51 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2013-09-12 03:04 - 2013-07-31 11:49 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2013-09-12 03:04 - 2013-07-31 11:48 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2013-09-12 03:04 - 2013-07-31 11:48 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2013-09-12 03:04 - 2013-07-31 11:48 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2013-09-12 03:04 - 2013-07-31 11:47 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2013-09-12 03:04 - 2013-07-31 11:46 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2013-09-12 03:04 - 2013-07-31 11:45 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2013-09-12 03:04 - 2013-07-31 11:45 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2013-09-12 03:04 - 2013-07-31 11:42 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2013-09-11 09:12 - 2013-08-08 03:45 - 02049536 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2013-09-11 09:12 - 2013-07-16 06:35 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\themeui.dll 2013-09-11 08:19 - 2013-09-11 08:20 - 00476024 _____ (1&1 Mail & Media GmbH) C:\Users\***********\Downloads\WEB.DE_MailCheck_chrome_setup.exe 2013-09-10 08:49 - 2013-09-10 08:49 - 00160640 _____ C:\Users\***********\Downloads\limit-login-attempts.1.7.1.zip 2013-09-07 18:59 - 2013-09-07 18:59 - 00037888 _____ C:\Users\***********\Downloads\GuV_leer.xls 2013-09-03 10:33 - 2013-09-03 10:34 - 00000000 ____D C:\Users\***********\Downloads\Diverses 2013-09-03 10:32 - 2013-09-03 10:33 - 00000000 ____D C:\Users\***********\Downloads\Rico Diverses 2013-09-03 08:15 - 2013-09-04 07:44 - 00000000 ____D C:\Users\***********\AppData\Roaming\Google 2013-09-02 07:46 - 2013-09-02 07:46 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe 2013-08-27 23:36 - 2013-08-02 06:09 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL 2013-08-27 10:12 - 2013-08-27 10:14 - 00000000 ____D C:\Users\***********\Documents\Arbeit 2013-08-26 07:24 - 2013-09-14 08:07 - 00699756 _____ C:\Windows\WindowsUpdate.log 2013-08-24 12:38 - 2013-08-24 12:38 - 01412416 _____ C:\Users\***********\Documents\Meine Änderungen des Themes.odp 2013-08-24 09:46 - 2013-08-24 09:46 - 00000000 ____D C:\Users\***********\AppData\Local\Monotype_Inc 2013-08-23 18:37 - 2013-08-23 18:37 - 00000000 ____D C:\Users\***********\AppData\Roaming\BlogDesk 2013-08-23 14:13 - 2013-08-23 14:13 - 00000872 _____ C:\Users\***********\Desktop\Notepad++.lnk 2013-08-23 14:13 - 2013-08-23 14:13 - 00000000 ____D C:\Users\***********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Notepad++ 2013-08-23 14:12 - 2013-08-23 16:35 - 00000000 ____D C:\Users\***********\AppData\Roaming\Notepad++ 2013-08-23 14:12 - 2013-08-23 14:13 - 00000000 ____D C:\Program Files\Notepad++ 2013-08-22 18:25 - 2013-08-22 18:25 - 00000000 ____D C:\Program Files\FileZilla FTP Client 2013-08-22 18:24 - 2013-08-23 09:27 - 00000000 ____D C:\Users\***********\AppData\Roaming\FileZilla 2013-08-22 18:21 - 2013-08-22 18:25 - 00001789 _____ C:\Users\Public\Desktop\FileZilla Client.lnk 2013-08-22 18:08 - 2013-08-22 18:08 - 00000000 ___HD C:\Users\***********\skyfonts-google 2013-08-22 17:21 - 2013-08-25 20:20 - 00000000 ____D C:\Users\***********\AppData\Roaming\Monotype 2013-08-22 17:21 - 2013-08-22 17:21 - 00001791 _____ C:\Users\Public\Desktop\SkyFonts.lnk 2013-08-22 17:21 - 2013-08-22 17:21 - 00000000 ____D C:\Program Files\Monotype 2013-08-22 09:46 - 2013-08-22 09:47 - 00000266 ____H C:\Users\Nadine Popich\.picasa.ini 2013-08-20 15:13 - 2013-08-20 15:13 - 00001166 _____ C:\Users\Public\Desktop\WEB.DE Club SmartFax.lnk 2013-08-15 08:04 - 2013-08-15 08:04 - 00000000 ____D C:\Users\***********\AppData\Local\Chromium ==================== One Month Modified Files and Folders ======= 2013-09-14 08:20 - 2013-09-14 08:20 - 00891144 _____ C:\Users\***********\Desktop\SecurityCheck.exe 2013-09-14 08:15 - 2013-09-13 12:29 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware 2013-09-14 08:07 - 2013-08-26 07:24 - 00699756 _____ C:\Windows\WindowsUpdate.log 2013-09-14 06:56 - 2006-11-02 14:47 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 2013-09-14 06:56 - 2006-11-02 14:47 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 2013-09-13 22:49 - 2006-11-02 12:33 - 01560144 _____ C:\Windows\system32\PerfStringBackup.INI 2013-09-13 22:48 - 2013-09-13 22:48 - 02347384 _____ (ESET) C:\Users\***********\Desktop\esetsmartinstaller_enu.exe 2013-09-13 17:50 - 2013-09-13 17:50 - 00000414 _____ C:\Users\***********\Desktop\Download.lnk 2013-09-13 17:44 - 2013-09-13 17:44 - 13376285 _____ C:\Users\***********\Desktop\Tupperware Profi-Chef.mp4 2013-09-13 13:39 - 2011-01-08 19:27 - 00000000 ____D C:\Users\***********\AppData\Local\PMB Files 2013-09-13 13:07 - 2013-09-13 13:07 - 00037920 _____ C:\Users\***********\Downloads\FRST.txt 2013-09-13 12:59 - 2013-09-13 12:59 - 00000000 ____D C:\Windows\ERUNT 2013-09-13 12:57 - 2013-09-13 12:40 - 00000000 ____D C:\AdwCleaner 2013-09-13 12:56 - 2009-08-11 11:47 - 00035669 _____ C:\ProgramData\nvModes.dat 2013-09-13 12:56 - 2009-08-11 11:47 - 00035669 _____ C:\ProgramData\nvModes.001 2013-09-13 12:56 - 2006-11-02 15:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2013-09-13 12:55 - 2006-11-02 15:01 - 00032530 _____ C:\Windows\Tasks\SCHEDLGU.TXT 2013-09-13 12:27 - 2013-09-13 12:27 - 01029509 _____ (Thisisu) C:\Users\***********\Desktop\JRT.exe 2013-09-13 12:25 - 2013-09-13 12:25 - 01037278 _____ C:\Users\***********\Desktop\adwcleaner.exe 2013-09-13 12:24 - 2013-09-13 12:24 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\***********\Downloads\mbam-setup-1.75.0.1300.exe 2013-09-13 12:23 - 2013-07-03 08:51 - 00000000 ____D C:\Users***********\Downloads\NUTZTIER-Arche 2013-09-13 12:23 - 2013-07-03 08:51 - 00000000 ____D C:\Users\***********\Downloads\Konto 2013-09-13 12:18 - 2013-09-13 07:49 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy 2013-09-13 10:37 - 2010-09-27 08:13 - 00000000 ____D C:\Users\***********\AppData\Roaming\FRITZ! 2013-09-13 10:02 - 2013-09-13 10:02 - 00377856 _____ C:\Users\***********\Downloads\sit5ry09.exe 2013-09-13 09:51 - 2013-09-13 09:50 - 00025561 _____ C:\Users\***********\Downloads\Addition.txt 2013-09-13 09:49 - 2013-09-13 09:49 - 00000000 ____D C:\FRST 2013-09-13 09:40 - 2013-09-13 09:39 - 00000488 _____ C:\Users\***********\Downloads\defogger_disable.log 2013-09-13 09:39 - 2013-09-13 09:39 - 00000000 _____ C:\Users\***********\defogger_reenable 2013-09-13 09:39 - 2009-12-27 17:09 - 00000000 ____D C:\Users\*********** 2013-09-13 09:38 - 2013-09-13 09:38 - 00050477 _____ C:\Users\***********\Downloads\Defogger.exe 2013-09-13 08:44 - 2013-09-13 07:48 - 00000000 ____D C:\Program Files\Spybot - Search & Destroy 2 2013-09-13 07:49 - 2013-09-13 07:49 - 00000644 _____ C:\Windows\Tasks\Check for updates (Spybot - Search & Destroy).job 2013-09-13 07:49 - 2013-09-13 07:49 - 00000616 _____ C:\Windows\Tasks\Refresh immunization (Spybot - Search & Destroy).job 2013-09-13 07:49 - 2013-09-13 07:49 - 00000446 _____ C:\Windows\Tasks\Scan the system (Spybot - Search & Destroy).job 2013-09-13 07:48 - 2013-09-13 07:48 - 00001962 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk 2013-09-12 03:24 - 2006-11-02 14:47 - 00359560 _____ C:\Windows\system32\FNTCACHE.DAT 2013-09-12 03:04 - 2013-08-07 03:03 - 00000000 ____D C:\Windows\system32\MRT 2013-09-12 03:01 - 2006-11-02 12:24 - 76725432 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe 2013-09-11 08:20 - 2013-09-11 08:19 - 00476024 _____ (1&1 Mail & Media GmbH) C:\Users\***********\Downloads\WEB.DE_MailCheck_chrome_setup.exe 2013-09-10 08:49 - 2013-09-10 08:49 - 00160640 _____ C:\Users\***********\Downloads\limit-login-attempts.1.7.1.zip 2013-09-07 18:59 - 2013-09-07 18:59 - 00037888 _____ C:\Users\***********\Downloads\GuV_leer.xls 2013-09-04 07:44 - 2013-09-03 08:15 - 00000000 ____D C:\Users\***********\AppData\Roaming\Google 2013-09-03 10:34 - 2013-09-03 10:33 - 00000000 ____D C:\Users\***********\Downloads\Diverses 2013-09-03 10:33 - 2013-09-03 10:32 - 00000000 ____D C:\Users\***********\Downloads\Rico Diverses 2013-09-03 10:33 - 2013-08-06 09:58 - 00000000 ____D C:\Users\***********\Downloads\Tupperzwischenlager 2013-09-03 08:15 - 2012-07-24 12:36 - 00000808 _____ C:\Users\Public\Desktop\CCleaner.lnk 2013-09-03 08:15 - 2011-01-13 13:36 - 00000000 ____D C:\ProgramData\Google 2013-09-03 08:15 - 2010-11-30 17:54 - 00000000 ____D C:\Users\***********\AppData\Local\Google 2013-09-03 08:15 - 2009-12-31 13:38 - 00000000 ____D C:\Program Files\CCleaner 2013-09-03 08:14 - 2010-11-30 17:54 - 00000000 ____D C:\Program Files\Google 2013-09-02 09:46 - 2011-09-28 12:34 - 00000000 ____D C:\ProgramData\CanonIJPLM 2013-09-02 07:47 - 2013-06-29 20:42 - 00262144 _____ C:\Windows\system32\config\ELAM 2013-09-02 07:46 - 2013-09-02 07:46 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe 2013-08-31 03:19 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\Microsoft.NET 2013-08-28 12:18 - 2013-07-03 08:50 - 00000000 ____D C:\Users\***********\Documents\TUPPERWARE 2013-08-27 10:19 - 2013-07-19 08:55 - 00000000 ____D C:\Users\***********\Downloads\WORDPRESS 2013-08-27 10:14 - 2013-08-27 10:12 - 00000000 ____D C:\Users\***********\Documents\Arbeit 2013-08-27 10:13 - 2013-08-07 07:59 - 00000000 ____D C:\Users\***********\Documents\*********** 2013-08-27 10:13 - 2013-07-03 08:50 - 00000000 ____D C:\Users\***********\Documents\Übersichten Kontoauszüge 2013-08-25 20:20 - 2013-08-22 17:21 - 00000000 ____D C:\Users\***********\AppData\Roaming\Monotype 2013-08-24 12:38 - 2013-08-24 12:38 - 01412416 _____ C:\Users\***********\Documents\Meine Änderungen des Themes.odp 2013-08-24 09:46 - 2013-08-24 09:46 - 00000000 ____D C:\Users\***********\AppData\Local\Monotype_Inc 2013-08-23 19:07 - 2009-12-27 17:28 - 00003584 _____ C:\Users\***********\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2013-08-23 18:37 - 2013-08-23 18:37 - 00000000 ____D C:\Users\***********\AppData\Roaming\BlogDesk 2013-08-23 18:37 - 2006-11-02 13:18 - 00000000 ____D C:\Program Files\Common Files\microsoft shared 2013-08-23 17:57 - 2013-08-14 08:26 - 00000568 ____H C:\Users\***********\Downloads\.picasa.ini 2013-08-23 16:35 - 2013-08-23 14:12 - 00000000 ____D C:\Users\***********\AppData\Roaming\Notepad++ 2013-08-23 14:13 - 2013-08-23 14:13 - 00000872 _____ C:\Users\***********\Desktop\Notepad++.lnk 2013-08-23 14:13 - 2013-08-23 14:13 - 00000000 ____D C:\Users\***********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Notepad++ 2013-08-23 14:13 - 2013-08-23 14:12 - 00000000 ____D C:\Program Files\Notepad++ 2013-08-23 09:27 - 2013-08-22 18:24 - 00000000 ____D C:\Users\***********\AppData\Roaming\FileZilla 2013-08-22 18:25 - 2013-08-22 18:25 - 00000000 ____D C:\Program Files\FileZilla FTP Client 2013-08-22 18:25 - 2013-08-22 18:21 - 00001789 _____ C:\Users\Public\Desktop\FileZilla Client.lnk 2013-08-22 18:08 - 2013-08-22 18:08 - 00000000 ___HD C:\Users\***********\skyfonts-google 2013-08-22 17:59 - 2013-07-03 08:51 - 00000000 ____D C:\Users\***********\Downloads\Schriftstile 2013-08-22 17:21 - 2013-08-22 17:21 - 00001791 _____ C:\Users\Public\Desktop\SkyFonts.lnk 2013-08-22 17:21 - 2013-08-22 17:21 - 00000000 ____D C:\Program Files\Monotype 2013-08-22 17:18 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\system32\de-DE 2013-08-22 09:47 - 2013-08-22 09:46 - 00000266 ____H C:\Users\***********\.picasa.ini 2013-08-22 09:43 - 2012-07-21 16:41 - 00000000 ___SD C:\Users\***********\Google Drive 2013-08-21 03:07 - 2010-09-07 18:10 - 00000000 ____D C:\Program Files\McAfee 2013-08-20 15:13 - 2013-08-20 15:13 - 00001166 _____ C:\Users\Public\Desktop\WEB.DE Club SmartFax.lnk 2013-08-15 08:17 - 2010-04-07 12:10 - 00000000 ____D C:\Windows\Minidump 2013-08-15 08:04 - 2013-08-15 08:04 - 00000000 ____D C:\Users\***********\AppData\Local\Chromium 2013-08-15 03:46 - 2006-11-02 13:18 - 00000000 ____D C:\Windows\rescache Some content of TEMP: ==================== C:\Users\***********\AppData\Local\Temp\Quarantine.exe ==================== Bamital & volsnap Check ================= C:\Windows\explorer.exe => MD5 is legit C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-09-14 01:03 ==================== End Of Log ============================ Ich hätte gerne noch einen Tipp bekommen, falls das möglich wäre, da Du ja nun alles meine Programme quasi gesehen hast, welche Schutzprogramme sollte ich haben und wie regelmäßig ausführen? Bzw. welche sollte ich runter schmeißen? In der Beziehung bin ich echt unsicher! Das wäre sehr nett! Und wenn ich kein Problem mehr hab, dann ist ja alles gut! Eine Frage noch, kann ich mit Deiner/Eurer Hilfe mein Netbook wieder auf Vordermann bringen ? Quasi von außerhalb, weil es nicht mehr ansprechbar ist. Fährt zwar hoch, aber dann ist Ende Gelände. Keine Ahnung was ich mir da eingefangen habe. Zum Abschluss, welche Programme soll ich von deinen, die ich jetzt geladen habe, wieder löschen? VIELEN DANK!!! Du glaubst gar nicht wie toll ich das finde! Hörst Du bestimmt oft genug!
__________________ Ich bin ein Neuling und habe doch gar nicht so viel Ahnung! Bitte bedenkt das! Das wäre nett! schon mal im voraus! Geändert von Nicht-Elfe (14.09.2013 um 07:45 Uhr) Grund: Neue Logs |
14.09.2013, 20:20 | #6 |
/// the machine /// TB-Ausbilder | Win32.Downloader.gen & Montera.Toolbar mit Spybot gefunden Fertig Die Reihenfolge ist hier entscheidend.
Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann. Zum Netbook: welches Betriebssystem?
__________________ --> Win32.Downloader.gen & Montera.Toolbar mit Spybot gefunden |
Themen zu Win32.Downloader.gen & Montera.Toolbar mit Spybot gefunden |
adblock, adobe, booten, browser, canon, computer, defender, desktop, dsl, email, farbar, farbar recovery scan tool, flash player, ftp, google, helper.exe, home, homepage, picasa, plug-in, realtek, refresh, registry, registry key, rundll, safer networking, scan, security, services.exe, siteadvisor, software, svchost.exe, system, temp, user agent, windows |