Trojaner TR/Dldr.Bizone.A

splify · 18.09.2013, 22:46

Hallo ihr lieben Helfer,

heute hatte ich plötzlich keinen Zugriff mehr auf mein Hotmail-Konto und es wurde angezeigt, dass sich jemand Fremdes eingeloggt hat. Ich habe deshalb mit Avira einen Systemscan durchgeführt und bin so auf den Trojaner "TR/Dldr.Bizone.A" gestoßen, den ich dann in die Quarantäne geschoben habe, wie ihr untenstehendem Log entnehmen könnt. Ich habe mir den Hilfs-Thread sorgsam durchgelesen und versuche nun alles so zu posten wie dort beschrieben. Falls ich etwas falsch mache oder etwas fehlt, sagt bitte bescheid! Ich hoffe ihr könnt mir helfen und Tipps geben, wie ich nun weiter vorgehen sollte. Vielen Dank schon jetzt für die Mühe!

Liebe Grüße,
Sabrina

Avira Log:

Code:

ATTFilter

Exportierte Ereignisse:

18.09.2013 22:39 [System-Scanner] Malware gefunden
      Die Datei 'C:\Users\Sabrina\AppData\Local\Microsoft\Windows\Explorer\FUD_5.exe'
      enthielt einen Virus oder unerwünschtes Programm 'TR/Dldr.Bizone.A' [trojan].
      Durchgeführte Aktion(en):
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5488a0be.qua' 
      verschoben!

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-09-2013
Ran by Sabrina (administrator) on SABRINA-PC on 18-09-2013 23:04:37
Running from D:\Documents\Downloads
Windows 7 Ultimate Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Windows\SysWOW64\srvany.exe
() C:\Windows\KMService.exe
() C:\Program Files (x86)\MyPublicWiFi\PublicWiFiService.exe
(Nalpeiron Ltd.) C:\Windows\SysWOW64\nlssrv32.exe
(MMSOFT Design Ltd.) C:\Program Files\PC Monitor\PCMonitorSrv.exe
(MMSOFT Design Ltd.) C:\Program Files\PC Monitor\pcmontask.exe
() C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe
(Dropbox, Inc.) C:\Users\Sabrina\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
() C:\Program Files (x86)\MyPublicWiFi\MyPublicWiFi.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Avira Operations GmbH & Co. KG) C:\program files (x86)\avira\antivir desktop\avcenter.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() D:\Documents\Downloads\Defogger.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [PC Monitor Operations] - C:\Program Files\PC Monitor\pcmontask.exe [519640 2013-08-29] (MMSOFT Design Ltd.)
HKCU\...\Run: [Rainlendar2] - C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe [2498048 2012-07-24] ()
HKCU\...\Run: [AdobeBridge] - [x]
MountPoints2: {c6225ca2-1b48-11e2-bc58-0026b9ab2f73} - F:\Setup.exe
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-08-20] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [BCSSync] - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
HKLM-x32\...\Run: [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] - C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-11-28] (Apple Inc.)
HKLM-x32\...\Run: [MyPublicWiFi] - C:\Program Files (x86)\MyPublicWiFi\MyPublicWiFi.exe [2002944 2011-12-22] ()
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
AppInit_DLLs-x32: c:\progra~3\browse~1\23796~1.11\{16cdf~1\browse~1.dll [ ] ()
Startup: C:\Users\Sabrina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CloudStation.lnk
ShortcutTarget: CloudStation.lnk -> C:\Users\Sabrina\AppData\Local\CloudStation\bin\cloud.exe ()
Startup: C:\Users\Sabrina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Sabrina\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=AT&userid=4c0a83b1-d787-4b60-802c-bf650b53c6c9&affid=113129&searchtype=ds&babsrc=lnkry&q={searchTerms}
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=AT&userid=4c0a83b1-d787-4b60-802c-bf650b53c6c9&affid=113129&searchtype=hp&babsrc=lnkry_nt
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x8DBED6DA4FA9CD01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=AT&userid=4c0a83b1-d787-4b60-802c-bf650b53c6c9&affid=113129&searchtype=ds&babsrc=lnkry&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM-x32 - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=AT&userid=4c0a83b1-d787-4b60-802c-bf650b53c6c9&affid=113129&searchtype=ds&babsrc=lnkry&q={searchTerms}
SearchScopes: HKLM-x32 - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=AT&userid=4c0a83b1-d787-4b60-802c-bf650b53c6c9&affid=113129&searchtype=ds&babsrc=lnkry&q={searchTerms}
SearchScopes: HKCU - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=AT&userid=4c0a83b1-d787-4b60-802c-bf650b53c6c9&affid=113129&searchtype=ds&babsrc=lnkry&q={searchTerms}
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=AT&userid=4c0a83b1-d787-4b60-802c-bf650b53c6c9&affid=113129&searchtype=ds&babsrc=lnkry&q={searchTerms}
SearchScopes: HKCU - {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL = 
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM -  No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} -  No File
Toolbar: HKLM-x32 -  No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} -  No File
DPF: HKLM-x32 {02BCC737-B171-4746-94C9-0D8A0B2C0089} hxxp://office.microsoft.com/_layouts/ClientBin/ieawsdc32.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Sabrina\AppData\Roaming\Mozilla\Firefox\Profiles\9oihsdpc.default
FF user.js: detected! => C:\Users\Sabrina\AppData\Roaming\Mozilla\Firefox\Profiles\9oihsdpc.default\user.js
FF DefaultSearchEngine: Web Search
FF SelectedSearchEngine: Web Search
FF Homepage: hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=AT&userid=4c0a83b1-d787-4b60-802c-bf650b53c6c9&affid=113129&searchtype=hp&babsrc=lnkry
FF Keyword.URL: hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=AT&userid=4c0a83b1-d787-4b60-802c-bf650b53c6c9&affid=113129&searchtype=ds&babsrc=lnkry&q=
FF Plugin: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Sabrina\AppData\Roaming\Mozilla\Firefox\Profiles\9oihsdpc.default\searchplugins\Web Search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF HKLM-x32\...\Firefox\Extensions: [{ACAA314B-EEBA-48e4-AD47-84E31C44796C}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\
FF Extension: No Name - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\

Chrome: 
=======
CHR HomePage: https://www.facebook.com/
CHR Extension: (Google Drive) - C:\Users\Sabrina\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (YouTube) - C:\Users\Sabrina\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\Sabrina\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Chrome In-App Payments service) - C:\Users\Sabrina\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.10_0
CHR Extension: (Gmail) - C:\Users\Sabrina\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1
CHR HKLM-x32\...\Chrome\Extension: [pgafcinpmmpklohkojmllohdhomoefph] - C:\ProgramData\Browser Manager\2.3.796.11\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.crx

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-08-20] (Avira Operations GmbH & Co. KG)
S4 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-08-20] (Avira Operations GmbH & Co. KG)
R2 KMService; C:\Windows\SysWow64\srvany.exe [8192 2012-10-21] ()
R2 MyPublicWiFiService; C:\Program Files (x86)\MyPublicWiFi\PublicWiFiService.exe [597504 2011-12-02] ()
S3 OpenVPNService; C:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe [29920 2013-01-08] (The OpenVPN Project)
R2 PC Monitor; C:\Program Files\PC Monitor\PCMonitorSrv.exe [581592 2013-08-29] (MMSOFT Design Ltd.)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-05] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-08-20] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-03-30] (Avira Operations GmbH & Co. KG)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2012-10-21] (DT Soft Ltd)
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [x]
S3 tsusbhub; system32\drivers\tsusbhub.sys [x]
S3 VGPU; System32\drivers\rdvgkmd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-18 23:04 - 2013-09-18 23:04 - 00051332 _____ C:\Users\Sabrina\Desktop\Für alle Hilfesuchenden! Was muss ich vor der Eröffnung eines Themas beachten  - Trojaner-Board.htm
2013-09-18 23:04 - 2013-09-18 23:04 - 00000000 ____D C:\FRST
2013-09-18 23:02 - 2013-09-18 23:02 - 00000168 _____ C:\Users\Sabrina\defogger_reenable
2013-09-16 13:11 - 2013-09-16 13:29 - 00061287 _____ C:\Users\Sabrina\Desktop\nico u bianca.wlmp
2013-09-09 19:40 - 2013-09-09 19:40 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-09-09 19:40 - 2013-09-09 19:40 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-08-19 17:02 - 2013-08-19 17:02 - 00000000 ____D C:\Users\Sabrina\Desktop\EN.PLL.SD.409
2013-08-19 10:09 - 2013-08-19 16:29 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

==================== One Month Modified Files and Folders =======

2013-09-18 23:04 - 2013-09-18 23:04 - 00051332 _____ C:\Users\Sabrina\Desktop\Für alle Hilfesuchenden! Was muss ich vor der Eröffnung eines Themas beachten  - Trojaner-Board.htm
2013-09-18 23:04 - 2013-09-18 23:04 - 00000000 ____D C:\FRST
2013-09-18 23:02 - 2013-09-18 23:02 - 00000168 _____ C:\Users\Sabrina\defogger_reenable
2013-09-18 23:02 - 2012-10-13 16:00 - 00000000 ____D C:\Users\Sabrina
2013-09-18 22:25 - 2012-10-13 16:35 - 00001112 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-18 22:01 - 2012-10-13 15:52 - 01112481 _____ C:\Windows\WindowsUpdate.log
2013-09-18 21:25 - 2012-10-13 16:35 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-18 20:57 - 2009-07-14 06:45 - 00016848 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-18 20:57 - 2009-07-14 06:45 - 00016848 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-18 20:56 - 2013-04-07 12:41 - 00000000 ____D C:\Users\Sabrina\AppData\Roaming\Dropbox
2013-09-18 20:50 - 2013-07-08 11:56 - 00000000 ___RD C:\Users\Sabrina\Unwichtiger Cloudstation Ordner
2013-09-18 20:49 - 2013-05-09 15:28 - 00009085 _____ C:\Windows\setupact.log
2013-09-18 20:49 - 2012-12-08 11:06 - 00000438 _____ C:\Windows\system32\Drivers\etc\hosts.ics
2013-09-18 20:49 - 2012-10-13 21:53 - 00000000 ____D C:\Users\Sabrina\.rainlendar2
2013-09-18 20:49 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-17 16:47 - 2012-11-10 19:36 - 00739178 _____ C:\Windows\system32\perfh00A.dat
2013-09-17 16:47 - 2012-11-10 19:36 - 00158714 _____ C:\Windows\system32\perfc00A.dat
2013-09-17 16:47 - 2009-07-14 19:58 - 00701710 _____ C:\Windows\system32\perfh007.dat
2013-09-17 16:47 - 2009-07-14 19:58 - 00149874 _____ C:\Windows\system32\perfc007.dat
2013-09-17 16:47 - 2009-07-14 07:13 - 02522360 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-16 13:29 - 2013-09-16 13:11 - 00061287 _____ C:\Users\Sabrina\Desktop\nico u bianca.wlmp
2013-09-16 10:59 - 2012-12-04 14:23 - 00000000 ____D C:\Users\Sabrina\AppData\Local\Windows Live
2013-09-13 17:12 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2013-09-09 19:40 - 2013-09-09 19:40 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-09-09 19:40 - 2013-09-09 19:40 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-09-05 14:08 - 2013-03-30 14:22 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-08-30 08:35 - 2012-10-15 18:55 - 00000000 ____D C:\Users\Sabrina\AppData\Roaming\Skype
2013-08-30 07:58 - 2013-01-14 15:23 - 00000000 ____D C:\Program Files\PC Monitor
2013-08-29 08:03 - 2012-10-17 18:53 - 00000000 ____D C:\Users\Sabrina\AppData\Roaming\vlc
2013-08-20 11:01 - 2013-05-07 19:02 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-08-20 11:01 - 2013-03-30 14:22 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-08-20 10:52 - 2012-10-28 20:15 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-19 17:02 - 2013-08-19 17:02 - 00000000 ____D C:\Users\Sabrina\Desktop\EN.PLL.SD.409
2013-08-19 16:29 - 2013-08-19 10:09 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

Some content of TEMP:
====================
C:\Users\Sabrina\AppData\Local\Temp\SkypeSetup.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


testsigning: ==> Check for possible unsigned rootkit driver <===== ATTENTION!


nointegritychecks: ==> Integrity Checks is disabled <===== ATTENTION!


LastRegBack: 2013-09-13 15:20

==================== End Of Log ============================

--- --- ---

--- --- ---

Addition:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 16-09-2013
Ran by Sabrina at 2013-09-18 23:05:48
Running from D:\Documents\Downloads
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

Adobe AIR (x32 Version: 3.4.0.2710)
Adobe Download Assistant (x32 Version: 1.2.3)
Adobe Flash Player 11 ActiveX (x32 Version: 11.5.502.110)
Adobe Photoshop CS6 (x32 Version: 13.0)
Adobe Reader X (10.1.5) - Deutsch (x32 Version: 10.1.5)
Amazon Kindle (x32)
Any Video Converter 5.0.5 (x32)
Apple Application Support (x32 Version: 2.3.2)
Apple Mobile Device Support (Version: 6.0.1.3)
Apple Software Update (x32 Version: 2.1.3.127)
Avira Free Antivirus (x32 Version: 13.0.0.4052)
Bonjour (Version: 3.0.0.10)
calibre (x32 Version: 0.9.40)
Color Efex Pro 4 (x32 Version: 4.0.0.2)
D3DX10 (x32 Version: 15.4.2368.0902)
DAEMON Tools Lite (x32 Version: 4.45.4.0314)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32)
Dropbox (HKCU Version: 2.0.22)
Fotogalerie (x32 Version: 16.4.3505.0912)
Free YouTube to MP3 Converter version 3.11.36.1201 (x32 Version: 3.11.36.1201)
GIMP 2.8.2 (Version: 2.8.2)
Google Chrome (x32 Version: 29.0.1547.66)
Google Update Helper (x32 Version: 1.3.21.153)
Java 7 Update 25 (x32 Version: 7.0.250)
Java Auto Updater (x32 Version: 2.1.9.5)
JDownloader 0.9 (x32 Version: 0.9)
Manage PC Shut Down 1.0 (x32)
Microsoft .NET Framework 4.5 (Version: 4.5.50709)
Microsoft .NET Framework 4.5 DEU Language Pack (Version: 4.5.50709)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Office 2010 Service Pack 1 (SP1) (x32)
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Groove MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office InfoPath MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.6029.1000)
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Professional Plus 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000)
Movie Maker (x32 Version: 16.4.3505.0912)
Mozilla Firefox 23.0.1 (x86 de) (x32 Version: 23.0.1)
Mozilla Maintenance Service (x32 Version: 23.0.1)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT110 (x32 Version: 16.4.1108.0727)
MSVCRT110_amd64 (Version: 16.4.1109.0912)
MyPublicWiFi 4.1 (x32)
Notepad++ (x32 Version: 6.3.2)
OpenVPN 2.3.0-I001  (x32 Version: 2.3.0-I001)
PC Monitor (Version: 3.5.2)
PDF Settings CS6 (x32 Version: 11.0)
PDF-Viewer (Version: 2.5.210.0)
Photo Gallery (x32 Version: 16.4.3505.0912)
Rainlendar2 (remove only) (x32)
Skype™ 6.3 (x32 Version: 6.3.107)
Synology Cloud Station (remove only) (HKCU)
TAP-Windows 9.9.2 (Version: 9.9.2)
Update for Microsoft Office 2010 (KB2553065) (x32)
Update for Microsoft Office 2010 (KB2553092) (x32)
Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553270) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2566458) (x32)
Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2687509) 32-Bit Edition (x32)
Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition (x32)
Update for Microsoft OneNote 2010 (KB2687277) 32-Bit Edition (x32)
Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition (x32)
Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition (x32)
Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition (x32)
VLC media player 2.0.3 (x32 Version: 2.0.3)
Windows Live Communications Platform (x32 Version: 16.4.3505.0912)
Windows Live Essentials (x32 Version: 16.4.3505.0912)
Windows Live ID Sign-in Assistant (Version: 7.250.4311.0)
Windows Live Installer (x32 Version: 16.4.3505.0912)
Windows Live Photo Common (x32 Version: 16.4.3505.0912)
Windows Live PIMT Platform (x32 Version: 16.4.3505.0912)
Windows Live SOXE (x32 Version: 16.4.3505.0912)
Windows Live SOXE Definitions (x32 Version: 16.4.3505.0912)
Windows Live UX Platform (x32 Version: 16.4.3505.0912)
Windows Live UX Platform Language Pack (x32 Version: 16.4.3505.0912)
WinRAR 4.20 (64-Bit) (Version: 4.20.0)

==================== Restore Points  =========================

17-09-2013 12:31:16 Geplanter Prüfpunkt

==================== Hosts content: ==========================

2009-07-14 04:34 - 2012-11-10 14:13 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {044A6734-E90E-4F8F-B357-B2DC8AB3B5EC} - System32\Tasks\Microsoft\Windows\Time Synchronization\SynchronizeTime => Sc.exe start w32time task_started
Task: {24F8993B-F916-40F8-8126-1007580D66CF} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-10-13] (Google Inc.)
Task: {4177F8BD-3FE7-4101-9A26-6EA3AB39016C} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-10-13] (Google Inc.)
Task: {8F9C6DE9-55DB-4CAB-AC40-5F40431CFCB9} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2009-07-14] (Microsoft Corporation)
Task: {BEECBD28-168B-4103-A325-FD76192A3CD6} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {BF7A7D7A-2968-4A0B-8E2D-53BFA8E23251} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task
Task: {F5E81AF1-7C49-46B3-9123-551EE2A60BB2} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2010-11-20] (Microsoft Corporation)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-04-12 13:40 - 2013-04-12 13:40 - 02327552 _____ (TODO: <Company name>) C:\Users\Sabrina\AppData\Local\CloudStation\iconoverlay_v2\IconOverlayDLLs_x64\iconOverlay.dll
2013-04-05 00:12 - 2013-04-05 00:12 - 00164016 _____ (Dropbox, Inc.) C:\Users\Sabrina\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
2011-03-17 00:07 - 2011-03-17 00:07 - 04297568 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2013-01-09 11:10 - 2013-08-29 09:49 - 00024024 _____ (MMSOFT Design Ltd.) C:\Program Files\PC Monitor\CommandTypes.dll
2013-01-09 11:10 - 2013-08-29 09:48 - 00213976 _____ (MMSOFT Design Ltd.) C:\Program Files\PC Monitor\PCMonitorTypes.dll
2013-01-09 11:10 - 2013-06-23 14:11 - 00084952 _____ (MMSOFT Design Ltd.) C:\Program Files\PC Monitor\MMUtilsFw.dll
2012-07-24 10:05 - 2012-07-24 10:05 - 00257536 _____ (The cURL library, hxxp://curl.haxx.se/) C:\Program Files (x86)\Rainlendar2\libcurl.dll
2012-07-24 10:05 - 2012-07-24 10:05 - 00140800 _____ () C:\Program Files (x86)\Rainlendar2\lua52.dll
2012-07-24 10:05 - 2012-07-24 10:05 - 01205760 _____ (wxWidgets development team) C:\Program Files (x86)\Rainlendar2\wxbase28u_vc_rny.dll
2012-07-24 10:05 - 2012-07-24 10:05 - 00131584 _____ (wxWidgets development team) C:\Program Files (x86)\Rainlendar2\wxbase28u_xml_vc_rny.dll
2012-07-24 10:05 - 2012-07-24 10:05 - 00707584 _____ (wxWidgets development team) C:\Program Files (x86)\Rainlendar2\wxmsw28u_adv_vc_rny.dll
2012-07-24 10:05 - 2012-07-24 10:05 - 02633216 _____ (wxWidgets development team) C:\Program Files (x86)\Rainlendar2\wxmsw28u_core_vc_rny.dll
2012-07-24 10:05 - 2012-07-24 10:05 - 00485376 _____ (wxWidgets development team) C:\Program Files (x86)\Rainlendar2\wxmsw28u_html_vc_rny.dll
2012-07-24 10:05 - 2012-07-24 10:05 - 00502784 _____ (wxWidgets development team) C:\Program Files (x86)\Rainlendar2\wxmsw28u_xrc_vc_rny.dll
2012-07-24 10:05 - 2012-07-24 10:05 - 00198144 _____ () C:\Program Files (x86)\Rainlendar2\plugins\iCalendarPlugin.dll
2012-07-24 10:05 - 2012-07-24 10:05 - 00012800 _____ () C:\Program Files (x86)\Rainlendar2\lfs.dll
2012-11-14 01:32 - 2012-11-14 01:32 - 03558400 _____ (wxWidgets development team) C:\Users\Sabrina\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll
2013-03-13 22:48 - 2013-03-13 22:48 - 24978944 _____ () C:\Users\Sabrina\AppData\Roaming\Dropbox\bin\libcef.dll
2013-03-13 22:48 - 2013-03-13 22:48 - 09956864 _____ (The ICU Project) C:\Users\Sabrina\AppData\Roaming\Dropbox\bin\icudt.dll
2013-04-05 00:12 - 2013-04-05 00:12 - 00130736 _____ (Dropbox, Inc.) C:\Users\Sabrina\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
2011-03-17 00:11 - 2011-03-17 00:11 - 04297568 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2013-09-04 19:28 - 2013-09-02 22:35 - 00709584 _____ () C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.66\libglesv2.dll
2013-09-04 19:28 - 2013-09-02 22:35 - 00099792 _____ () C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.66\libegl.dll
2013-09-04 19:28 - 2013-09-02 22:35 - 04053456 _____ () C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.66\pdf.dll
2013-09-04 19:28 - 2013-09-02 22:35 - 00410576 _____ () C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.66\ppGoogleNaClPluginChrome.dll
2013-09-04 19:28 - 2013-09-02 22:35 - 01604560 _____ () C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.66\ffmpegsumo.dll
2013-09-04 19:28 - 2013-09-02 22:35 - 13599184 _____ () C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.66\PepperFlash\pepflashplayer.dll
2012-10-13 16:59 - 2012-09-19 19:17 - 00397088 _____ () C:\program files (x86)\avira\antivir desktop\sqlite3.dll

==================== Alternate Data Streams (whitelisted) ==========

AlternateDataStreams: C:\Windows:nlsPreferences


==================== Faulty Device Manager Devices =============

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Massenspeichercontroller
Description: Massenspeichercontroller
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Microsoft-Adapter für Miniports virtueller WiFis
Description: Microsoft-Adapter für Miniports virtueller WiFis
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: vwifimp
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (09/18/2013 08:50:57 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: avnotify.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6b921
Name des fehlerhaften Moduls: avnotify.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6b921
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00001487
ID des fehlerhaften Prozesses: 0x604
Startzeit der fehlerhaften Anwendung: 0xavnotify.exe0
Pfad der fehlerhaften Anwendung: avnotify.exe1
Pfad des fehlerhaften Moduls: avnotify.exe2
Berichtskennung: avnotify.exe3

Error: (09/17/2013 07:59:32 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: avnotify.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6b921
Name des fehlerhaften Moduls: avnotify.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6b921
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00001487
ID des fehlerhaften Prozesses: 0x15c0
Startzeit der fehlerhaften Anwendung: 0xavnotify.exe0
Pfad der fehlerhaften Anwendung: avnotify.exe1
Pfad des fehlerhaften Moduls: avnotify.exe2
Berichtskennung: avnotify.exe3

Error: (09/17/2013 02:00:14 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: avnotify.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6b921
Name des fehlerhaften Moduls: avnotify.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6b921
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00001487
ID des fehlerhaften Prozesses: 0x1014
Startzeit der fehlerhaften Anwendung: 0xavnotify.exe0
Pfad der fehlerhaften Anwendung: avnotify.exe1
Pfad des fehlerhaften Moduls: avnotify.exe2
Berichtskennung: avnotify.exe3

Error: (09/16/2013 04:27:57 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: avnotify.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6b921
Name des fehlerhaften Moduls: avnotify.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6b921
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00001487
ID des fehlerhaften Prozesses: 0x158
Startzeit der fehlerhaften Anwendung: 0xavnotify.exe0
Pfad der fehlerhaften Anwendung: avnotify.exe1
Pfad des fehlerhaften Moduls: avnotify.exe2
Berichtskennung: avnotify.exe3

Error: (09/16/2013 10:28:00 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: avnotify.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6b921
Name des fehlerhaften Moduls: avnotify.exe, Version: 13.6.20.2100, Zeitstempel: 0x51e6b921
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00001487
ID des fehlerhaften Prozesses: 0x5f0
Startzeit der fehlerhaften Anwendung: 0xavnotify.exe0
Pfad der fehlerhaften Anwendung: avnotify.exe1
Pfad des fehlerhaften Moduls: avnotify.exe2
Berichtskennung: avnotify.exe3

Error: (09/15/2013 07:23:57 PM) (Source: PublicWiFiService.exe) (User: )
Description: Windows-Socket-Fehler: Ein Socketvorgang konnte nicht ausgeführt werden, da dem System Pufferspeicher fehlte oder eine Warteschlange voll war (10055), auf API 'connect'

Error: (09/15/2013 07:23:56 PM) (Source: PublicWiFiService.exe) (User: )
Description: Windows-Socket-Fehler: Ein Socketvorgang konnte nicht ausgeführt werden, da dem System Pufferspeicher fehlte oder eine Warteschlange voll war (10055), auf API 'connect'

Error: (09/15/2013 07:23:55 PM) (Source: PublicWiFiService.exe) (User: )
Description: Windows-Socket-Fehler: Ein Socketvorgang konnte nicht ausgeführt werden, da dem System Pufferspeicher fehlte oder eine Warteschlange voll war (10055), auf API 'connect'

Error: (09/15/2013 07:23:54 PM) (Source: PublicWiFiService.exe) (User: )
Description: Windows-Socket-Fehler: Ein Socketvorgang konnte nicht ausgeführt werden, da dem System Pufferspeicher fehlte oder eine Warteschlange voll war (10055), auf API 'connect'

Error: (09/15/2013 07:23:53 PM) (Source: PublicWiFiService.exe) (User: )
Description: Windows-Socket-Fehler: Ein Socketvorgang konnte nicht ausgeführt werden, da dem System Pufferspeicher fehlte oder eine Warteschlange voll war (10055), auf API 'connect'


System errors:
=============
Error: (09/18/2013 08:51:23 PM) (Source: ipnathlp) (User: )
Description: 0

Error: (09/18/2013 08:48:59 PM) (Source: atikmdag) (User: )
Description: Display is not active

Error: (09/18/2013 08:48:59 PM) (Source: atikmdag) (User: )
Description: CPLIB :: General - Invalid Parameter

Error: (09/17/2013 05:19:31 PM) (Source: ipnathlp) (User: )
Description: 0

Error: (09/17/2013 05:19:29 PM) (Source: ipnathlp) (User: )
Description: 0

Error: (09/17/2013 02:26:10 PM) (Source: volsnap) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.

Error: (09/17/2013 01:58:36 PM) (Source: atikmdag) (User: )
Description: Display is not active

Error: (09/17/2013 01:58:36 PM) (Source: atikmdag) (User: )
Description: CPLIB :: General - Invalid Parameter

Error: (09/16/2013 10:26:57 AM) (Source: atikmdag) (User: )
Description: Display is not active

Error: (09/16/2013 10:26:57 AM) (Source: atikmdag) (User: )
Description: CPLIB :: General - Invalid Parameter


Microsoft Office Sessions:
=========================
Error: (09/18/2013 08:50:57 PM) (Source: Application Error)(User: )
Description: avnotify.exe13.6.20.210051e6b921avnotify.exe13.6.20.210051e6b921c00000050000148760401ceb49ffc75b136C:\Program Files (x86)\Avira\AntiVir Desktop\avnotify.exeC:\Program Files (x86)\Avira\AntiVir Desktop\avnotify.exe402bcb60-2093-11e3-9276-0026b9ab2f73

Error: (09/17/2013 07:59:32 PM) (Source: Application Error)(User: )
Description: avnotify.exe13.6.20.210051e6b921avnotify.exe13.6.20.210051e6b921c00000050000148715c001ceb3cfa9593f93C:\Program Files (x86)\Avira\AntiVir Desktop\avnotify.exeC:\Program Files (x86)\Avira\AntiVir Desktop\avnotify.exee720dc92-1fc2-11e3-9959-0026b9ab2f73

Error: (09/17/2013 02:00:14 PM) (Source: Application Error)(User: )
Description: avnotify.exe13.6.20.210051e6b921avnotify.exe13.6.20.210051e6b921c000000500001487101401ceb39d75353e0aC:\Program Files (x86)\Avira\AntiVir Desktop\avnotify.exeC:\Program Files (x86)\Avira\AntiVir Desktop\avnotify.exeb5bef0bf-1f90-11e3-9959-0026b9ab2f73

Error: (09/16/2013 04:27:57 PM) (Source: Application Error)(User: )
Description: avnotify.exe13.6.20.210051e6b921avnotify.exe13.6.20.210051e6b921c00000050000148715801ceb2e8ef8777e6C:\Program Files (x86)\Avira\AntiVir Desktop\avnotify.exeC:\Program Files (x86)\Avira\AntiVir Desktop\avnotify.exe2e106bea-1edc-11e3-9e7f-0026b9ab2f73

Error: (09/16/2013 10:28:00 AM) (Source: Application Error)(User: )
Description: avnotify.exe13.6.20.210051e6b921avnotify.exe13.6.20.210051e6b921c0000005000014875f001ceb2b6a24385f1C:\Program Files (x86)\Avira\AntiVir Desktop\avnotify.exeC:\Program Files (x86)\Avira\AntiVir Desktop\avnotify.exee531215c-1ea9-11e3-9e7f-0026b9ab2f73

Error: (09/15/2013 07:23:57 PM) (Source: PublicWiFiService.exe)(User: )
Description: Windows-Socket-Fehler: Ein Socketvorgang konnte nicht ausgeführt werden, da dem System Pufferspeicher fehlte oder eine Warteschlange voll war (10055), auf API 'connect'

Error: (09/15/2013 07:23:56 PM) (Source: PublicWiFiService.exe)(User: )
Description: Windows-Socket-Fehler: Ein Socketvorgang konnte nicht ausgeführt werden, da dem System Pufferspeicher fehlte oder eine Warteschlange voll war (10055), auf API 'connect'

Error: (09/15/2013 07:23:55 PM) (Source: PublicWiFiService.exe)(User: )
Description: Windows-Socket-Fehler: Ein Socketvorgang konnte nicht ausgeführt werden, da dem System Pufferspeicher fehlte oder eine Warteschlange voll war (10055), auf API 'connect'

Error: (09/15/2013 07:23:54 PM) (Source: PublicWiFiService.exe)(User: )
Description: Windows-Socket-Fehler: Ein Socketvorgang konnte nicht ausgeführt werden, da dem System Pufferspeicher fehlte oder eine Warteschlange voll war (10055), auf API 'connect'

Error: (09/15/2013 07:23:53 PM) (Source: PublicWiFiService.exe)(User: )
Description: Windows-Socket-Fehler: Ein Socketvorgang konnte nicht ausgeführt werden, da dem System Pufferspeicher fehlte oder eine Warteschlange voll war (10055), auf API 'connect'


==================== Memory info =========================== 

Percentage of memory in use: 50%
Total physical RAM: 4090.96 MB
Available physical RAM: 2005 MB
Total Pagefile: 8180.12 MB
Available Pagefile: 5888.16 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:48.83 GB) (Free:4.92 GB) NTFS
Drive d: () (Fixed) (Total:249.16 GB) (Free:160 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: 74582F0E)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=49 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=249 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Gmer:

Code:

ATTFilter

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-09-18 23:34:01
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ST9320325AS rev.D003DEM1 298,09GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Sabrina\AppData\Local\Temp\pxlirfob.sys


---- User code sections - GMER 2.1 ----

.text   C:\Program Files (x86)\MyPublicWiFi\PublicWiFiService.exe[1124] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69          00000000766a1465 2 bytes [6A, 76]
.text   C:\Program Files (x86)\MyPublicWiFi\PublicWiFiService.exe[1124] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155         00000000766a14bb 2 bytes [6A, 76]
.text   ...                                                                                                                              * 2
.text   C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2276] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69     00000000766a1465 2 bytes [6A, 76]
.text   C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2276] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155    00000000766a14bb 2 bytes [6A, 76]
.text   ...                                                                                                                              * 2
.text   C:\Program Files (x86)\MyPublicWiFi\MyPublicWiFi.exe[2352] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69               00000000766a1465 2 bytes [6A, 76]
.text   C:\Program Files (x86)\MyPublicWiFi\MyPublicWiFi.exe[2352] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155              00000000766a14bb 2 bytes [6A, 76]
.text   ...                                                                                                                              * 2
.text   C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2360] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69   00000000766a1465 2 bytes [6A, 76]
.text   C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2360] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155  00000000766a14bb 2 bytes [6A, 76]
.text   ...                                                                                                                              * 2

---- Devices - GMER 2.1 ----

Device  \Driver\avipbb \Device\avipbb                                                                                                    fffff8800b36a768

---- EOF - GMER 2.1 ----

cosinus · 18.09.2013, 23:25

Hallo und

Zitat:

() C:\Windows\SysWOW64\srvany.exe
() C:\Windows\KMService.exe

Da scheint wohl mal jmd einen Office-Crack verwendet zu haben!

Und wenn schon ein gecracktes Office drauf ist, sollte man vllt auch mal klären aus welcher Quelle deine Ultimate Edition von Windows stammt.

Bitte lesen => http://www.trojaner-board.de/95393-c...-software.html

Es geht weiter wenn du alles Illegale entfernt hast.

Bei wiederholten Crack/Keygen Verstößen behalte ich es mir vor, den Support einzustellen, d.h. Hilfe nur noch bei der Datensicherung und Neuinstallation des Betriebssystems.

Trojaner TR/Dldr.Bizone.A

Log-Analyse und Auswertung: Trojaner TR/Dldr.Bizone.A

Trojaner TR/Dldr.Bizone.A

Trojaner TR/Dldr.Bizone.A

Ähnliche Themen: Trojaner TR/Dldr.Bizone.A