| |
| |||||||
Log-Analyse und Auswertung: Safa7_22.vbs Datei versteckt Dateien und produziert Verknüpfungen in system32Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
17.12.2013, 00:03
| #31 |
 |  Safa7_22.vbs Datei versteckt Dateien und produziert Verknüpfungen in system32 Hier die Scanlogs, ich habe den Scan zwei Mal ausgeführt. Beide Male wurde kein Fehler gefunden, also auch keine Bereinigung... Code:
ATTFilter Malwarebytes Anti-Rootkit BETA 1.07.0.1008
www.malwarebytes.org
Database version: v2013.12.16.07
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16476
Toshiba :: TOSHIBA-TOSH [administrator]
16.12.2013 23:01:26
mbar-log-2013-12-16 (23-01-26).txt
Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Kernel memory modifications detected. Deep Anti-Rootkit Scan engaged.
Objects scanned: 262850
Time elapsed: 25 minute(s), 22 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
Physical Sectors Detected: 0
(No malicious items detected)
(end)
Code:
ATTFilter Malwarebytes Anti-Rootkit BETA 1.07.0.1008
www.malwarebytes.org
Database version: v2013.12.16.08
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16476
Toshiba :: TOSHIBA-TOSH [administrator]
16.12.2013 23:36:10
mbar-log-2013-12-16 (23-36-10).txt
Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Kernel memory modifications detected. Deep Anti-Rootkit Scan engaged.
Objects scanned: 262963
Time elapsed: 22 minute(s), 13 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
Physical Sectors Detected: 0
(No malicious items detected)
(end)
|
|
17.12.2013, 00:06
| #32 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Safa7_22.vbs Datei versteckt Dateien und produziert Verknüpfungen in system32 FRST neu runterladen auf den Desktop, Doppelklicken, Haken bei Additions.txt setzen und scannen. Beide neuen Logs in CODE-Tags posten
__________________
__________________ |
|
17.12.2013, 00:15
| #33 |
| | Safa7_22.vbs Datei versteckt Dateien und produziert Verknüpfungen in system32 FRST Log:
__________________FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-12-2013 02
Ran by Toshiba (administrator) on TOSHIBA-TOSH on 17-12-2013 00:10:59
Running from C:\Users\Toshiba\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Nero AG) C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(TOSHIBA Corporation) C:\Windows\System32\ThpSrv.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\TECO\TecoService.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(TOSHIBA Corporation) C:\Windows\System32\ThpSrv.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\TECO\Teco.exe
(Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe
(Toshiba Europe GmbH) C:\Program Files\Toshiba\Registration\ToshibaReminder.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\Power Saver\TPwrMain.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\SmoothView\SmoothView.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\FlashCards\TCrdMain.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(Microsoft Corporation) C:\Windows\System32\wscript.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
() C:\Program Files\Toshiba\FlashCards\Hotkey\TCrdKBB.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe
(TOSHIBA Corporation) C:\Program Files (x86)\TOSHIBA\TRCMan\TRCMan.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil64_11_9_900_170_ActiveX.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\TPHM\TPCHSrv.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\TOSHIBA HDD SSD Alert\TosSENotify.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\TPHM\TPCHWMsg.exe
(Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Google Inc.) C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [NvCplDaemon] - RUNDLL32.EXE C:\windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10134560 2010-03-22] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [896032 2010-03-22] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2052392 2010-03-10] (Synaptics Incorporated)
HKLM\...\Run: [ThpSrv] - C:\windows\system32\thpsrv /logon
HKLM\...\Run: [Teco] - C:\Program Files\Toshiba\TECO\Teco.exe [1489760 2010-04-06] (TOSHIBA Corporation)
HKLM\...\Run: [TosSENotify] - C:\Program Files\Toshiba\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [709976 2010-02-05] (TOSHIBA Corporation)
HKLM\...\Run: [TosWaitSrv] - C:\Program Files\Toshiba\TPHM\TosWaitSrv.exe [705368 2010-02-23] (TOSHIBA Corporation)
HKLM\...\Run: [SmartFaceVWatcher] - C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatcher.exe [238080 2009-10-19] (TOSHIBA Corporation)
HKLM\...\Run: [TosVolRegulator] - C:\Program Files\Toshiba\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation)
HKLM\...\Run: [Toshiba TEMPRO] - C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe [1050072 2010-02-11] (Toshiba Europe GmbH)
HKLM\...\Run: [Toshiba Registration] - C:\Program Files\Toshiba\Registration\ToshibaReminder.exe [136136 2010-04-19] (Toshiba Europe GmbH)
HKLM\...\Run: [TPwrMain] - C:\Program Files\Toshiba\Power Saver\TPwrMain.exe [566184 2010-09-28] (TOSHIBA Corporation)
HKLM\...\Run: [HSON] - C:\Program Files\Toshiba\TBS\HSON.exe [52600 2009-03-09] (TOSHIBA Corporation)
HKLM\...\Run: [SmoothView] - C:\Program Files\Toshiba\SmoothView\SmoothView.exe [570680 2009-08-13] (TOSHIBA Corporation)
HKLM\...\Run: [00TCrdMain] - C:\Program Files\Toshiba\FlashCards\TCrdMain.exe [915320 2010-05-10] (TOSHIBA Corporation)
HKCU\...\Run: [OfficeSyncProcess] - C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE [720064 2013-04-22] (Microsoft Corporation)
HKCU\...\Run: [safa7_22] - wscript.exe //B "C:\Users\Toshiba\AppData\Roaming\safa7_22.vbs"
HKCU\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2010-12-13] (Google Inc.)
HKCU\...\Run: [RESTART_STICKY_NOTES] - C:\Windows\System32\StikyNot.exe [427520 2009-07-14] (Microsoft Corporation)
HKCU\...\Run: [ciizgfaygg] - C:\Users\Toshiba\AppData\Local\Temp\ciizgfaygg..vbs [70199 2013-07-27] () <===== ATTENTION
HKLM-x32\...\Run: [SVPWUTIL] - C:\Program Files (x86)\TOSHIBA\Utilities\SVPWUTIL.exe [352256 2010-02-22] (TOSHIBA)
HKLM-x32\...\Run: [HWSetup] - C:\Program Files\Toshiba\Utilities\HWSetup.exe [423936 2010-03-04] (TOSHIBA Electronics, Inc.)
HKLM-x32\...\Run: [KeNotify] - C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe [34160 2009-12-25] (TOSHIBA CORPORATION)
HKLM-x32\...\Run: [ITSecMng] - C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe [83336 2009-07-22] (TOSHIBA CORPORATION)
HKLM-x32\...\Run: [TRCMan] - C:\Program Files (x86)\TOSHIBA\TRCMan\TRCMan.exe [701752 2009-07-21] (TOSHIBA Corporation)
HKLM-x32\...\Run: [TWebCamera] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe [2454840 2010-02-24] (TOSHIBA CORPORATION.)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [BCSSync] - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [683576 2013-11-19] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKU\Default\...\Run: [TOSHIBA Online Product Information] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\TOPI.exe [4581280 2010-03-03] (TOSHIBA)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Toshiba\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ciizgfaygg..vbs ()
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - DefaultScope {727B7DD5-C094-4D23-A9D7-0DDA240E4489} URL = hxxp://search.ividi.org/?q={searchTerms}&src=tbsp&id=a853117d00000000000088ae1d50dffa&affilt=3&r=979
SearchScopes: HKCU - {08A059CE-029C-425B-A390-4DB3FF42A2F7} URL =
SearchScopes: HKCU - {1693C2F3-4930-41AF-89F1-F1557E974FCC} URL = hxxp://rover.ebay.com/rover/1/707-44556-9400-9/4?satitle={searchTerms}
SearchScopes: HKCU - {2A9BD6BD-DDF2-4ED9-90E5-74B18360C039} URL =
SearchScopes: HKCU - {727B7DD5-C094-4D23-A9D7-0DDA240E4489} URL = hxxp://search.ividi.org/?q={searchTerms}&src=tbsp&id=a853117d00000000000088ae1d50dffa&affilt=3&r=979
SearchScopes: HKCU - {AE9B2183-80F6-44E4-B4FB-0019E2630828} URL = hxxp://www.amazon.de/gp/search?ie=UTF8&keywords={searchTerms}&tag=tochibade-win7-ie-search-21&index=blended&linkCode=ur2
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: TOSHIBA Media Controller Plug-in - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
DPF: HKLM-x32 {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: HKLM-x32 {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (iVidi Chrome Toolbar) - C:\Users\Toshiba\AppData\Local\Google\Chrome\User Data\default\extensions\kpdhgpkkloealnjnmepfhanpcleldbef\1.0_0
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-11-19] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-19] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1164360 2013-11-19] (Avira Operations GmbH & Co. KG)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [124368 2010-02-11] (Toshiba Europe GmbH)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [107416 2013-12-03] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132600 2013-11-19] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-19] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2010-12-23] ()
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 cpuz132; \??\C:\Users\Toshiba\AppData\Local\Temp\cpuz132\cpuz132_x64.sys [x]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-12-17 00:10 - 2013-12-17 00:11 - 00016063 _____ C:\Users\Toshiba\Desktop\FRST.txt
2013-12-17 00:10 - 2013-12-17 00:10 - 01927940 _____ (Farbar) C:\Users\Toshiba\Desktop\FRST64.exe
2013-12-16 23:01 - 2013-12-16 23:59 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-12-16 23:01 - 2013-12-16 23:36 - 00117464 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2013-12-16 22:58 - 2013-12-16 23:59 - 00000000 ____D C:\Users\Toshiba\Desktop\mbar
2013-12-16 22:58 - 2013-12-16 23:35 - 00089304 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2013-12-16 22:57 - 2013-12-16 22:57 - 12582688 _____ (Malwarebytes Corp.) C:\Users\Toshiba\Desktop\mbar-1.07.0.1008.exe
2013-12-16 10:02 - 2013-11-26 12:54 - 23183360 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2013-12-16 10:02 - 2013-11-26 11:19 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2013-12-16 10:02 - 2013-11-26 11:18 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2013-12-16 10:02 - 2013-11-26 11:11 - 17112576 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2013-12-16 10:02 - 2013-11-26 10:48 - 00066048 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2013-12-16 10:02 - 2013-11-26 10:46 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2013-12-16 10:02 - 2013-11-26 10:41 - 02764288 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2013-12-16 10:02 - 2013-11-26 10:29 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2013-12-16 10:02 - 2013-11-26 10:27 - 00033792 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2013-12-16 10:02 - 2013-11-26 10:23 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2013-12-16 10:02 - 2013-11-26 10:21 - 00574976 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2013-12-16 10:02 - 2013-11-26 10:18 - 00139264 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2013-12-16 10:02 - 2013-11-26 10:18 - 00111616 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2013-12-16 10:02 - 2013-11-26 10:16 - 00708608 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2013-12-16 10:02 - 2013-11-26 09:57 - 00218624 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2013-12-16 10:02 - 2013-11-26 09:38 - 02166784 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2013-12-16 10:02 - 2013-11-26 09:38 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2013-12-16 10:02 - 2013-11-26 09:35 - 05769216 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2013-12-16 10:02 - 2013-11-26 09:32 - 00440832 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2013-12-16 10:02 - 2013-11-26 09:28 - 00553472 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll
2013-12-16 10:02 - 2013-11-26 09:16 - 04243968 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2013-12-16 10:02 - 2013-11-26 09:02 - 01995264 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2013-12-16 10:02 - 2013-11-26 08:48 - 12996608 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2013-12-16 10:02 - 2013-11-26 08:32 - 01928192 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2013-12-16 10:02 - 2013-11-26 08:26 - 11221504 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2013-12-16 10:02 - 2013-11-26 08:07 - 02334208 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2013-12-16 10:02 - 2013-11-26 07:40 - 01395200 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2013-12-16 10:02 - 2013-11-26 07:34 - 00817664 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2013-12-16 10:02 - 2013-11-26 07:34 - 00703488 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2013-12-16 10:02 - 2013-11-26 07:33 - 01820160 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2013-12-16 10:02 - 2013-11-26 07:27 - 01157632 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2013-12-14 15:28 - 2013-12-14 15:37 - 00000000 ___SD C:\ComboFix
2013-12-14 14:45 - 2013-12-14 14:45 - 01034531 _____ (Thisisu) C:\Users\Toshiba\Desktop\JRT.exe
2013-12-14 14:35 - 2013-12-14 14:35 - 01226802 _____ C:\Users\Toshiba\Desktop\adwcleaner.exe
2013-12-14 13:58 - 2013-10-14 18:00 - 00028368 _____ (Microsoft Corporation) C:\windows\system32\IEUDINIT.EXE
2013-12-14 13:53 - 2013-12-14 13:53 - 01228800 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 01051136 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00942592 _____ (Microsoft Corporation) C:\windows\system32\jsIntl.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00940032 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00774144 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00645120 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsIntl.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00626176 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00616104 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dat
2013-12-14 13:53 - 2013-12-14 13:53 - 00616104 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dat
2013-12-14 13:53 - 2013-12-14 13:53 - 00610304 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00548352 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00523776 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00454656 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00453120 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00413696 _____ (Microsoft Corporation) C:\windows\system32\html.iec
2013-12-14 13:53 - 2013-12-14 13:53 - 00367104 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00337408 _____ (Microsoft Corporation) C:\windows\SysWOW64\html.iec
2013-12-14 13:53 - 2013-12-14 13:53 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00263376 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00247808 _____ (Microsoft Corporation) C:\windows\system32\msls31.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00244736 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00243200 _____ (Microsoft Corporation) C:\windows\system32\webcheck.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00238288 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00235520 _____ (Microsoft Corporation) C:\windows\system32\url.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00235008 _____ (Microsoft Corporation) C:\windows\system32\elshyph.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00233472 _____ (Microsoft Corporation) C:\windows\SysWOW64\url.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00208384 _____ (Microsoft Corporation) C:\windows\SysWOW64\webcheck.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00195584 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00194048 _____ (Microsoft Corporation) C:\windows\SysWOW64\elshyph.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00182272 _____ (Microsoft Corporation) C:\windows\SysWOW64\msls31.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00167424 _____ (Microsoft Corporation) C:\windows\system32\iexpress.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00164864 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00151552 _____ (Microsoft Corporation) C:\windows\SysWOW64\iexpress.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00147968 _____ (Microsoft Corporation) C:\windows\system32\occache.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00143872 _____ (Microsoft Corporation) C:\windows\system32\wextract.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00139264 _____ (Microsoft Corporation) C:\windows\SysWOW64\wextract.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00135680 _____ (Microsoft Corporation) C:\windows\system32\iepeers.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00131072 _____ (Microsoft Corporation) C:\windows\system32\IEAdvpack.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00127488 _____ (Microsoft Corporation) C:\windows\SysWOW64\occache.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00116736 _____ (Microsoft Corporation) C:\windows\SysWOW64\iepeers.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00112128 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00111616 _____ (Microsoft Corporation) C:\windows\SysWOW64\IEAdvpack.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00105984 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00101376 _____ (Microsoft Corporation) C:\windows\system32\inseng.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00090112 _____ (Microsoft Corporation) C:\windows\system32\SetIEInstalledDate.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00086016 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00086016 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00084992 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00083968 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00083456 _____ (Microsoft Corporation) C:\windows\SysWOW64\inseng.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00081408 _____ (Microsoft Corporation) C:\windows\system32\icardie.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00077312 _____ (Microsoft Corporation) C:\windows\system32\tdc.ocx
2013-12-14 13:53 - 2013-12-14 13:53 - 00074240 _____ (Microsoft Corporation) C:\windows\SysWOW64\SetIEInstalledDate.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00069632 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00069120 _____ (Microsoft Corporation) C:\windows\SysWOW64\icardie.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\tdc.ocx
2013-12-14 13:53 - 2013-12-14 13:53 - 00062464 _____ (Microsoft Corporation) C:\windows\system32\pngfilt.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00056832 _____ (Microsoft Corporation) C:\windows\SysWOW64\pngfilt.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00052224 _____ (Microsoft Corporation) C:\windows\system32\msfeedsbs.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00051200 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00048640 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmler.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\mshtmler.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00048128 _____ (Microsoft Corporation) C:\windows\system32\imgutil.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeedsbs.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00040448 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00036352 _____ (Microsoft Corporation) C:\windows\SysWOW64\imgutil.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00034816 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00032768 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00030208 _____ (Microsoft Corporation) C:\windows\system32\licmgr10.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00024576 _____ (Microsoft Corporation) C:\windows\SysWOW64\licmgr10.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00013824 _____ (Microsoft Corporation) C:\windows\system32\mshta.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00013312 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshta.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00013312 _____ (Microsoft Corporation) C:\windows\system32\msfeedssync.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00012800 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeedssync.exe
2013-12-14 13:51 - 2013-12-14 13:58 - 00010277 _____ C:\windows\IE11_main.log
2013-12-13 14:23 - 2013-05-10 06:56 - 14631424 _____ (Microsoft Corporation) C:\windows\system32\wmp.dll
2013-12-13 14:23 - 2013-05-10 06:56 - 12625920 _____ (Microsoft Corporation) C:\windows\system32\wmploc.DLL
2013-12-13 14:23 - 2013-05-10 05:56 - 12625408 _____ (Microsoft Corporation) C:\windows\SysWOW64\wmploc.DLL
2013-12-13 14:23 - 2013-05-10 05:56 - 11410432 _____ (Microsoft Corporation) C:\windows\SysWOW64\wmp.dll
2013-12-12 21:40 - 2013-11-12 03:23 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\tzres.dll
2013-12-12 21:40 - 2013-11-12 03:07 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\tzres.dll
2013-12-12 21:03 - 2013-10-30 02:24 - 03155968 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2013-12-12 20:47 - 2013-10-19 03:18 - 00081408 _____ (Microsoft Corporation) C:\windows\system32\imagehlp.dll
2013-12-12 20:47 - 2013-10-19 02:36 - 00159232 _____ (Microsoft Corporation) C:\windows\SysWOW64\imagehlp.dll
2013-12-12 20:28 - 2013-10-30 03:32 - 00335360 _____ (Microsoft Corporation) C:\windows\system32\msieftp.dll
2013-12-12 20:28 - 2013-10-30 03:19 - 00301568 _____ (Microsoft Corporation) C:\windows\SysWOW64\msieftp.dll
2013-12-12 20:18 - 2013-11-23 19:26 - 00417792 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMPhoto.dll
2013-12-12 20:18 - 2013-11-23 18:47 - 00465920 _____ (Microsoft Corporation) C:\windows\system32\WMPhoto.dll
2013-12-12 20:17 - 2013-10-04 03:16 - 00116736 _____ (Microsoft Corporation) C:\windows\system32\Drivers\drmk.sys
2013-12-12 20:17 - 2013-10-04 02:36 - 00230400 _____ (Microsoft Corporation) C:\windows\system32\Drivers\portcls.sys
2013-12-12 20:09 - 2013-10-12 03:32 - 00150016 _____ (Microsoft Corporation) C:\windows\system32\wshom.ocx
2013-12-12 20:09 - 2013-10-12 03:31 - 00202752 _____ (Microsoft Corporation) C:\windows\system32\scrrun.dll
2013-12-12 20:09 - 2013-10-12 03:04 - 00121856 _____ (Microsoft Corporation) C:\windows\SysWOW64\wshom.ocx
2013-12-12 20:09 - 2013-10-12 03:03 - 00163840 _____ (Microsoft Corporation) C:\windows\SysWOW64\scrrun.dll
2013-12-12 20:09 - 2013-10-12 02:33 - 00168960 _____ (Microsoft Corporation) C:\windows\system32\wscript.exe
2013-12-12 20:09 - 2013-10-12 02:33 - 00156160 _____ (Microsoft Corporation) C:\windows\system32\cscript.exe
2013-12-12 20:09 - 2013-10-12 02:15 - 00141824 _____ (Microsoft Corporation) C:\windows\SysWOW64\wscript.exe
2013-12-12 20:09 - 2013-10-12 02:15 - 00126976 _____ (Microsoft Corporation) C:\windows\SysWOW64\cscript.exe
2013-11-20 17:14 - 2013-11-20 17:14 - 00000000 ____D C:\ProgramData\Oracle
2013-11-20 17:12 - 2013-11-20 17:12 - 00264616 _____ (Oracle Corporation) C:\windows\SysWOW64\javaws.exe
2013-11-20 17:12 - 2013-11-20 17:12 - 00096168 _____ (Oracle Corporation) C:\windows\SysWOW64\WindowsAccessBridge-32.dll
2013-11-18 15:44 - 2013-11-25 11:00 - 00000000 ____D C:\Users\Toshiba\Desktop\Ideen
==================== One Month Modified Files and Folders =======
2013-12-17 00:11 - 2013-12-17 00:10 - 00016063 _____ C:\Users\Toshiba\Desktop\FRST.txt
2013-12-17 00:10 - 2013-12-17 00:10 - 01927940 _____ (Farbar) C:\Users\Toshiba\Desktop\FRST64.exe
2013-12-17 00:00 - 2010-09-23 14:34 - 00000000 ____D C:\Users\Toshiba\AppData\Roaming\Skype
2013-12-16 23:59 - 2013-12-16 23:01 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-12-16 23:59 - 2013-12-16 22:58 - 00000000 ____D C:\Users\Toshiba\Desktop\mbar
2013-12-16 23:57 - 2012-09-24 17:46 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2013-12-16 23:47 - 2010-12-13 16:43 - 00001112 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-12-16 23:36 - 2013-12-16 23:01 - 00117464 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2013-12-16 23:35 - 2013-12-16 22:58 - 00089304 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2013-12-16 23:03 - 2010-07-18 12:54 - 01622847 _____ C:\windows\WindowsUpdate.log
2013-12-16 22:57 - 2013-12-16 22:57 - 12582688 _____ (Malwarebytes Corp.) C:\Users\Toshiba\Desktop\mbar-1.07.0.1008.exe
2013-12-16 21:48 - 2009-07-14 05:45 - 00016080 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-12-16 21:48 - 2009-07-14 05:45 - 00016080 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-12-16 21:42 - 2013-10-04 10:09 - 00000000 ____D C:\FRST
2013-12-16 21:41 - 2010-12-13 16:43 - 00001108 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-12-16 21:39 - 2009-07-14 06:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-12-16 21:39 - 2009-07-14 05:51 - 00200990 _____ C:\windows\setupact.log
2013-12-16 21:38 - 2010-08-31 08:32 - 00000000 ___RD C:\Users\Toshiba\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-12-16 20:30 - 2012-03-10 14:28 - 00003954 _____ C:\windows\System32\Tasks\User_Feed_Synchronization-{AB0334C5-6282-41F4-9B68-A22855822001}
2013-12-16 10:01 - 2013-08-15 18:38 - 00000000 ____D C:\windows\system32\MRT
2013-12-16 09:56 - 2011-01-26 16:12 - 90708896 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2013-12-15 09:04 - 2012-09-24 17:46 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2013-12-15 09:04 - 2012-09-24 17:46 - 00003822 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2013-12-15 09:04 - 2011-11-09 19:11 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-12-15 08:34 - 2012-10-30 18:50 - 00000000 ____D C:\Users\Toshiba\Desktop\Namibia
2013-12-14 15:39 - 2010-07-18 12:50 - 00225546 _____ C:\windows\PFRO.log
2013-12-14 15:37 - 2013-12-14 15:28 - 00000000 ___SD C:\ComboFix
2013-12-14 15:29 - 2013-10-04 11:00 - 00000000 ____D C:\Qoobox
2013-12-14 14:45 - 2013-12-14 14:45 - 01034531 _____ (Thisisu) C:\Users\Toshiba\Desktop\JRT.exe
2013-12-14 14:37 - 2013-10-07 06:35 - 00000000 ____D C:\AdwCleaner
2013-12-14 14:35 - 2013-12-14 14:35 - 01226802 _____ C:\Users\Toshiba\Desktop\adwcleaner.exe
2013-12-14 14:26 - 2009-07-14 03:34 - 00000215 _____ C:\windows\system.ini
2013-12-14 14:03 - 2010-08-31 08:35 - 00001432 _____ C:\Users\Toshiba\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-12-14 14:00 - 2009-07-14 04:20 - 00000000 ____D C:\windows\PolicyDefinitions
2013-12-14 13:58 - 2013-12-14 13:51 - 00010277 _____ C:\windows\IE11_main.log
2013-12-14 13:53 - 2013-12-14 13:53 - 01228800 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 01051136 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00942592 _____ (Microsoft Corporation) C:\windows\system32\jsIntl.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00940032 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00774144 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00645120 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsIntl.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00626176 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00616104 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dat
2013-12-14 13:53 - 2013-12-14 13:53 - 00616104 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dat
2013-12-14 13:53 - 2013-12-14 13:53 - 00610304 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00548352 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00523776 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00454656 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00453120 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00413696 _____ (Microsoft Corporation) C:\windows\system32\html.iec
2013-12-14 13:53 - 2013-12-14 13:53 - 00367104 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00337408 _____ (Microsoft Corporation) C:\windows\SysWOW64\html.iec
2013-12-14 13:53 - 2013-12-14 13:53 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00263376 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00247808 _____ (Microsoft Corporation) C:\windows\system32\msls31.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00244736 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00243200 _____ (Microsoft Corporation) C:\windows\system32\webcheck.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00238288 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00235520 _____ (Microsoft Corporation) C:\windows\system32\url.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00235008 _____ (Microsoft Corporation) C:\windows\system32\elshyph.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00233472 _____ (Microsoft Corporation) C:\windows\SysWOW64\url.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00208384 _____ (Microsoft Corporation) C:\windows\SysWOW64\webcheck.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00195584 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00194048 _____ (Microsoft Corporation) C:\windows\SysWOW64\elshyph.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00182272 _____ (Microsoft Corporation) C:\windows\SysWOW64\msls31.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00167424 _____ (Microsoft Corporation) C:\windows\system32\iexpress.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00164864 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00151552 _____ (Microsoft Corporation) C:\windows\SysWOW64\iexpress.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00147968 _____ (Microsoft Corporation) C:\windows\system32\occache.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00143872 _____ (Microsoft Corporation) C:\windows\system32\wextract.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00139264 _____ (Microsoft Corporation) C:\windows\SysWOW64\wextract.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00135680 _____ (Microsoft Corporation) C:\windows\system32\iepeers.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00131072 _____ (Microsoft Corporation) C:\windows\system32\IEAdvpack.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00127488 _____ (Microsoft Corporation) C:\windows\SysWOW64\occache.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00116736 _____ (Microsoft Corporation) C:\windows\SysWOW64\iepeers.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00112128 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00111616 _____ (Microsoft Corporation) C:\windows\SysWOW64\IEAdvpack.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00105984 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00101376 _____ (Microsoft Corporation) C:\windows\system32\inseng.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00090112 _____ (Microsoft Corporation) C:\windows\system32\SetIEInstalledDate.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00086016 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00086016 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00084992 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00083968 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00083456 _____ (Microsoft Corporation) C:\windows\SysWOW64\inseng.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00081408 _____ (Microsoft Corporation) C:\windows\system32\icardie.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00077312 _____ (Microsoft Corporation) C:\windows\system32\tdc.ocx
2013-12-14 13:53 - 2013-12-14 13:53 - 00074240 _____ (Microsoft Corporation) C:\windows\SysWOW64\SetIEInstalledDate.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00069632 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00069120 _____ (Microsoft Corporation) C:\windows\SysWOW64\icardie.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\tdc.ocx
2013-12-14 13:53 - 2013-12-14 13:53 - 00062464 _____ (Microsoft Corporation) C:\windows\system32\pngfilt.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00056832 _____ (Microsoft Corporation) C:\windows\SysWOW64\pngfilt.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00052224 _____ (Microsoft Corporation) C:\windows\system32\msfeedsbs.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00051200 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00048640 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmler.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\mshtmler.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00048128 _____ (Microsoft Corporation) C:\windows\system32\imgutil.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeedsbs.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00040448 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00036352 _____ (Microsoft Corporation) C:\windows\SysWOW64\imgutil.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00034816 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00032768 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00030208 _____ (Microsoft Corporation) C:\windows\system32\licmgr10.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00024576 _____ (Microsoft Corporation) C:\windows\SysWOW64\licmgr10.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00013824 _____ (Microsoft Corporation) C:\windows\system32\mshta.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00013312 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshta.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00013312 _____ (Microsoft Corporation) C:\windows\system32\msfeedssync.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00012800 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeedssync.exe
2013-12-14 12:18 - 2010-12-13 16:43 - 00000000 ____D C:\Users\Toshiba\AppData\Local\Google
2013-12-13 18:26 - 2010-09-26 21:08 - 00000000 ____D C:\Users\Toshiba\Desktop\Sebastian
2013-12-13 16:51 - 2009-07-14 06:09 - 00000000 ____D C:\windows\System32\Tasks\WPD
2013-12-13 15:50 - 2010-05-05 22:05 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-12-13 15:50 - 2010-05-05 22:05 - 00000000 ____D C:\ProgramData\Skype
2013-12-13 14:22 - 2010-05-05 22:12 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-12-13 10:37 - 2009-07-14 18:58 - 00654852 _____ C:\windows\system32\perfh007.dat
2013-12-13 10:37 - 2009-07-14 18:58 - 00130434 _____ C:\windows\system32\perfc007.dat
2013-12-13 10:37 - 2009-07-14 06:13 - 01500294 _____ C:\windows\system32\PerfStringBackup.INI
2013-12-13 06:42 - 2010-12-13 16:43 - 00004108 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-12-13 06:42 - 2010-12-13 16:43 - 00003856 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-12-13 06:12 - 2009-07-14 05:45 - 00445056 _____ C:\windows\system32\FNTCACHE.DAT
2013-12-03 20:57 - 2013-07-21 11:14 - 00000000 ____D C:\Users\Toshiba\AppData\Roaming\Dropbox
2013-12-03 20:56 - 2013-07-21 11:16 - 00000000 ___RD C:\Users\Toshiba\Dropbox
2013-12-03 20:55 - 2009-07-14 06:08 - 00032640 _____ C:\windows\Tasks\SCHEDLGU.TXT
2013-12-03 12:22 - 2013-08-15 10:38 - 00107416 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys
2013-12-03 10:46 - 2013-08-13 20:50 - 00000000 ____D C:\Program Files (x86)\Mobile Partner
2013-12-01 14:12 - 2011-01-19 19:09 - 00000000 ____D C:\Users\Toshiba\AppData\Roaming\dvdcss
2013-11-28 12:21 - 2011-06-24 23:56 - 02241024 ___SH C:\Users\Toshiba\Desktop\Thumbs.db
2013-11-26 12:54 - 2013-12-16 10:02 - 23183360 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2013-11-26 11:19 - 2013-12-16 10:02 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2013-11-26 11:18 - 2013-12-16 10:02 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2013-11-26 11:11 - 2013-12-16 10:02 - 17112576 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2013-11-26 10:48 - 2013-12-16 10:02 - 00066048 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2013-11-26 10:46 - 2013-12-16 10:02 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2013-11-26 10:41 - 2013-12-16 10:02 - 02764288 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2013-11-26 10:29 - 2013-12-16 10:02 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2013-11-26 10:27 - 2013-12-16 10:02 - 00033792 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2013-11-26 10:23 - 2013-12-16 10:02 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2013-11-26 10:21 - 2013-12-16 10:02 - 00574976 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2013-11-26 10:18 - 2013-12-16 10:02 - 00139264 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2013-11-26 10:18 - 2013-12-16 10:02 - 00111616 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2013-11-26 10:16 - 2013-12-16 10:02 - 00708608 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2013-11-26 09:57 - 2013-12-16 10:02 - 00218624 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2013-11-26 09:38 - 2013-12-16 10:02 - 02166784 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2013-11-26 09:38 - 2013-12-16 10:02 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2013-11-26 09:35 - 2013-12-16 10:02 - 05769216 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2013-11-26 09:32 - 2013-12-16 10:02 - 00440832 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2013-11-26 09:28 - 2013-12-16 10:02 - 00553472 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll
2013-11-26 09:16 - 2013-12-16 10:02 - 04243968 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2013-11-26 09:02 - 2013-12-16 10:02 - 01995264 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2013-11-26 08:48 - 2013-12-16 10:02 - 12996608 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2013-11-26 08:32 - 2013-12-16 10:02 - 01928192 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2013-11-26 08:26 - 2013-12-16 10:02 - 11221504 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2013-11-26 08:07 - 2013-12-16 10:02 - 02334208 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2013-11-26 07:40 - 2013-12-16 10:02 - 01395200 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2013-11-26 07:34 - 2013-12-16 10:02 - 00817664 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2013-11-26 07:34 - 2013-12-16 10:02 - 00703488 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2013-11-26 07:33 - 2013-12-16 10:02 - 01820160 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2013-11-26 07:27 - 2013-12-16 10:02 - 01157632 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2013-11-25 11:00 - 2013-11-18 15:44 - 00000000 ____D C:\Users\Toshiba\Desktop\Ideen
2013-11-23 19:26 - 2013-12-12 20:18 - 00417792 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMPhoto.dll
2013-11-23 18:47 - 2013-12-12 20:18 - 00465920 _____ (Microsoft Corporation) C:\windows\system32\WMPhoto.dll
2013-11-21 09:18 - 2012-01-18 18:18 - 00000000 ____D C:\Users\Toshiba\Documents\Outlook-Dateien
2013-11-20 17:14 - 2013-11-20 17:14 - 00000000 ____D C:\ProgramData\Oracle
2013-11-20 17:12 - 2013-11-20 17:12 - 00264616 _____ (Oracle Corporation) C:\windows\SysWOW64\javaws.exe
2013-11-20 17:12 - 2013-11-20 17:12 - 00096168 _____ (Oracle Corporation) C:\windows\SysWOW64\WindowsAccessBridge-32.dll
2013-11-20 17:12 - 2013-06-20 16:07 - 00175016 _____ (Oracle Corporation) C:\windows\SysWOW64\javaw.exe
2013-11-20 17:12 - 2013-06-20 16:07 - 00174504 _____ (Oracle Corporation) C:\windows\SysWOW64\java.exe
2013-11-20 17:12 - 2010-09-09 14:38 - 00000000 ____D C:\Program Files (x86)\Java
2013-11-19 13:18 - 2013-08-15 10:39 - 00083160 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avnetflt.sys
2013-11-19 13:18 - 2013-08-15 10:38 - 00132600 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys
2013-11-19 13:18 - 2013-08-15 10:38 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avkmgr.sys
2013-11-17 11:34 - 2009-07-14 04:20 - 00000000 ____D C:\windows\system32\NDF
Files to move or delete:
====================
C:\Users\Toshiba\AppData\Local\Temp\ciizgfaygg..vbs
Some content of TEMP:
====================
C:\Users\Toshiba\AppData\Local\Temp\avgnt.exe
C:\Users\Toshiba\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-10-21 11:28
==================== End Of Log ============================
Addition: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 16-12-2013 02
Ran by Toshiba at 2013-12-17 00:11:50
Running from C:\Users\Toshiba\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Disabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Disabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
Adobe AIR (x32 Version: 1.5.3.9130)
Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.170)
Adobe Reader XI (11.0.05) - Deutsch (x32 Version: 11.0.05)
Adobe Shockwave Player 11.5 (x32 Version: 11.5.9.615)
Advertising Center (x32 Version: 0.0.0.2)
Amazon.de (x32)
Avira Free Antivirus (x32 Version: 14.0.1.759)
Bluetooth Stack for Windows by Toshiba (Version: v7.10.10(T))
Broadcom 802.11 Network Adapter (Version: 5.60.48.42)
Compatibility Pack für 2007 Office System (x32 Version: 12.0.6612.1000)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32)
Dropbox (HKCU Version: 2.0.26)
eBay (x32 Version: 1.1.9)
ENE CIR Receiver Driver (Version: 2.7.4.1)
FileZilla Client 3.6.0.2 (x32 Version: 3.6.0.2)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0)
Google Toolbar for Internet Explorer (x32 Version: 7.5.4805.320)
Google Update Helper (x32 Version: 1.3.22.3)
ImagXpress (x32 Version: 7.0.74.0)
Intel(R) Management Engine Components (x32 Version: 6.0.0.1179)
Intel(R) Rapid Storage Technology (x32 Version: 9.5.7.1002)
Intel(R) Turbo Boost Technology Driver (x32 Version: 01.01.01.1007)
Java 7 Update 45 (x32 Version: 7.0.450)
Java Auto Updater (x32 Version: 2.1.9.8)
Java(TM) 6 Update 16 (x32 Version: 6.0.160)
Java(TM) 6 Update 31 (x32 Version: 6.0.310)
JavaFX 2.1.1 (x32 Version: 2.1.1)
JMicron Flash Media Controller Driver (x32 Version: 1.0.44.1)
Junk Mail filter update (x32 Version: 14.0.8089.726)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Choice Guard (x32 Version: 2.0.48.0)
Microsoft Games for Windows - LIVE Redistributable (x32 Version: 3.5.88.0)
Microsoft Games for Windows Marketplace (x32 Version: 3.5.50.0)
Microsoft Office 2010 Service Pack 1 (SP1) (x32)
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003)
Microsoft Office Groove MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office InfoPath MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000)
Microsoft Office Klick-und-Los 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.6029.1000)
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Professional Plus 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Suite Activation Assistant (x32 Version: 2.9)
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Silverlight (Version: 5.1.20913.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (x32 Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft Works (x32 Version: 9.7.0621)
MSVCRT (x32 Version: 14.0.1468.721)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
Nero 9 Essentials (x32)
Nero BackItUp and Burn (x32 Version: 1.2.0030)
Nero BurnRights (x32 Version: 3.4.13.100)
Nero BurnRights (x32 Version: 3.6.26001)
Nero BurnRights Help (x32 Version: 3.4.4.100)
Nero ControlCenter (x32 Version: 9.0.0.1)
Nero DiscSpeed (x32 Version: 5.4.13.100)
Nero DiscSpeed Help (x32 Version: 5.4.4.100)
Nero DriveSpeed (x32 Version: 4.4.12.100)
Nero DriveSpeed Help (x32 Version: 4.4.4.100)
Nero Express (x32 Version: 9.6.16000)
Nero Express Help (x32 Version: 9.4.34.100)
Nero InfoTool (x32 Version: 6.4.12.100)
Nero InfoTool Help (x32 Version: 6.4.4.100)
Nero Installer (x32 Version: 4.4.9.0)
Nero Online Upgrade (x32 Version: 1.3.0.0)
Nero RescueAgent (x32 Version: 2.6.25002)
Nero StartSmart (x32 Version: 9.4.37.100)
Nero StartSmart Help (x32 Version: 9.4.37.100)
NeroExpress (x32 Version: 9.4.34.100)
neroxml (x32 Version: 1.0.0)
NVIDIA Drivers (Version: 1.10.56.34)
NVIDIA PhysX (x32 Version: 9.09.0428)
NVIDIA Updatus (x32 Version: 1.0.3)
OpenOffice.org 3.1 (x32 Version: 3.1.9420)
Photo Service - powered by myphotobook (x32 Version: 1.0.7)
Photo Service - powered by myphotobook (x32 Version: 1.0.7-279)
PlayReady PC Runtime amd64 (Version: 1.3.0)
Realtek Ethernet Controller Driver For Windows 7 (x32 Version: 7.19.409.2010)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6069)
SAMSUNG Mobile USB Modem 1.0 Software
SAMSUNG Mobile USB Modem Software
Samsung New PC Studio (x32 Version: 1.00.0000)
Secure Download Manager (x32 Version: 3.0.5)
Skype Click to Call (x32 Version: 5.9.9216)
Skype™ 6.11 (x32 Version: 6.11.102)
Synaptics Pointing Device Driver (Version: 15.0.8.1)
Toshiba Assist (x32 Version: 3.00.11)
TOSHIBA ConfigFree (x32 Version: 8.0.29)
TOSHIBA Disc Creator (Version: 2.1.0.2 for x64)
TOSHIBA eco Utility (Version: 1.2.11.64)
TOSHIBA eco Utility (x32 Version: 1.2.11.64)
TOSHIBA Face Recognition (Version: 3.1.3.64)
TOSHIBA Face Recognition (x32 Version: 3.1.3.64)
TOSHIBA Flash Cards Support Utility (x32 Version: 1.63.0.6C)
TOSHIBA Hardware Setup (x32 Version: 1.63.0.22C)
TOSHIBA HDD Protection (Version: 2.2.0.4)
TOSHIBA HDD/SSD Alert (Version: 3.1.64.6)
TOSHIBA HDD/SSD Alert (x32 Version: 3.1.64.6)
Toshiba Manuals (x32 Version: 10.01)
TOSHIBA Media Controller (x32 Version: 1.0.80.3.64)
TOSHIBA Media Controller Plug-in (x32 Version: 1.0.5.10)
TOSHIBA Online Product Information (x32 Version: 2.09.0001)
TOSHIBA PC Health Monitor (Version: 1.6.0.64)
TOSHIBA Recovery Media Creator (Version: 2.1.0.4 x64)
TOSHIBA Recovery Media Creator Reminder (x32 Version: 1.00.0019)
TOSHIBA Remote Control Manager (x32 Version: 3.0.1.0)
TOSHIBA Service Station (x32 Version: 2.1.40)
TOSHIBA Sleep Utility (x32 Version: 1.4.1.3)
TOSHIBA Supervisor Password (x32 Version: 1.63.0.9C)
TOSHIBA Supervisorkennwort (x32 Version: 1.63.0.9C)
Toshiba TEMPRO (x32 Version: 3.30)
TOSHIBA Value Added Package (Version: 1.3.19.64)
TOSHIBA Value Added Package (x32 Version: 1.3.19.64)
TOSHIBA Web Camera Application (x32 Version: 1.1.1.15)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (x32)
Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553065) (x32)
Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2566458) (x32)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2687503) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2825640) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (x32)
Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition (x32)
Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition (x32)
Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition (x32)
Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition (x32)
Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (x32)
Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition (x32)
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (x32)
Update for Microsoft Word 2010 (KB2837593) 32-Bit Edition (x32)
Utility Common Driver (x32 Version: 1.0.52.1C)
VLC media player 1.1.10 (x32 Version: 1.1.10)
Windows Live Call (x32 Version: 14.0.8064.0206)
Windows Live Communications Platform (x32 Version: 14.0.8064.206)
Windows Live Essentials (x32 Version: 14.0.8089.0726)
Windows Live Essentials (x32 Version: 14.0.8089.726)
Windows Live Fotogalerie (x32 Version: 14.0.8081.709)
Windows Live ID Sign-in Assistant (Version: 6.500.3165.0)
Windows Live Mail (x32 Version: 14.0.8089.0726)
Windows Live Messenger (x32 Version: 14.0.8089.0726)
Windows Live Movie Maker (x32 Version: 14.0.8091.0730)
Windows Live Sync (x32 Version: 14.0.8089.726)
Windows Live Writer (x32 Version: 14.0.8089.0726)
Windows Live-Uploadtool (x32 Version: 14.0.8014.1029)
==================== Restore Points =========================
19-11-2013 15:38:02 Windows Update
20-11-2013 16:10:48 Installed Java 7 Update 45
22-11-2013 16:26:11 Windows Update
24-11-2013 18:00:11 Windows-Sicherung
27-11-2013 06:54:08 Windows Update
01-12-2013 18:00:10 Windows-Sicherung
03-12-2013 06:05:56 Windows Update
12-12-2013 18:23:12 Windows-Sicherung
12-12-2013 19:17:10 Windows Update
12-12-2013 23:47:41 Windows Update
13-12-2013 13:21:00 Windows Update
14-12-2013 12:51:18 Windows Update
16-12-2013 08:54:56 Windows Update
16-12-2013 09:00:18 Windows-Sicherung
==================== Hosts content: ==========================
2009-07-14 03:34 - 2013-10-06 12:58 - 00000027 ____A C:\windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
Task: {088482FA-65B8-4E17-9ABF-1DCD48E8D373} - System32\Tasks\Microsoft\Windows\Tcpip\IpAddressConflict1 => Rundll32.exe ndfapi.dll,NdfRunDllDuplicateIPOffendingSystem
Task: {09F06BFE-A3C8-40E3-846A-6E6F4000C238} - System32\Tasks\Microsoft\Windows\Tcpip\IpAddressConflict2 => Rundll32.exe ndfapi.dll,NdfRunDllDuplicateIPDefendingSystem
Task: {1F1B98A5-5B76-4350-A619-A9550412972F} - \Scheduled Update for Ask Toolbar No Task File
Task: {32F82E3B-AAA0-4EDF-A6FC-8F9D08C05B80} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-12-13] (Google Inc.)
Task: {3F6FBCC4-885B-4B74-A32D-65B2577A05C3} - System32\Tasks\{2F4C93CA-2385-4556-B853-B8C9E6139B1A} => F:\RECYCLER\470a1245.exe
Task: {57E19D2D-032C-4607-B4D6-DCB9CEBDBB97} - System32\Tasks\{CC4A83CC-1FBA-4D1E-B623-C9207E376844} => C:\Program Files (x86)\Counter-Strike\hl.exe
Task: {5FAABF2E-6962-45C7-BDDA-B30841BB2B5C} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {625C8323-EE13-4C2F-A6A8-BD07D897FDF3} - System32\Tasks\Toshiba Local Autobackup => C:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBCore.exe
Task: {994C86AD-A929-4B2C-88A0-4E25A107A029} - System32\Tasks\Microsoft\Windows\SystemRestore\SR => Rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation
Task: {A7C73732-9F11-4281-8D19-764D4EC9D94D} - System32\Tasks\Microsoft\Windows\Application Experience\ProgramDataUpdater => Rundll32.exe aepdu.dll,AePduRunUpdate
Task: {C2045FDC-FF17-4864-B8D8-9DCBC3ED8D6C} - System32\Tasks\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector => Rundll32.exe dfdts.dll,DfdGetDefaultPolicyAndSMART
Task: {CEDEC944-DE51-4DC7-9037-A0FFE0C351BF} - System32\Tasks\WPD\SqmUpload_S-1-5-21-1359332084-2657517654-48699966-1002 => Rundll32.exe portabledeviceapi.dll,#1
Task: {D0F287FD-27BC-4A67-BFF0-8132152C0051} - System32\Tasks\ConfigFree Startup Programs => C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe [2010-02-22] (TOSHIBA CORPORATION)
Task: {D7B6E81D-3CF4-432C-84D2-24213F4316E6} - System32\Tasks\Microsoft\Windows\Autochk\Proxy => Rundll32.exe /d acproxy.dll,PerformAutochkOperations
Task: {DAFF98E5-9A2C-47FC-8F6E-3E70F4570998} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-15] (Adobe Systems Incorporated)
Task: {DD0E722D-8098-47F8-A6CA-2FEC657CD814} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-12-13] (Google Inc.)
Task: {E22A8667-F75B-4BA9-BA46-067ED4429DE8} - System32\Tasks\Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStartTypeChange => Rundll32.exe bfe.dll,BfeOnServiceStartTypeChange
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2013-09-05 00:17 - 2013-09-05 00:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2010-01-02 15:42 - 2010-01-02 15:42 - 00098304 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll
2010-04-06 13:53 - 2010-04-06 13:53 - 00578936 _____ () C:\Program Files\Toshiba\TECO\TecoPower.dll
2010-04-07 15:07 - 2010-04-07 15:07 - 09468728 _____ () C:\Program Files\Toshiba\FlashCards\BlackPng.dll
2009-11-03 12:26 - 2009-11-03 12:26 - 00053560 _____ () C:\Program Files\TOSHIBA\FlashCards\Hotkey\FnZ.dll
2010-03-03 13:15 - 2010-03-03 13:15 - 00019256 _____ () C:\Program Files\TOSHIBA\FlashCards\Hotkey\FnF10.dll
2010-03-03 13:15 - 2010-03-03 13:15 - 00019256 _____ () C:\Program Files\TOSHIBA\FlashCards\Hotkey\FnF11.dll
2010-05-05 21:55 - 2009-06-22 13:40 - 00022328 _____ () C:\Program Files\TOSHIBA\Toshiba Assist\NotifyX.dll
2009-03-12 18:08 - 2009-03-12 18:08 - 00048640 _____ () C:\Program Files (x86)\Toshiba\PCDiag\NotifyPCD.dll
2009-07-25 15:38 - 2009-07-25 15:38 - 00017800 _____ () C:\Program Files\TOSHIBA\TOSHIBA Disc Creator\NotifyTDC.dll
2010-02-05 16:44 - 2010-02-05 16:44 - 00079192 _____ () C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosIPCWraper.dll
2013-08-15 10:38 - 2013-08-15 10:28 - 00394824 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\Users\Toshiba\Desktop\Sebastian:Roxio EMC Stream
==================== Safe Mode (whitelisted) ===================
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PEVSystemStart => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\procexp90.Sys => ""="Driver"
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (12/16/2013 09:57:02 PM) (Source: Application Hang) (User: )
Description: Programm IEXPLORE.EXE, Version 11.0.9600.16428 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 37c
Startzeit: 01cefaa0dc3b9688
Endzeit: 359
Anwendungspfad: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
Berichts-ID:
Error: (12/16/2013 09:51:45 PM) (Source: Application Hang) (User: )
Description: Programm IEXPLORE.EXE, Version 11.0.9600.16428 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 1418
Startzeit: 01cefa9f6a20d6e3
Endzeit: 0
Anwendungspfad: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
Berichts-ID:
Error: (12/15/2013 10:23:55 AM) (Source: Application Hang) (User: )
Description: Programm IEXPLORE.EXE, Version 11.0.9600.16428 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 55c
Startzeit: 01cef976fe7b07fd
Endzeit: 200
Anwendungspfad: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
Berichts-ID:
Error: (12/15/2013 08:29:13 AM) (Source: Application Hang) (User: )
Description: Programm IEXPLORE.EXE, Version 11.0.9600.16428 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 16ec
Startzeit: 01cef9668c7577d4
Endzeit: 0
Anwendungspfad: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
Berichts-ID:
System errors:
=============
Error: (12/16/2013 09:38:27 PM) (Source: DCOM) (User: )
Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}
Error: (12/16/2013 04:14:54 PM) (Source: DCOM) (User: )
Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}
Error: (12/16/2013 10:25:18 AM) (Source: DCOM) (User: )
Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}
Error: (12/15/2013 10:13:38 AM) (Source: NetBT) (User: )
Description: Der Name "WORKGROUP :1d" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.178.69
registriert werden. Der Computer mit IP-Adresse 192.168.178.1 hat nicht
zugelassen, dass dieser Computer diesen Namen verwendet.
Error: (12/14/2013 02:55:36 PM) (Source: DCOM) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}
Microsoft Office Sessions:
=========================
Error: (12/16/2013 09:57:02 PM) (Source: Application Hang)(User: )
Description: IEXPLORE.EXE11.0.9600.1642837c01cefaa0dc3b9688359C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
Error: (12/16/2013 09:51:45 PM) (Source: Application Hang)(User: )
Description: IEXPLORE.EXE11.0.9600.16428141801cefa9f6a20d6e30C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
Error: (12/15/2013 10:23:55 AM) (Source: Application Hang)(User: )
Description: IEXPLORE.EXE11.0.9600.1642855c01cef976fe7b07fd200C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
Error: (12/15/2013 08:29:13 AM) (Source: Application Hang)(User: )
Description: IEXPLORE.EXE11.0.9600.1642816ec01cef9668c7577d40C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
CodeIntegrity Errors:
===================================
Date: 2013-10-06 13:58:07.800
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-10-06 13:58:07.644
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-10-06 13:58:07.488
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-10-06 13:58:07.332
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-10-04 13:08:40.366
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-10-04 13:08:40.101
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Percentage of memory in use: 58%
Total physical RAM: 3954.67 MB
Available physical RAM: 1628.9 MB
Total Pagefile: 7907.52 MB
Available Pagefile: 4966.07 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB
==================== Drives ================================
Drive c: (TI30621500A) (Fixed) (Total:287.42 GB) (Free:208.95 GB) NTFS ==>[System with boot components (obtained from reading drive)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 298 GB) (Disk ID: 729E0031)
Partition 1: (Active) - (Size=1 GB) - (Type=27)
Partition 2: (Not Active) - (Size=287 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=9 GB) - (Type=17)
==================== End Of Log ============================
|
|
17.12.2013, 00:20
| #34 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Safa7_22.vbs Datei versteckt Dateien und produziert Verknüpfungen in system32 Vor dem Fix Virenscanner deaktivieren!! Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter HKCU\...\Run: [safa7_22] - wscript.exe //B "C:\Users\Toshiba\AppData\Roaming\safa7_22.vbs"
HKCU\...\Run: [ciizgfaygg] - C:\Users\Toshiba\AppData\Local\Temp\ciizgfaygg..vbs [70199 2013-07-27] () <===== ATTENTION
Startup: C:\Users\Toshiba\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ciizgfaygg..vbs ()
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - DefaultScope {727B7DD5-C094-4D23-A9D7-0DDA240E4489} URL = http://search.ividi.org/?q={searchTerms}&src=tbsp&id=a853117d00000000000088ae1d50dffa&affilt=3&r=979
SearchScopes: HKCU - {08A059CE-029C-425B-A390-4DB3FF42A2F7} URL =
SearchScopes: HKCU - {1693C2F3-4930-41AF-89F1-F1557E974FCC} URL = http://rover.ebay.com/rover/1/707-44556-9400-9/4?satitle={searchTerms}
SearchScopes: HKCU - {2A9BD6BD-DDF2-4ED9-90E5-74B18360C039} URL =
SearchScopes: HKCU - {727B7DD5-C094-4D23-A9D7-0DDA240E4489} URL = http://search.ividi.org/?q={searchTerms}&src=tbsp&id=a853117d00000000000088ae1d50dffa&affilt=3&r=979
C:\Users\Toshiba\AppData\Local\Temp\ciizgfaygg..vbs
C:\Users\Toshiba\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ciizgfaygg..vbs
C:\Users\Toshiba\AppData\Roaming\*.vbs
C:\Users\Toshiba\AppData\Roaming\*.exe
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
17.12.2013, 00:31
| #35 |
| | Safa7_22.vbs Datei versteckt Dateien und produziert Verknüpfungen in system32 Fixlog: Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 16-12-2013 02
Ran by Toshiba at 2013-12-17 00:25:26 Run:4
Running from C:\Users\Toshiba\Desktop
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
HKCU\...\Run: [safa7_22] - wscript.exe //B "C:\Users\Toshiba\AppData\Roaming\safa7_22.vbs"
HKCU\...\Run: [ciizgfaygg] - C:\Users\Toshiba\AppData\Local\Temp\ciizgfaygg..vbs [70199 2013-07-27] () <===== ATTENTION
Startup: C:\Users\Toshiba\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ciizgfaygg..vbs ()
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - DefaultScope {727B7DD5-C094-4D23-A9D7-0DDA240E4489} URL = hxxp://search.ividi.org/?q={searchTerms}&src=tbsp&id=a853117d00000000000088ae1d50dffa&affilt=3&r=979
SearchScopes: HKCU - {08A059CE-029C-425B-A390-4DB3FF42A2F7} URL =
SearchScopes: HKCU - {1693C2F3-4930-41AF-89F1-F1557E974FCC} URL = hxxp://rover.ebay.com/rover/1/707-44556-9400-9/4?satitle={searchTerms}
SearchScopes: HKCU - {2A9BD6BD-DDF2-4ED9-90E5-74B18360C039} URL =
SearchScopes: HKCU - {727B7DD5-C094-4D23-A9D7-0DDA240E4489} URL = hxxp://search.ividi.org/?q={searchTerms}&src=tbsp&id=a853117d00000000000088ae1d50dffa&affilt=3&r=979
C:\Users\Toshiba\AppData\Local\Temp\ciizgfaygg..vbs
C:\Users\Toshiba\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ciizgfaygg..vbs
C:\Users\Toshiba\AppData\Roaming\*.vbs
C:\Users\Toshiba\AppData\Roaming\*.exe
*****************
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\safa7_22 => Value deleted successfully.
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\ciizgfaygg => Value deleted successfully.
C:\Users\Toshiba\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ciizgfaygg..vbs => Moved successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key deleted successfully.
HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value deleted successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{08A059CE-029C-425B-A390-4DB3FF42A2F7} => Key deleted successfully.
HKCR\CLSID\{08A059CE-029C-425B-A390-4DB3FF42A2F7} => Key not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{1693C2F3-4930-41AF-89F1-F1557E974FCC} => Key deleted successfully.
HKCR\CLSID\{1693C2F3-4930-41AF-89F1-F1557E974FCC} => Key not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2A9BD6BD-DDF2-4ED9-90E5-74B18360C039} => Key deleted successfully.
HKCR\CLSID\{2A9BD6BD-DDF2-4ED9-90E5-74B18360C039} => Key not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{727B7DD5-C094-4D23-A9D7-0DDA240E4489} => Key deleted successfully.
HKCR\CLSID\{727B7DD5-C094-4D23-A9D7-0DDA240E4489} => Key not found.
Could not move "C:\Users\Toshiba\AppData\Local\Temp\ciizgfaygg..vbs" => Scheduled to move on reboot.
"C:\Users\Toshiba\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ciizgfaygg..vbs" => File/Directory not found.
"C:\Users\Toshiba\AppData\Roaming\*.vbs" => File/Directory not found.
"C:\Users\Toshiba\AppData\Roaming\*.exe" => File/Directory not found.
=> Result of Scheduled Files to move (Boot Mode: Normal) (Date&Time: 2013-12-17 00:28:11)<=
C:\Users\Toshiba\AppData\Local\Temp\ciizgfaygg..vbs => Is moved successfully.
==== End of Fixlog ====
Auf dem Desktop ist noch eine undefinierbare Datei erschienen, die mit chinesischen Schriftzeichen (o.ä.) bezeichnet ist. Was genau ist das? :-) |
|
17.12.2013, 00:34
| #36 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Safa7_22.vbs Datei versteckt Dateien und produziert Verknüpfungen in system32 Windows neustarten, neues Log mit FRST erstellen
__________________ --> Safa7_22.vbs Datei versteckt Dateien und produziert Verknüpfungen in system32 |
|
17.12.2013, 00:50
| #37 |
| | Safa7_22.vbs Datei versteckt Dateien und produziert Verknüpfungen in system32 FRST Log: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-12-2013 02
Ran by Toshiba (administrator) on TOSHIBA-TOSH on 17-12-2013 00:42:20
Running from C:\Users\Toshiba\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Nero AG) C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(TOSHIBA Corporation) C:\Windows\System32\ThpSrv.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\TECO\TecoService.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(TOSHIBA Corporation) C:\Windows\System32\ThpSrv.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\TECO\Teco.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\TOSHIBA HDD SSD Alert\TosWaitSrv.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\TPHM\TosWaitSrv.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\TosVolRegulator\TosVolRegulator.exe
(Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe
(Toshiba Europe GmbH) C:\Program Files\Toshiba\Registration\ToshibaReminder.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\Power Saver\TPwrMain.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\SmoothView\SmoothView.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\FlashCards\TCrdMain.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE
(Google Inc.) C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
() C:\Program Files\Toshiba\FlashCards\Hotkey\TCrdKBB.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe
(TOSHIBA Corporation) C:\Program Files (x86)\TOSHIBA\TRCMan\TRCMan.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [NvCplDaemon] - RUNDLL32.EXE C:\windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10134560 2010-03-22] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [896032 2010-03-22] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2052392 2010-03-10] (Synaptics Incorporated)
HKLM\...\Run: [ThpSrv] - C:\windows\system32\thpsrv /logon
HKLM\...\Run: [Teco] - C:\Program Files\Toshiba\TECO\Teco.exe [1489760 2010-04-06] (TOSHIBA Corporation)
HKLM\...\Run: [TosSENotify] - C:\Program Files\Toshiba\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [709976 2010-02-05] (TOSHIBA Corporation)
HKLM\...\Run: [TosWaitSrv] - C:\Program Files\Toshiba\TPHM\TosWaitSrv.exe [705368 2010-02-23] (TOSHIBA Corporation)
HKLM\...\Run: [SmartFaceVWatcher] - C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatcher.exe [238080 2009-10-19] (TOSHIBA Corporation)
HKLM\...\Run: [TosVolRegulator] - C:\Program Files\Toshiba\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation)
HKLM\...\Run: [Toshiba TEMPRO] - C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe [1050072 2010-02-11] (Toshiba Europe GmbH)
HKLM\...\Run: [Toshiba Registration] - C:\Program Files\Toshiba\Registration\ToshibaReminder.exe [136136 2010-04-19] (Toshiba Europe GmbH)
HKLM\...\Run: [TPwrMain] - C:\Program Files\Toshiba\Power Saver\TPwrMain.exe [566184 2010-09-28] (TOSHIBA Corporation)
HKLM\...\Run: [HSON] - C:\Program Files\Toshiba\TBS\HSON.exe [52600 2009-03-09] (TOSHIBA Corporation)
HKLM\...\Run: [SmoothView] - C:\Program Files\Toshiba\SmoothView\SmoothView.exe [570680 2009-08-13] (TOSHIBA Corporation)
HKLM\...\Run: [00TCrdMain] - C:\Program Files\Toshiba\FlashCards\TCrdMain.exe [915320 2010-05-10] (TOSHIBA Corporation)
HKCU\...\Run: [OfficeSyncProcess] - C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE [720064 2013-04-22] (Microsoft Corporation)
HKCU\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2010-12-13] (Google Inc.)
HKCU\...\Run: [RESTART_STICKY_NOTES] - C:\Windows\System32\StikyNot.exe [427520 2009-07-14] (Microsoft Corporation)
HKLM-x32\...\Run: [SVPWUTIL] - C:\Program Files (x86)\TOSHIBA\Utilities\SVPWUTIL.exe [352256 2010-02-22] (TOSHIBA)
HKLM-x32\...\Run: [HWSetup] - C:\Program Files\Toshiba\Utilities\HWSetup.exe [423936 2010-03-04] (TOSHIBA Electronics, Inc.)
HKLM-x32\...\Run: [KeNotify] - C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe [34160 2009-12-25] (TOSHIBA CORPORATION)
HKLM-x32\...\Run: [ITSecMng] - C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe [83336 2009-07-22] (TOSHIBA CORPORATION)
HKLM-x32\...\Run: [TRCMan] - C:\Program Files (x86)\TOSHIBA\TRCMan\TRCMan.exe [701752 2009-07-21] (TOSHIBA Corporation)
HKLM-x32\...\Run: [TWebCamera] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe [2454840 2010-02-24] (TOSHIBA CORPORATION.)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [BCSSync] - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [683576 2013-11-19] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKU\Default\...\Run: [TOSHIBA Online Product Information] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\TOPI.exe [4581280 2010-03-03] (TOSHIBA)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - {AE9B2183-80F6-44E4-B4FB-0019E2630828} URL = hxxp://www.amazon.de/gp/search?ie=UTF8&keywords={searchTerms}&tag=tochibade-win7-ie-search-21&index=blended&linkCode=ur2
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: TOSHIBA Media Controller Plug-in - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
DPF: HKLM-x32 {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: HKLM-x32 {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (iVidi Chrome Toolbar) - C:\Users\Toshiba\AppData\Local\Google\Chrome\User Data\default\extensions\kpdhgpkkloealnjnmepfhanpcleldbef\1.0_0
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-11-19] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-19] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1164360 2013-11-19] (Avira Operations GmbH & Co. KG)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [124368 2010-02-11] (Toshiba Europe GmbH)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [107416 2013-12-03] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132600 2013-11-19] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-19] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2010-12-23] ()
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 cpuz132; \??\C:\Users\Toshiba\AppData\Local\Temp\cpuz132\cpuz132_x64.sys [x]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-12-17 00:42 - 2013-12-17 00:42 - 00014616 _____ C:\Users\Toshiba\Desktop\FRST.txt
2013-12-17 00:10 - 2013-12-17 00:10 - 01927940 _____ (Farbar) C:\Users\Toshiba\Desktop\FRST64.exe
2013-12-16 23:01 - 2013-12-16 23:59 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-12-16 23:01 - 2013-12-16 23:36 - 00117464 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2013-12-16 22:58 - 2013-12-16 23:59 - 00000000 ____D C:\Users\Toshiba\Desktop\mbar
2013-12-16 22:58 - 2013-12-16 23:35 - 00089304 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2013-12-16 22:57 - 2013-12-16 22:57 - 12582688 _____ (Malwarebytes Corp.) C:\Users\Toshiba\Desktop\mbar-1.07.0.1008.exe
2013-12-16 10:02 - 2013-11-26 12:54 - 23183360 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2013-12-16 10:02 - 2013-11-26 11:19 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2013-12-16 10:02 - 2013-11-26 11:18 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2013-12-16 10:02 - 2013-11-26 11:11 - 17112576 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2013-12-16 10:02 - 2013-11-26 10:48 - 00066048 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2013-12-16 10:02 - 2013-11-26 10:46 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2013-12-16 10:02 - 2013-11-26 10:41 - 02764288 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2013-12-16 10:02 - 2013-11-26 10:29 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2013-12-16 10:02 - 2013-11-26 10:27 - 00033792 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2013-12-16 10:02 - 2013-11-26 10:23 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2013-12-16 10:02 - 2013-11-26 10:21 - 00574976 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2013-12-16 10:02 - 2013-11-26 10:18 - 00139264 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2013-12-16 10:02 - 2013-11-26 10:18 - 00111616 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2013-12-16 10:02 - 2013-11-26 10:16 - 00708608 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2013-12-16 10:02 - 2013-11-26 09:57 - 00218624 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2013-12-16 10:02 - 2013-11-26 09:38 - 02166784 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2013-12-16 10:02 - 2013-11-26 09:38 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2013-12-16 10:02 - 2013-11-26 09:35 - 05769216 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2013-12-16 10:02 - 2013-11-26 09:32 - 00440832 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2013-12-16 10:02 - 2013-11-26 09:28 - 00553472 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll
2013-12-16 10:02 - 2013-11-26 09:16 - 04243968 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2013-12-16 10:02 - 2013-11-26 09:02 - 01995264 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2013-12-16 10:02 - 2013-11-26 08:48 - 12996608 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2013-12-16 10:02 - 2013-11-26 08:32 - 01928192 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2013-12-16 10:02 - 2013-11-26 08:26 - 11221504 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2013-12-16 10:02 - 2013-11-26 08:07 - 02334208 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2013-12-16 10:02 - 2013-11-26 07:40 - 01395200 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2013-12-16 10:02 - 2013-11-26 07:34 - 00817664 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2013-12-16 10:02 - 2013-11-26 07:34 - 00703488 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2013-12-16 10:02 - 2013-11-26 07:33 - 01820160 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2013-12-16 10:02 - 2013-11-26 07:27 - 01157632 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2013-12-14 15:28 - 2013-12-14 15:37 - 00000000 ___SD C:\ComboFix
2013-12-14 14:45 - 2013-12-14 14:45 - 01034531 _____ (Thisisu) C:\Users\Toshiba\Desktop\JRT.exe
2013-12-14 14:35 - 2013-12-14 14:35 - 01226802 _____ C:\Users\Toshiba\Desktop\adwcleaner.exe
2013-12-14 13:58 - 2013-10-14 18:00 - 00028368 _____ (Microsoft Corporation) C:\windows\system32\IEUDINIT.EXE
2013-12-14 13:53 - 2013-12-14 13:53 - 01228800 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 01051136 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00942592 _____ (Microsoft Corporation) C:\windows\system32\jsIntl.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00940032 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00774144 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00645120 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsIntl.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00626176 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00616104 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dat
2013-12-14 13:53 - 2013-12-14 13:53 - 00616104 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dat
2013-12-14 13:53 - 2013-12-14 13:53 - 00610304 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00548352 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00523776 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00454656 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00453120 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00413696 _____ (Microsoft Corporation) C:\windows\system32\html.iec
2013-12-14 13:53 - 2013-12-14 13:53 - 00367104 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00337408 _____ (Microsoft Corporation) C:\windows\SysWOW64\html.iec
2013-12-14 13:53 - 2013-12-14 13:53 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00263376 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00247808 _____ (Microsoft Corporation) C:\windows\system32\msls31.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00244736 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00243200 _____ (Microsoft Corporation) C:\windows\system32\webcheck.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00238288 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00235520 _____ (Microsoft Corporation) C:\windows\system32\url.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00235008 _____ (Microsoft Corporation) C:\windows\system32\elshyph.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00233472 _____ (Microsoft Corporation) C:\windows\SysWOW64\url.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00208384 _____ (Microsoft Corporation) C:\windows\SysWOW64\webcheck.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00195584 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00194048 _____ (Microsoft Corporation) C:\windows\SysWOW64\elshyph.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00182272 _____ (Microsoft Corporation) C:\windows\SysWOW64\msls31.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00167424 _____ (Microsoft Corporation) C:\windows\system32\iexpress.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00164864 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00151552 _____ (Microsoft Corporation) C:\windows\SysWOW64\iexpress.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00147968 _____ (Microsoft Corporation) C:\windows\system32\occache.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00143872 _____ (Microsoft Corporation) C:\windows\system32\wextract.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00139264 _____ (Microsoft Corporation) C:\windows\SysWOW64\wextract.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00135680 _____ (Microsoft Corporation) C:\windows\system32\iepeers.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00131072 _____ (Microsoft Corporation) C:\windows\system32\IEAdvpack.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00127488 _____ (Microsoft Corporation) C:\windows\SysWOW64\occache.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00116736 _____ (Microsoft Corporation) C:\windows\SysWOW64\iepeers.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00112128 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00111616 _____ (Microsoft Corporation) C:\windows\SysWOW64\IEAdvpack.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00105984 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00101376 _____ (Microsoft Corporation) C:\windows\system32\inseng.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00090112 _____ (Microsoft Corporation) C:\windows\system32\SetIEInstalledDate.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00086016 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00086016 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00084992 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00083968 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00083456 _____ (Microsoft Corporation) C:\windows\SysWOW64\inseng.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00081408 _____ (Microsoft Corporation) C:\windows\system32\icardie.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00077312 _____ (Microsoft Corporation) C:\windows\system32\tdc.ocx
2013-12-14 13:53 - 2013-12-14 13:53 - 00074240 _____ (Microsoft Corporation) C:\windows\SysWOW64\SetIEInstalledDate.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00069632 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00069120 _____ (Microsoft Corporation) C:\windows\SysWOW64\icardie.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\tdc.ocx
2013-12-14 13:53 - 2013-12-14 13:53 - 00062464 _____ (Microsoft Corporation) C:\windows\system32\pngfilt.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00056832 _____ (Microsoft Corporation) C:\windows\SysWOW64\pngfilt.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00052224 _____ (Microsoft Corporation) C:\windows\system32\msfeedsbs.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00051200 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00048640 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmler.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\mshtmler.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00048128 _____ (Microsoft Corporation) C:\windows\system32\imgutil.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeedsbs.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00040448 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00036352 _____ (Microsoft Corporation) C:\windows\SysWOW64\imgutil.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00034816 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00032768 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00030208 _____ (Microsoft Corporation) C:\windows\system32\licmgr10.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00024576 _____ (Microsoft Corporation) C:\windows\SysWOW64\licmgr10.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00013824 _____ (Microsoft Corporation) C:\windows\system32\mshta.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00013312 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshta.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00013312 _____ (Microsoft Corporation) C:\windows\system32\msfeedssync.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00012800 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeedssync.exe
2013-12-14 13:51 - 2013-12-14 13:58 - 00010277 _____ C:\windows\IE11_main.log
2013-12-13 14:23 - 2013-05-10 06:56 - 14631424 _____ (Microsoft Corporation) C:\windows\system32\wmp.dll
2013-12-13 14:23 - 2013-05-10 06:56 - 12625920 _____ (Microsoft Corporation) C:\windows\system32\wmploc.DLL
2013-12-13 14:23 - 2013-05-10 05:56 - 12625408 _____ (Microsoft Corporation) C:\windows\SysWOW64\wmploc.DLL
2013-12-13 14:23 - 2013-05-10 05:56 - 11410432 _____ (Microsoft Corporation) C:\windows\SysWOW64\wmp.dll
2013-12-12 21:40 - 2013-11-12 03:23 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\tzres.dll
2013-12-12 21:40 - 2013-11-12 03:07 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\tzres.dll
2013-12-12 21:12 - 2013-07-27 18:22 - 00070199 _____ C:\Users\Toshiba\Desktop\㩃䙜卒屔畑牡湡楴敮Ȁ
2013-12-12 21:03 - 2013-10-30 02:24 - 03155968 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2013-12-12 20:47 - 2013-10-19 03:18 - 00081408 _____ (Microsoft Corporation) C:\windows\system32\imagehlp.dll
2013-12-12 20:47 - 2013-10-19 02:36 - 00159232 _____ (Microsoft Corporation) C:\windows\SysWOW64\imagehlp.dll
2013-12-12 20:28 - 2013-10-30 03:32 - 00335360 _____ (Microsoft Corporation) C:\windows\system32\msieftp.dll
2013-12-12 20:28 - 2013-10-30 03:19 - 00301568 _____ (Microsoft Corporation) C:\windows\SysWOW64\msieftp.dll
2013-12-12 20:18 - 2013-11-23 19:26 - 00417792 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMPhoto.dll
2013-12-12 20:18 - 2013-11-23 18:47 - 00465920 _____ (Microsoft Corporation) C:\windows\system32\WMPhoto.dll
2013-12-12 20:17 - 2013-10-04 03:16 - 00116736 _____ (Microsoft Corporation) C:\windows\system32\Drivers\drmk.sys
2013-12-12 20:17 - 2013-10-04 02:36 - 00230400 _____ (Microsoft Corporation) C:\windows\system32\Drivers\portcls.sys
2013-12-12 20:09 - 2013-10-12 03:32 - 00150016 _____ (Microsoft Corporation) C:\windows\system32\wshom.ocx
2013-12-12 20:09 - 2013-10-12 03:31 - 00202752 _____ (Microsoft Corporation) C:\windows\system32\scrrun.dll
2013-12-12 20:09 - 2013-10-12 03:04 - 00121856 _____ (Microsoft Corporation) C:\windows\SysWOW64\wshom.ocx
2013-12-12 20:09 - 2013-10-12 03:03 - 00163840 _____ (Microsoft Corporation) C:\windows\SysWOW64\scrrun.dll
2013-12-12 20:09 - 2013-10-12 02:33 - 00168960 _____ (Microsoft Corporation) C:\windows\system32\wscript.exe
2013-12-12 20:09 - 2013-10-12 02:33 - 00156160 _____ (Microsoft Corporation) C:\windows\system32\cscript.exe
2013-12-12 20:09 - 2013-10-12 02:15 - 00141824 _____ (Microsoft Corporation) C:\windows\SysWOW64\wscript.exe
2013-12-12 20:09 - 2013-10-12 02:15 - 00126976 _____ (Microsoft Corporation) C:\windows\SysWOW64\cscript.exe
2013-11-20 17:14 - 2013-11-20 17:14 - 00000000 ____D C:\ProgramData\Oracle
2013-11-20 17:12 - 2013-11-20 17:12 - 00264616 _____ (Oracle Corporation) C:\windows\SysWOW64\javaws.exe
2013-11-20 17:12 - 2013-11-20 17:12 - 00096168 _____ (Oracle Corporation) C:\windows\SysWOW64\WindowsAccessBridge-32.dll
2013-11-18 15:44 - 2013-11-25 11:00 - 00000000 ____D C:\Users\Toshiba\Desktop\Ideen
==================== One Month Modified Files and Folders =======
2013-12-17 00:43 - 2013-12-17 00:42 - 00014616 _____ C:\Users\Toshiba\Desktop\FRST.txt
2013-12-17 00:39 - 2010-12-13 16:43 - 00001108 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-12-17 00:39 - 2009-07-14 06:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-12-17 00:39 - 2009-07-14 05:51 - 00201102 _____ C:\windows\setupact.log
2013-12-17 00:38 - 2010-09-23 14:34 - 00000000 ____D C:\Users\Toshiba\AppData\Roaming\Skype
2013-12-17 00:38 - 2010-07-18 12:54 - 01655559 _____ C:\windows\WindowsUpdate.log
2013-12-17 00:34 - 2009-07-14 05:45 - 00016080 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-12-17 00:34 - 2009-07-14 05:45 - 00016080 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-12-17 00:28 - 2013-10-04 10:09 - 00000000 ____D C:\FRST
2013-12-17 00:25 - 2010-08-31 08:32 - 00000000 ___RD C:\Users\Toshiba\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-12-17 00:10 - 2013-12-17 00:10 - 01927940 _____ (Farbar) C:\Users\Toshiba\Desktop\FRST64.exe
2013-12-16 23:59 - 2013-12-16 23:01 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-12-16 23:59 - 2013-12-16 22:58 - 00000000 ____D C:\Users\Toshiba\Desktop\mbar
2013-12-16 23:57 - 2012-09-24 17:46 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2013-12-16 23:47 - 2010-12-13 16:43 - 00001112 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-12-16 23:36 - 2013-12-16 23:01 - 00117464 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2013-12-16 23:35 - 2013-12-16 22:58 - 00089304 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2013-12-16 22:57 - 2013-12-16 22:57 - 12582688 _____ (Malwarebytes Corp.) C:\Users\Toshiba\Desktop\mbar-1.07.0.1008.exe
2013-12-16 20:30 - 2012-03-10 14:28 - 00003954 _____ C:\windows\System32\Tasks\User_Feed_Synchronization-{AB0334C5-6282-41F4-9B68-A22855822001}
2013-12-16 10:01 - 2013-08-15 18:38 - 00000000 ____D C:\windows\system32\MRT
2013-12-16 09:56 - 2011-01-26 16:12 - 90708896 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2013-12-15 09:04 - 2012-09-24 17:46 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2013-12-15 09:04 - 2012-09-24 17:46 - 00003822 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2013-12-15 09:04 - 2011-11-09 19:11 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-12-15 08:34 - 2012-10-30 18:50 - 00000000 ____D C:\Users\Toshiba\Desktop\Namibia
2013-12-14 15:39 - 2010-07-18 12:50 - 00225546 _____ C:\windows\PFRO.log
2013-12-14 15:37 - 2013-12-14 15:28 - 00000000 ___SD C:\ComboFix
2013-12-14 15:29 - 2013-10-04 11:00 - 00000000 ____D C:\Qoobox
2013-12-14 14:45 - 2013-12-14 14:45 - 01034531 _____ (Thisisu) C:\Users\Toshiba\Desktop\JRT.exe
2013-12-14 14:37 - 2013-10-07 06:35 - 00000000 ____D C:\AdwCleaner
2013-12-14 14:35 - 2013-12-14 14:35 - 01226802 _____ C:\Users\Toshiba\Desktop\adwcleaner.exe
2013-12-14 14:26 - 2009-07-14 03:34 - 00000215 _____ C:\windows\system.ini
2013-12-14 14:03 - 2010-08-31 08:35 - 00001432 _____ C:\Users\Toshiba\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-12-14 14:00 - 2009-07-14 04:20 - 00000000 ____D C:\windows\PolicyDefinitions
2013-12-14 13:58 - 2013-12-14 13:51 - 00010277 _____ C:\windows\IE11_main.log
2013-12-14 13:53 - 2013-12-14 13:53 - 01228800 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 01051136 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00942592 _____ (Microsoft Corporation) C:\windows\system32\jsIntl.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00940032 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00774144 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00645120 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsIntl.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00626176 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00616104 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dat
2013-12-14 13:53 - 2013-12-14 13:53 - 00616104 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dat
2013-12-14 13:53 - 2013-12-14 13:53 - 00610304 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00548352 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00523776 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00454656 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00453120 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00413696 _____ (Microsoft Corporation) C:\windows\system32\html.iec
2013-12-14 13:53 - 2013-12-14 13:53 - 00367104 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00337408 _____ (Microsoft Corporation) C:\windows\SysWOW64\html.iec
2013-12-14 13:53 - 2013-12-14 13:53 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00263376 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00247808 _____ (Microsoft Corporation) C:\windows\system32\msls31.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00244736 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00243200 _____ (Microsoft Corporation) C:\windows\system32\webcheck.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00238288 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00235520 _____ (Microsoft Corporation) C:\windows\system32\url.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00235008 _____ (Microsoft Corporation) C:\windows\system32\elshyph.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00233472 _____ (Microsoft Corporation) C:\windows\SysWOW64\url.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00208384 _____ (Microsoft Corporation) C:\windows\SysWOW64\webcheck.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00195584 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00194048 _____ (Microsoft Corporation) C:\windows\SysWOW64\elshyph.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00182272 _____ (Microsoft Corporation) C:\windows\SysWOW64\msls31.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00167424 _____ (Microsoft Corporation) C:\windows\system32\iexpress.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00164864 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00151552 _____ (Microsoft Corporation) C:\windows\SysWOW64\iexpress.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00147968 _____ (Microsoft Corporation) C:\windows\system32\occache.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00143872 _____ (Microsoft Corporation) C:\windows\system32\wextract.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00139264 _____ (Microsoft Corporation) C:\windows\SysWOW64\wextract.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00135680 _____ (Microsoft Corporation) C:\windows\system32\iepeers.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00131072 _____ (Microsoft Corporation) C:\windows\system32\IEAdvpack.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00127488 _____ (Microsoft Corporation) C:\windows\SysWOW64\occache.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00116736 _____ (Microsoft Corporation) C:\windows\SysWOW64\iepeers.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00112128 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00111616 _____ (Microsoft Corporation) C:\windows\SysWOW64\IEAdvpack.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00105984 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00101376 _____ (Microsoft Corporation) C:\windows\system32\inseng.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00090112 _____ (Microsoft Corporation) C:\windows\system32\SetIEInstalledDate.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00086016 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00086016 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00084992 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00083968 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00083456 _____ (Microsoft Corporation) C:\windows\SysWOW64\inseng.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00081408 _____ (Microsoft Corporation) C:\windows\system32\icardie.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00077312 _____ (Microsoft Corporation) C:\windows\system32\tdc.ocx
2013-12-14 13:53 - 2013-12-14 13:53 - 00074240 _____ (Microsoft Corporation) C:\windows\SysWOW64\SetIEInstalledDate.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00069632 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00069120 _____ (Microsoft Corporation) C:\windows\SysWOW64\icardie.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\tdc.ocx
2013-12-14 13:53 - 2013-12-14 13:53 - 00062464 _____ (Microsoft Corporation) C:\windows\system32\pngfilt.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00056832 _____ (Microsoft Corporation) C:\windows\SysWOW64\pngfilt.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00052224 _____ (Microsoft Corporation) C:\windows\system32\msfeedsbs.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00051200 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00048640 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmler.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\mshtmler.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00048128 _____ (Microsoft Corporation) C:\windows\system32\imgutil.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeedsbs.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00040448 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00036352 _____ (Microsoft Corporation) C:\windows\SysWOW64\imgutil.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00034816 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00032768 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00030208 _____ (Microsoft Corporation) C:\windows\system32\licmgr10.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00024576 _____ (Microsoft Corporation) C:\windows\SysWOW64\licmgr10.dll
2013-12-14 13:53 - 2013-12-14 13:53 - 00013824 _____ (Microsoft Corporation) C:\windows\system32\mshta.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00013312 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshta.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00013312 _____ (Microsoft Corporation) C:\windows\system32\msfeedssync.exe
2013-12-14 13:53 - 2013-12-14 13:53 - 00012800 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeedssync.exe
2013-12-14 12:18 - 2010-12-13 16:43 - 00000000 ____D C:\Users\Toshiba\AppData\Local\Google
2013-12-13 18:26 - 2010-09-26 21:08 - 00000000 ____D C:\Users\Toshiba\Desktop\Sebastian
2013-12-13 16:51 - 2009-07-14 06:09 - 00000000 ____D C:\windows\System32\Tasks\WPD
2013-12-13 15:50 - 2010-05-05 22:05 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-12-13 15:50 - 2010-05-05 22:05 - 00000000 ____D C:\ProgramData\Skype
2013-12-13 14:22 - 2010-05-05 22:12 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-12-13 10:37 - 2009-07-14 18:58 - 00654852 _____ C:\windows\system32\perfh007.dat
2013-12-13 10:37 - 2009-07-14 18:58 - 00130434 _____ C:\windows\system32\perfc007.dat
2013-12-13 10:37 - 2009-07-14 06:13 - 01500294 _____ C:\windows\system32\PerfStringBackup.INI
2013-12-13 06:42 - 2010-12-13 16:43 - 00004108 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-12-13 06:42 - 2010-12-13 16:43 - 00003856 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-12-13 06:12 - 2009-07-14 05:45 - 00445056 _____ C:\windows\system32\FNTCACHE.DAT
2013-12-03 20:57 - 2013-07-21 11:14 - 00000000 ____D C:\Users\Toshiba\AppData\Roaming\Dropbox
2013-12-03 20:56 - 2013-07-21 11:16 - 00000000 ___RD C:\Users\Toshiba\Dropbox
2013-12-03 20:55 - 2009-07-14 06:08 - 00032640 _____ C:\windows\Tasks\SCHEDLGU.TXT
2013-12-03 12:22 - 2013-08-15 10:38 - 00107416 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys
2013-12-03 10:46 - 2013-08-13 20:50 - 00000000 ____D C:\Program Files (x86)\Mobile Partner
2013-12-01 14:12 - 2011-01-19 19:09 - 00000000 ____D C:\Users\Toshiba\AppData\Roaming\dvdcss
2013-11-28 12:21 - 2011-06-24 23:56 - 02241024 ___SH C:\Users\Toshiba\Desktop\Thumbs.db
2013-11-26 12:54 - 2013-12-16 10:02 - 23183360 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2013-11-26 11:19 - 2013-12-16 10:02 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2013-11-26 11:18 - 2013-12-16 10:02 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2013-11-26 11:11 - 2013-12-16 10:02 - 17112576 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2013-11-26 10:48 - 2013-12-16 10:02 - 00066048 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2013-11-26 10:46 - 2013-12-16 10:02 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2013-11-26 10:41 - 2013-12-16 10:02 - 02764288 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2013-11-26 10:29 - 2013-12-16 10:02 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2013-11-26 10:27 - 2013-12-16 10:02 - 00033792 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2013-11-26 10:23 - 2013-12-16 10:02 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2013-11-26 10:21 - 2013-12-16 10:02 - 00574976 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2013-11-26 10:18 - 2013-12-16 10:02 - 00139264 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2013-11-26 10:18 - 2013-12-16 10:02 - 00111616 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2013-11-26 10:16 - 2013-12-16 10:02 - 00708608 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2013-11-26 09:57 - 2013-12-16 10:02 - 00218624 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2013-11-26 09:38 - 2013-12-16 10:02 - 02166784 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2013-11-26 09:38 - 2013-12-16 10:02 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2013-11-26 09:35 - 2013-12-16 10:02 - 05769216 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2013-11-26 09:32 - 2013-12-16 10:02 - 00440832 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2013-11-26 09:28 - 2013-12-16 10:02 - 00553472 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll
2013-11-26 09:16 - 2013-12-16 10:02 - 04243968 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2013-11-26 09:02 - 2013-12-16 10:02 - 01995264 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2013-11-26 08:48 - 2013-12-16 10:02 - 12996608 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2013-11-26 08:32 - 2013-12-16 10:02 - 01928192 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2013-11-26 08:26 - 2013-12-16 10:02 - 11221504 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2013-11-26 08:07 - 2013-12-16 10:02 - 02334208 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2013-11-26 07:40 - 2013-12-16 10:02 - 01395200 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2013-11-26 07:34 - 2013-12-16 10:02 - 00817664 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2013-11-26 07:34 - 2013-12-16 10:02 - 00703488 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2013-11-26 07:33 - 2013-12-16 10:02 - 01820160 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2013-11-26 07:27 - 2013-12-16 10:02 - 01157632 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2013-11-25 11:00 - 2013-11-18 15:44 - 00000000 ____D C:\Users\Toshiba\Desktop\Ideen
2013-11-23 19:26 - 2013-12-12 20:18 - 00417792 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMPhoto.dll
2013-11-23 18:47 - 2013-12-12 20:18 - 00465920 _____ (Microsoft Corporation) C:\windows\system32\WMPhoto.dll
2013-11-21 09:18 - 2012-01-18 18:18 - 00000000 ____D C:\Users\Toshiba\Documents\Outlook-Dateien
2013-11-20 17:14 - 2013-11-20 17:14 - 00000000 ____D C:\ProgramData\Oracle
2013-11-20 17:12 - 2013-11-20 17:12 - 00264616 _____ (Oracle Corporation) C:\windows\SysWOW64\javaws.exe
2013-11-20 17:12 - 2013-11-20 17:12 - 00096168 _____ (Oracle Corporation) C:\windows\SysWOW64\WindowsAccessBridge-32.dll
2013-11-20 17:12 - 2013-06-20 16:07 - 00175016 _____ (Oracle Corporation) C:\windows\SysWOW64\javaw.exe
2013-11-20 17:12 - 2013-06-20 16:07 - 00174504 _____ (Oracle Corporation) C:\windows\SysWOW64\java.exe
2013-11-20 17:12 - 2010-09-09 14:38 - 00000000 ____D C:\Program Files (x86)\Java
2013-11-19 13:18 - 2013-08-15 10:39 - 00083160 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avnetflt.sys
2013-11-19 13:18 - 2013-08-15 10:38 - 00132600 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys
2013-11-19 13:18 - 2013-08-15 10:38 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avkmgr.sys
2013-11-17 11:34 - 2009-07-14 04:20 - 00000000 ____D C:\windows\system32\NDF
Some content of TEMP:
====================
C:\Users\Toshiba\AppData\Local\Temp\avgnt.exe
C:\Users\Toshiba\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-10-21 11:28
==================== End Of Log ============================
|
|
17.12.2013, 00:53
| #38 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Safa7_22.vbs Datei versteckt Dateien und produziert Verknüpfungen in system32 Nun ist es weg. Frische Kontrollscans mit MBAM und ESET bitte.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
17.12.2013, 01:01
| #39 |
| | Safa7_22.vbs Datei versteckt Dateien und produziert Verknüpfungen in system32 Wenn ich die Datei über die Suchfunktion suche wird sie noch angezeigt... Ich habe einen langen, langen Flug hinter mir und gehe jetzt ins Bett, ich führe die Anweisungen morgen aus. Viele Dank für die schnellen Antworten heute!! |
|
17.12.2013, 01:04
| #40 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Safa7_22.vbs Datei versteckt Dateien und produziert Verknüpfungen in system32Zitat:
Es sollte klar sein, dass Programme wie FRST gefixte Einträge und Dateien in die Q schieben und nicht sofort löschen falls man da noch ran muss.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
17.12.2013, 19:57
| #41 |
| | Safa7_22.vbs Datei versteckt Dateien und produziert Verknüpfungen in system32 Alles klar. Hier die beiden geforderten Logs: ESET: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=21bca4c3ba723f4e90d0572b828cabea
# engine=16298
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-12-17 05:15:24
# local_time=2013-12-17 06:15:24 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 94 21393 157971829 14122 0
# compatibility_mode=5893 16776573 100 94 21897 138930374 0 0
# scanned=177285
# found=4
# cleaned=0
# scan_time=9493
sh=F506F8E2F6591A6AF5373F64D9784AB1BEC958FE ft=0 fh=0000000000000000 vn="VBS/Agent.NDR worm" ac=I fn="C:\FRST\Quarantine\staxnet.vbe"
sh=F506F8E2F6591A6AF5373F64D9784AB1BEC958FE ft=0 fh=0000000000000000 vn="VBS/Agent.NDR worm" ac=I fn="C:\Qoobox\Quarantine\C\Users\Toshiba\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\staxnet.vbe.vir"
sh=C02423884B82F50565A8AA2BE8F974E821760F18 ft=0 fh=0000000000000000 vn="Eicar test file" ac=I fn="C:\Users\Toshiba\AppData\Local\Temp\Av-test.txt"
sh=BBB5A7BB893C22D5370FC644E2A57B982EFDFD81 ft=0 fh=0000000000000000 vn="VBS/Kryptik.L trojan" ac=I fn="C:\Users\Toshiba\Desktop\??????????"
Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.12.17.03 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 11.0.9600.16476 Toshiba :: TOSHIBA-TOSH [Administrator] 17.12.2013 13:11:44 mbam-log-2013-12-17 (13-11-44).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|Q:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 402548 Laufzeit: 1 Stunde(n), 46 Minute(n), 29 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 1 C:\AdwCleaner\Quarantine\C\Program Files (x86)\Conduit\Community Alerts\Alert.dll.vir (PUP.Optional.Conduit) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) |
|
17.12.2013, 23:15
| #42 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Safa7_22.vbs Datei versteckt Dateien und produziert Verknüpfungen in system32Zitat:
__________________ Logfiles bitte immer in CODE-Tags posten |
|
18.12.2013, 14:40
| #43 |
| | Safa7_22.vbs Datei versteckt Dateien und produziert Verknüpfungen in system32 Ähm. Bewusst habe ich nichts verändert. Da war so eine leere Textdatei mit chinesischen Schriftzeichen, die habe ich aber gelöscht. Vielleicht war die das? |
|
18.12.2013, 15:28
| #44 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Safa7_22.vbs Datei versteckt Dateien und produziert Verknüpfungen in system32 Dann wars nur Müll TFC - Temp File Cleaner Lade dir  TFC (TempFileCleaner von Oldtimer) herunter und speichere es auf den Desktop.
Sieht soweit ok aus  Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat. Info: Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie ) Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird. Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu Safa7_22.vbs Datei versteckt Dateien und produziert Verknüpfungen in system32 |
| appdata, autorun, computer, dateien, formatierung, laptop, musik, problem, programm, pup.optional.browsefox.a, pup.optional.installcore, safa7_22, start, stick, system, system32, toshiba, trojaner, usb, usb stick, vbs/dldr.agent.1438, windows |
Linear-Darstellung
