| |
| |||||||
Log-Analyse und Auswertung: Windows 8: Online-Banking TrojanerWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
07.10.2013, 15:11
| #1 |
| |  Windows 8: Online-Banking Trojaner Hallo liebe Experten, vor einiger Zeit habe ich eine dubiose Email mit Anhang erhalten, der sich im Nachhinein als Online-Banking Trojaner erwiesen hat (da meine Frau den Mailanhang leider geöffnet hat). Ein Scan mit Antivir hat zwar den Trojaner "TR/Yakes.dbwb" gefunden und entfernt (leider habe ich das Log-File nicht mehr), aber beim log-in zum Online-Banking erscheint weiterhin jedes Mal ein Fenster, das mich auffordert, meine Handy-Nummer einzugeben und eine App auf dem Smartphone zu installieren (offensichtlich sollen hierdurch SMS-TANs abgefangen werden - auf dem Eingabe-Bildschirm erscheint auch das gefälschte Logo des TÜV). Es ist die gleiche Meldung wie im bereits existierenden Thema unter folgendem Link: http://www.trojaner-board.de/137207-...-download.html Spätere Scans mit Antivir und Malware-Bytes ergaben keinerlei Resultate. Ich habe die in eurer Anleitung beschriebenen Scans durchgeführt und die entsprechenden Log-Files unten eingefügt. Ich hoffe ihr könnt mir helfen, das Ding wieder komplett vom Rechner zu bekommen. Vielen Dank schon mal im Voraus und viele Grüße, Mienk Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 22:37 on 22/08/2013 (Tizi)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 21-08-2013 02 (ATTENTION: ====> FRST version is 47 days old and could be outdated)
Ran by SYSTEM on 07-10-2013 15:16:45
Running from D:\
Windows 8 (X64) OS Language: English(US)
Internet Explorer Version 10
Boot Mode: Recovery
The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13191824 2012-08-10] (Realtek Semiconductor)
HKLM\...\Run: [BtTray] - C:\Program Files (x86)\Bluetooth Suite\BtTray.exe [766080 2012-12-05] (Qualcomm Atheros)
HKLM\...\Run: [BtvStack] - C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [128640 2012-12-05] (Qualcomm Atheros Commnucations)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [40312 2013-09-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [RemoteControl10] - C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [97392 2012-08-15] (CyberLink Corp.)
HKLM-x32\...\Run: [CLMLServer_For_P2G8] - C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111120 2012-06-07] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] - C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [491120 2012-07-12] (CyberLink Corp.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-11] (Oracle Corporation)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-04] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Samsung PanelMgr] - C:\Windows\Samsung\PanelMgr\SSMMgr.exe [618496 2010-06-23] ()
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642216 2012-09-12] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [F-Secure Hoster (47731)] - C:\Program Files (x86)\Kabel BW\fshoster32.exe [191424 2013-05-15] (F-Secure Corporation)
HKU\Tizi\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19875432 2013-06-20] (Skype Technologies S.A.)
HKU\Tizi\...\Run: [eecqbywt] - C:\Users\Tizi\AppData\Local\Temp\Lqph\pppazrzbywt.exe [x] <===== ATTENTION
HKU\Tizi\...\Run: [AppEx Accelerator UI] - C:\Program Files\AMD Quick Stream\AppexAcceleratorUI.exe [1000288 2012-05-22] (AppEx Networks Corporation)
HKU\Tizi\...\Run: [Quick Starter] - C:\Program Files (x86)\Samsung\Quick Starter\Quick Starter.exe [2213424 2013-04-18] (Samsung Electronics CO., LTD.)
HKU\Tizi\...\Policies\system: [DisableLockWorkstation] 0
Startup: C:\Users\Tizi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wetter.lnk
ShortcutTarget: wetter.lnk -> C:\Program Files (x86)\wetter.com DesktopApp\wetter.com DesktopApp.exe (No File)
==================== Services (Whitelisted) =================
S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-04] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-04] (Avira Operations GmbH & Co. KG)
S2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [231552 2012-12-05] (Qualcomm Atheros Commnucations)
S2 Easy Launcher; C:\Program Files (x86)\Samsung\Settings\CmdServer\EasyLauncher.exe [1593976 2012-08-26] (Samsung Electronics CO., LTD.)
S2 fshoster; C:\Program Files (x86)\Kabel BW\fshoster32.exe [191424 2013-05-15] (F-Secure Corporation)
S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S2 SWUpdateService; C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe [3017776 2013-07-12] (Samsung Electronics CO., LTD.)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-01] (Microsoft Corporation)
S2 ZAtheros Bt and Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [323584 2012-12-05] (Atheros)
==================== Drivers (Whitelisted) ====================
S0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [35496 2012-07-09] (Advanced Micro Devices, Inc.)
S2 APXACC; C:\Windows\system32\DRIVERS\appexDrv.sys [199008 2012-06-22] (AppEx Networks Corporation)
S3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [91648 2012-08-21] (Advanced Micro Devices)
S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-04] (Avira Operations GmbH & Co. KG)
S1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [132088 2013-09-04] (Avira Operations GmbH & Co. KG)
S1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-02-26] (Avira Operations GmbH & Co. KG)
S3 BTATH_HID; C:\Windows\system32\DRIVERS\btath_hid.sys [222360 2012-12-05] (Qualcomm Atheros)
S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2012-12-05] (Qualcomm Atheros)
S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-25] (Microsoft Corporation)
S1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-24] (CyberLink)
S3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 RadioHIDMini; C:\Windows\System32\drivers\RadioHIDMini.sys [23408 2012-07-27] (Windows (R) Win 7 DDK provider)
========================== Drivers MD5 =======================
C:\Windows\System32\drivers\1394ohci.sys E890C46E4754F0DF51BAFCC8D2E07498
C:\Windows\System32\drivers\3ware.sys 4F18D4C7EA14F11A7211F60D553C03DB
C:\Windows\System32\drivers\ACPI.sys 975AABEB243B800C23626D6B652C5A9C
C:\Windows\System32\Drivers\acpiex.sys DC968C37822117E576B933F34A2D130C
C:\Windows\System32\drivers\acpipagr.sys 0CA9F7C3A78227C21A0A7854E245CFB2
C:\Windows\System32\drivers\acpipmi.sys 8EB8DA03B142D3DD1EB9ED8107A76C43
C:\Windows\System32\drivers\acpitime.sys CBCE725C5D86ABA7D2604E22951AA9B8
C:\Windows\System32\drivers\adp94xx.sys 93C6388592B99925C1D1576E465BC80F
C:\Windows\System32\drivers\adpahci.sys D27763E0247292654E7F7D16444C7C72
C:\Windows\System32\drivers\adpu320.sys 67B90070FF48F794AF19F9FCF0080D75
C:\Windows\system32\drivers\afd.sys 36D6A3201721558A8AFBCC09C2DA4C2C
C:\Windows\System32\drivers\agp440.sys 01590377A5AB19E792528C628A2A68F9
C:\Windows\System32\drivers\amdk8.sys 5A81054B824004B1ECC04F0034A1CDF9
C:\Windows\system32\DRIVERS\atikmdag.sys C4DF1D3A6D617A69404973DF4FFBEFC2
C:\Windows\system32\DRIVERS\atikmpag.sys 7E039BD9D3A659D0F4193BF25F319F8A
C:\Windows\System32\drivers\amdkmpfd.sys 02CF5AD93538CCE63EB09364EDD3DCF9
C:\Windows\System32\drivers\amdppm.sys B849D453E644FAB9BC8EF6DC8CA9C4C6
C:\Windows\System32\drivers\amdsata.sys 35A0EB5AECB0FA3C41A2FB514A562304
C:\Windows\System32\drivers\amdsbs.sys 00452671904F5EE94B50BF0219C97164
C:\Windows\System32\drivers\amdxata.sys EA3FFE53E92E59C87E3ECA9BEB20D9B7
C:\Windows\System32\drivers\amd_sata.sys E907C9355E822799B0A7D06110CE683A
C:\Windows\System32\drivers\amd_xata.sys 15FD758D7E1B9887262D7101509AE892
C:\Windows\system32\drivers\appid.sys 83B3682CE922FB0F415734B26D9D6233
C:\Windows\system32\DRIVERS\appexDrv.sys 44695679881DEB85CAD7C249B151066E
C:\Windows\System32\drivers\arc.sys E933401B392387F4BE34DE8BAF1722A7
C:\Windows\System32\drivers\arcsas.sys 07CA323EF2E8247A568AB0F3662AD644
C:\Windows\system32\DRIVERS\asyncmac.sys 74DBAEC35366C4EE7670428808715A6A
C:\Windows\System32\drivers\atapi.sys A721FF570C2387E383BDDEA9632863C9
C:\Windows\system32\DRIVERS\btath_flt.sys AFF895D6FFA43B058ABFF27964083BBC
C:\Windows\system32\DRIVERS\athw8x.sys 221F28472FB210E2D4A7B4488BC798F9
C:\Windows\system32\drivers\AtihdW86.sys 87DAD8D354E312DB16636DC71EB39E5E
C:\Windows\System32\DRIVERS\avgntflt.sys 0D5C96FD25D6455D97A5C4D7706DFAB1
C:\Windows\system32\DRIVERS\avipbb.sys E26B3C8E9C3DDE047B32C5719955D715
C:\Windows\system32\DRIVERS\avkmgr.sys 490FA25161BF3E51993EB724ECF0ACEB
C:\Windows\System32\drivers\bxvbda.sys 87AB5BB072A3F128541D5B815F82FFDD
C:\Windows\System32\drivers\BasicDisplay.sys 81703BC5D68DEDBB086C2368FBE7B334
C:\Windows\System32\drivers\BasicRender.sys 5EC68164E14D25675C98BBB5F09E8606
C:\Windows\System32\Drivers\Beep.sys 9E7AEA59776D904607985AFFE7E5E183
C:\Windows\System32\DRIVERS\bowser.sys B17AC10B47C7FCB44D22A1F06415840E
C:\Windows\system32\drivers\btath_a2dp.sys 71EAE55AB4E8195E254C34DC2E13A15F
C:\Windows\system32\drivers\btath_avdt.sys 86F9298BD580818EDFE84306F2681F3F
C:\Windows\System32\drivers\btath_bus.sys D5418AF1B9AC86D89C045026EFBD5FB7
C:\Windows\System32\drivers\btath_hcrp.sys DDA454A4D6F88C91ED931E7C7C524015
C:\Windows\system32\DRIVERS\btath_hid.sys BE7BB6D1353E0434317C037C7DA9CD25
C:\Windows\system32\DRIVERS\btath_lwflt.sys 785C38070043BEEE9E9D591DE4067244
C:\Windows\System32\drivers\btath_rcp.sys 9B58A32D0C39910361225995FA546776
C:\Windows\system32\DRIVERS\btfilter.sys 7E82C4E6D383B81522EE57F1916D8BDA
C:\Windows\System32\drivers\BthAvrcpTg.sys 6695200F455E251F0BCC9CE4D0978D59
C:\Windows\System32\drivers\BthEnum.sys A8B20D852B07AE19A13B5D47EC4E4C3B
C:\Windows\System32\drivers\bthhfenum.sys 616EB8748C988AEE98D93DA141C3D3B4
C:\Windows\System32\drivers\BthHFHid.sys DCB4EBD928A6FB368BE6CAE522412DE1
C:\Windows\system32\DRIVERS\BthLEEnum.sys 42201C346F0B8C458E1E9CDE04D68A2C
C:\Windows\System32\drivers\bthmodem.sys 033916CE8784A848B9A3D686B7F66D97
C:\Windows\system32\DRIVERS\bthpan.sys 091BB978E9504D0AD14586929431A957
C:\Windows\System32\Drivers\BTHport.sys 13795CAA34239D97A7211E7F9D96E012
C:\Windows\System32\Drivers\BTHUSB.sys 1F715957F5236D30B6020A19A4271F6A
C:\Windows\System32\DRIVERS\cdfs.sys 990B1BABE6E81FB18E65A87EBEFB1772
C:\Windows\System32\drivers\cdrom.sys 339BFF85D788268752DA8C9644B188EE
C:\Windows\System32\drivers\circlass.sys F64B7D1A37CC1D5F421D5359EEC81E2E
C:\Windows\System32\drivers\CLFS.sys 9905168708DB68849B879B5548F68AB3
C:\Windows\system32\DRIVERS\CLVirtualDrive.sys 075CCE75090786F124573A788C8656E6
C:\Windows\System32\drivers\CmBatt.sys 2DC8538A2260647484A6C921CA837313
C:\Windows\System32\Drivers\cng.sys E708BFF0473EC6B271EA46B65B16CA56
C:\Windows\System32\drivers\CompositeBus.sys 0E5B1E9E7122EDAAF1F6CE047965CA92
C:\Windows\System32\drivers\condrv.sys D9CB0782AF819548072AA45B70F8B22D
C:\Windows\System32\drivers\dam.sys C4D01BD86D6B207275FC143EEA951D75
C:\Windows\System32\Drivers\dfsc.sys 09D9EB9E7898F8E6561473A20CC808B9
C:\Windows\system32\DRIVERS\ssudbus.sys 0B3F6C8F93C5C25977EA5A8B2E656357
C:\Windows\System32\drivers\discache.sys 3C736FAE17BA6F91BA37594AAB139CD0
C:\Windows\System32\drivers\disk.sys 560495FF4CA22E1D9B1972FA18F43B6F
C:\Windows\System32\drivers\dmvsc.sys 82A7C72593793FE1EADA7A305BD1567A
C:\Windows\system32\drivers\drmkaud.sys 9C7C183F937951AE17C5B8B3259CF3FF
C:\Windows\System32\drivers\dxgkrnl.sys 6D1B8A9A2C0BD4851D8AF1AB43E67AD9
C:\Windows\System32\drivers\evbda.sys 5AB97B3282D7D6114949D1EB5C8598E4
C:\Windows\System32\drivers\EhStorClass.sys 66D60BD9A4C05616ABECA2A901475098
C:\Windows\System32\drivers\EhStorTcgDrv.sys A61D0F543024E458C0FE32352E1978E2
C:\Windows\System32\drivers\errdev.sys D790D058D67582DB9C84C2D33695FE6B
C:\Windows\System32\Drivers\exfat.sys 7A4D6FEB8C52B3FE855E4DCDF9107E03
C:\Windows\System32\Drivers\fastfat.sys 60996602A7111FD2D086E803F33E4282
C:\Windows\System32\drivers\fdc.sys 73B2D11DF0B6E03A0CB0323218ACB3E4
C:\Windows\System32\drivers\fileinfo.sys 88A9EBACD1058ABB237A6B4E96E7F397
C:\Windows\System32\drivers\filetrace.sys 9E4EE3A0B00FF7D5F42A4AF9744CBA02
C:\Windows\System32\drivers\flpydisk.sys B1D4C168FF7B8579E3745888658FFB1D
C:\Windows\System32\drivers\fltmgr.sys B33EC133AE4E6C1881D2302D93D2467D
C:\Windows\System32\drivers\FsDepends.sys A5F7873A39E4E9FAAAE59B7E9E36B705
C:\Windows\System32\Drivers\Fs_Rec.sys A6DD7D491F587F4BC13FB972977DC8E8
C:\Windows\System32\DRIVERS\fvevol.sys FA228F4BB10DC7ED7E7D131C034E2331
C:\Windows\System32\drivers\fxppm.sys A969D92973DFA895E7776B4BFE36DBB2
C:\Windows\System32\drivers\gagp30kx.sys 52BC441E07A827EBAB70CDC7EAEDB28D
C:\Windows\System32\drivers\vmgencounter.sys 721F8EEF5E9747F32670DEFF7FB92541
C:\Windows\System32\Drivers\msgpioclx.sys CA18ECFCFFDD638ECE80799A9056B238
C:\Windows\system32\drivers\HdAudio.sys C2504AA983B5D411F7D31402E8B57725
C:\Windows\System32\drivers\HDAudBus.sys 7D87B5B6C7188D553E11B59DC7F0B111
C:\Windows\System32\drivers\HidBatt.sys 3F76BBA53D65E85A7F53E7A71082082C
C:\Windows\System32\drivers\hidbth.sys 085F150D002B7F0153D3C06DDF33A143
C:\Windows\System32\drivers\hidi2c.sys CC4A07E51D89575CAB6F4EB590D87CD4
C:\Windows\System32\drivers\hidir.sys DC96F7DACB777CDEAEF9958A50BFDA06
C:\Windows\System32\drivers\hidusb.sys 9E11EE0F2E117B2D5A835B2B91752827
C:\Windows\System32\drivers\HpSAMD.sys 64DB7A8D97CA53DCCF93D0A1E08342CF
C:\Windows\System32\drivers\HTTP.sys F4A91D985EB9D1D2717D538F3424603C
C:\Windows\System32\drivers\hwpolicy.sys 2A98301068801700906C06649860FE94
C:\Windows\System32\drivers\hyperkbd.sys DC76901D82097C9E297F20C287CB9A27
C:\Windows\system32\DRIVERS\HyperVideo.sys 716413AB3CA12DE0A7222D28C1C9352C
C:\Windows\System32\drivers\i8042prt.sys C9E9CBF73AFFBFE3E801EFB516787BA3
C:\Windows\System32\drivers\iaStorV.sys 5E394EBD26FD68AA9300332C46BEDD62
C:\Windows\System32\drivers\iirsp.sys 24847A06B84339FEEDE5CABF3D27D320
C:\Windows\system32\drivers\RTKVHD64.sys 5C20DBF6A00AF50C7CB74DB233E03AF0
C:\Windows\System32\drivers\intelide.sys 4F37726CF764CA18A8A84F85EF3A7F24
C:\Windows\System32\drivers\intelppm.sys E15CDF68DD73423F15D4AC404793AF0D
C:\Windows\System32\DRIVERS\ipfltdrv.sys 8FCA66234A0933D796BB780B7953BAB9
C:\Windows\System32\drivers\IPMIDrv.sys 6E98A046A12AA113F8898AA5D612BD6E
C:\Windows\System32\drivers\ipnat.sys 3969B9C218DD3FAA9F4ED2FFC3651C02
C:\Windows\System32\drivers\irenum.sys 25CD7C4BB2863FFC2B0B311F0AEBF77C
C:\Windows\System32\drivers\isapnp.sys D940C5BB9DC92E588533C19ABCC3D2C2
C:\Windows\System32\drivers\msiscsi.sys 69C8BF0BC2B0EA10F130F4D3104DC2EF
C:\Windows\System32\drivers\kbdclass.sys 8FBD94B69D6423E20ABCD59D86368B21
C:\Windows\System32\drivers\kbdhid.sys E88C932ABDF8185A62C8F2FC7B051FB6
C:\Windows\system32\DRIVERS\kdnic.sys FB6C185092E18011EF49989425C2AA87
C:\Windows\System32\Drivers\ksecdd.sys DFA480F6DED551464F3A5B959F437800
C:\Windows\System32\Drivers\ksecpkg.sys 127FB0AAD232BAAD2C9BBACD374F4FC5
C:\Windows\system32\drivers\ksthunk.sys 81492FEEBF2F26455B00EE8DBAE8A1B0
C:\Windows\system32\DRIVERS\lltdio.sys CEEFD29FC551F289810B0B9381B321DC
C:\Windows\System32\drivers\lsi_sas.sys 022CDD12161B063D7852B1075BF3FFF2
C:\Windows\System32\drivers\lsi_sas2.sys 07AD59D669B996F29F91817F0ECFA34F
C:\Windows\System32\drivers\lsi_scsi.sys 216FB796AA4E252ACCE93B1BCB80B5EC
C:\Windows\System32\drivers\lsi_sss.sys 5E80530AF37102488EE980B4A92AF99F
C:\Windows\system32\drivers\luafv.sys 2BDC5D711FA61307CE6190D47C956368
C:\windows\system32\drivers\mbam.sys 0BB97D43299910CBFBA59C461B99B910
C:\windows\system32\drivers\mbam.sys 0BB97D43299910CBFBA59C461B99B910
C:\Windows\System32\drivers\megasas.sys 9B0D829C3BE4E7472DB9DD2B79908E3C
C:\Windows\System32\drivers\MegaSR.sys ECC3F54C7AFC318271C4F0B4606D8DB0
C:\Windows\System32\drivers\modem.sys 780098AD5DA8A4822E2563984C85EF7B
C:\Windows\System32\drivers\monitor.sys EA8EAD3F5B762F889CC7F3966625B48B
C:\Windows\System32\drivers\mouclass.sys 618446B98C79776654340CE27C73485E
C:\Windows\System32\drivers\mouhid.sys C0ADEBED913295803B579ED288936CBB
C:\Windows\System32\drivers\mountmgr.sys 89D263DBF08119CE16273991C120D6DD
C:\Windows\System32\drivers\mpsdrv.sys 0D1609DD82C7440F5D5BF21A9D4D5C0C
C:\Windows\system32\drivers\mrxdav.sys 3D70147F55F1EC84EB9139ED7FFE48BC
C:\Windows\System32\DRIVERS\mrxsmb.sys 93179D48066918323628CB016D8C94DC
C:\Windows\System32\DRIVERS\mrxsmb10.sys 06D5F2FA3C61E8EA91648EA8E9F99FD3
C:\Windows\System32\DRIVERS\mrxsmb20.sys 5C7DD2E5759FFCCD2C7341C1B90F2B26
C:\Windows\system32\DRIVERS\bridge.sys 98487487D6B3797CA927E9D7B030AE13
C:\Windows\System32\Drivers\Msfs.sys 3886F1F2A4D2900ABAA7E4486BEEE6A2
C:\Windows\System32\drivers\msgpiowin32.sys C32A7A39B960A42BA9D4FBE47213CA03
C:\Windows\System32\drivers\mshidkmdf.sys D3857A767B91A061B408CCAB02DA4F40
C:\Windows\System32\drivers\mshidumdf.sys 839B48910FB1E887635C48F3EC11A05E
C:\Windows\System32\drivers\msisadrv.sys 55C0DB741E3AB7463242B185B1C2997C
C:\Windows\system32\drivers\MSKSSRV.sys 509809566E49F4411055864EA8D437CD
C:\Windows\system32\DRIVERS\mslldp.sys 63145201D6458E4958E572E7D6FC2604
C:\Windows\system32\drivers\MSPCLOCK.sys 99D526E803DB6D7FF290FD98B6204641
C:\Windows\system32\drivers\MSPQM.sys 06FA77C3E2A491ADCD704C5E73006269
C:\Windows\System32\Drivers\MsRPC.sys E134EC4DE11CF78CB01432D180710D84
C:\Windows\System32\drivers\mssmbios.sys B5AECF12F09DEE97C9FCAA5BA016CE1E
C:\Windows\system32\drivers\MSTEE.sys 72D66A05E0F99F2528F6C6204FD22AA1
C:\Windows\System32\drivers\MTConfig.sys 8AAAE399FC255FA105D4158CBA289001
C:\Windows\System32\Drivers\mup.sys 3BCB702F3E6CC622DCAFCAA45D7CDE0A
C:\Windows\System32\drivers\mvumis.sys 3A1E095277BBD406CEA8EA6B76950664
C:\Windows\system32\DRIVERS\nwifi.sys 43D7388A90A4C6EA346A4D6FF0377479
C:\Windows\System32\drivers\ndis.sys A10E176F3B2BF83EDE7B5C4658C93B66
C:\Windows\system32\DRIVERS\ndiscap.sys 39C8A1D9D46F5E83A016BCAB72455284
C:\Windows\system32\DRIVERS\NdisImPlatform.sys 762941932B7E4C588E48A577BA9D6440
C:\Windows\system32\DRIVERS\ndistapi.sys 7A6F8A6D0E01432EBA294EF29CDD0FA7
C:\Windows\system32\DRIVERS\ndisuio.sys 79AB68BB3FFF974AD4F41FA559F4EC67
C:\Windows\system32\DRIVERS\ndiswan.sys 62C7DBF4F9301F76CF87D4B9D8F57BF8
C:\Windows\system32\DRIVERS\ndiswan.sys 62C7DBF4F9301F76CF87D4B9D8F57BF8
C:\Windows\System32\Drivers\NDProxy.sys 3730942D7DB2F8BB5F84542B7FF6F650
C:\Windows\System32\drivers\Ndu.sys D3F60A4345FCA9C1BE68AD7D0D6DE770
C:\Windows\System32\DRIVERS\netbios.sys 7C203A76394F9AE68F69EEE5F9612C4A
C:\Windows\System32\DRIVERS\netbt.sys 7CEC25C682D319D484630B3952C31A11
C:\Windows\System32\drivers\nfrd960.sys 12DD2800E4EEA37DC9AE256AD62423B4
C:\Windows\System32\Drivers\Npfs.sys 17E19A742FB30C002F8B43575451DBE1
C:\Windows\System32\drivers\npsvctrig.sys 8ED299C30792544264E558BEA79F0947
C:\Windows\System32\drivers\nsiproxy.sys 689B3B1E95C70ABF7AFF29F9406EF1E0
C:\Windows\System32\Drivers\Ntfs.sys 76929F4A69E425911A63B407E26C2589
C:\Windows\System32\Drivers\Null.sys 4163ADE07DB51843AE31F65B94F5398D
C:\Windows\system32\DRIVERS\nvlddmkm.sys F648FE6BCE0AAD9E5EA63C8BE9AD90E3
C:\Windows\System32\drivers\nvraid.sys D6D34118263412D3AAA8348A9572B7F2
C:\Windows\System32\drivers\nvstor.sys 27AFC428D1D32ABD04A86763A4EDDEA9
C:\Windows\System32\drivers\nv_agp.sys 051CFB5107BAAE510419BDC41F8C4036
C:\Windows\System32\drivers\parport.sys 4563DAF8C6A740AD7F501E219BD10766
C:\Windows\System32\drivers\partmgr.sys D6ACCF9F2EEEEA711C14EFD976E573F3
C:\Windows\System32\drivers\pci.sys 4A003E8F718C1E6A2050CA98CD53E3E2
C:\Windows\System32\drivers\pciide.sys F9908D274D458220F91E89B54D78D837
C:\Windows\System32\drivers\pcmcia.sys 84D19CB6102627932DCB5DFDF89FE269
C:\Windows\System32\drivers\pcw.sys CEBBAD5391C2644560C55628A40BFD27
C:\Windows\System32\drivers\pdc.sys 0698DEDEAD6A00AD0D468C687D830FBF
C:\Windows\System32\drivers\peauth.sys 61FE70659CD43E07F94DA4DC31DEC493
C:\Windows\system32\DRIVERS\raspptp.sys 362D47E5B4D67270DE4B8606036F4ADD
C:\Windows\System32\drivers\processr.sys DD979EB6A7212F60E4AFBE96EDC7AE6D
C:\Windows\system32\DRIVERS\pacer.sys EB8034147D4820CD31BFCB11A2A652DF
C:\Windows\system32\drivers\qwavedrv.sys 13D47BB0CCA2FC51BD15F8E85C6A078E
C:\Windows\System32\drivers\RadioHIDMini.sys 194ED3C117525613E701FF257882303E
C:\Windows\System32\DRIVERS\rasacd.sys 873C60F8178100557740A832FCE10B5F
C:\Windows\system32\DRIVERS\AgileVpn.sys 69B93F623B130976243ECA3D84CC99CA
C:\Windows\system32\DRIVERS\rasl2tp.sys A14D625C5AEE5FFE0F47D1A1D419FAAE
C:\Windows\system32\DRIVERS\raspppoe.sys 00695B9C2DB6111064499C529E90C042
C:\Windows\system32\DRIVERS\rassstp.sys A7F24D8CD1956B0A1FDCB86CC5114DE4
C:\Windows\System32\DRIVERS\rdbss.sys CA03D642ACE58E1BA54E4B383F91CD69
C:\Windows\System32\drivers\rdpbus.sys CA7DF5EC95D8DE0DD24BE7FF97369F68
C:\Windows\System32\drivers\rdpdr.sys B2A3AD74FF2E2FFA73AF2567108231B3
C:\Windows\System32\drivers\rdpvideominiport.sys 57F4787E4602A3FCA719C0A33137C6DA
C:\Windows\System32\Drivers\RDPWD.sys B3CB0721E81E30419CE7D837EF4EA151
C:\Windows\System32\drivers\rdyboost.sys 62C1F8A0685FE07E998AA296C4F697C4
C:\Windows\System32\drivers\rfcomm.sys CCBFCABDFE2BC22F0645CEAADDB36004
C:\Windows\system32\DRIVERS\rspndr.sys E04E770DD198B9399640717145E79EBF
C:\Windows\System32\Drivers\RtsUVStor.sys 8EB6DCEB7473C232D8BC9A886E3183AC
C:\Windows\system32\DRIVERS\Rt630x64.sys 34DA0D14F5C3F1883A331AFB975AB434
C:\Windows\System32\drivers\vms3cap.sys 752EC7DCD2F96871A3857EEE6AFE965A
C:\Windows\System32\drivers\sbp2port.sys 9C7B28CE0D136DB226E24DB3BC817F92
C:\Windows\System32\DRIVERS\scfilter.sys 5D7733A12756B267FCA021672B26BC9E
C:\Windows\System32\drivers\sdbus.sys 98636FB2973B8876A7F0BECD076CF109
C:\Windows\System32\drivers\sdstor.sys BB107AA9980B0DA4E19A3A90C3BD4460
C:\Windows\System32\Drivers\secdrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\SerCx.sys 87C46B239A7EEF30FDFDD5E9BD46130C
C:\Windows\System32\drivers\serenum.sys 7A1F9347C85FD55E39B8A76B3A25C5AD
C:\Windows\System32\drivers\serial.sys F640A0A218BBF857F1D04A15D7D939F6
C:\Windows\System32\drivers\sermouse.sys F1A5F56B2620B862CC28FF96A0A6DAAB
C:\Windows\System32\drivers\sfloppy.sys 7EE65419B29302C795714FF8073969A1
C:\Windows\System32\drivers\SiSRaid2.sys 2560721D6F16D5B611C36A3A9D28C1B2
C:\Windows\System32\drivers\sisraid4.sys 3AA8FDE1DBF65BB8B88B053529554A0D
C:\Windows\System32\drivers\spaceport.sys FD3AF5575B99871BADB94E7699DBCE08
C:\Windows\System32\drivers\SpbCx.sys 3D8679C8DF52EB26EB7583A4E0A29202
C:\Windows\System32\DRIVERS\srv.sys 0F1FCD575A03ABDE13FCA9D0ADE4DDA6
C:\Windows\System32\DRIVERS\srv2.sys 56218A571ECF8D55E0CDFF8DF2546CF1
C:\Windows\System32\DRIVERS\srvnet.sys 14FC338B80CFF7E04215133B568D15C4
C:\windows\system32\Drivers\SSPORT.sys 0211AB46B73A2623B86C1CFCB30579AB
C:\windows\system32\Drivers\SSPORT.sys 0211AB46B73A2623B86C1CFCB30579AB
C:\Windows\system32\DRIVERS\ssudmdm.sys EA8F41484CCC5BA6A1455C2AD3D1BE3C
C:\Windows\System32\drivers\stexstor.sys 4E85355B94CFCB67C135F6521A4895A7
C:\Windows\System32\drivers\storahci.sys B240874B2CA0CD02E8CD11E140B14C57
C:\Windows\System32\DRIVERS\vmstorfl.sys F74DBC95A57B1EE866D3732EB5F79BE2
C:\Windows\System32\drivers\storvsc.sys 543CD3CC0E05B8D8815E0D4F040B6F59
C:\Windows\System32\drivers\swenum.sys 4AFD66AAE74FFB5986BC240744DC5FC9
C:\Windows\system32\DRIVERS\SynTP.sys D068E3E8AA9951D1E051E20300260E7B
C:\Windows\System32\drivers\tcpip.sys 1794C43A000A47D92B3304FC1E3E512A
C:\Windows\system32\DRIVERS\tcpip.sys 1794C43A000A47D92B3304FC1E3E512A
C:\Windows\System32\drivers\tcpipreg.sys 8F2A13A5DF99D72FDDE87F502A66F989
C:\Windows\system32\DRIVERS\tdx.sys 73DC722CE5DF26D7638CE2446F2655C7
C:\Windows\System32\drivers\terminpt.sys F7C8AB5D8AFFAA318D6A21093D139BF4
C:\Windows\system32\drivers\tpm.sys 6F0BFF80EE2A5BC841286A51F893CBAD
C:\Windows\System32\drivers\tsusbflt.sys 4E7C5FB10A50435523DE0CAA37DE2BD3
C:\Windows\System32\drivers\TsUsbGD.sys 16D684A820872EE54F6370703AC0B513
C:\Windows\system32\DRIVERS\tunnel.sys 78C9EE193AC2B4CBDBC48B620314D740
C:\Windows\System32\drivers\uagp35.sys 6D4F67CA56ACA2085DFA2CD89EAFBC1A
C:\Windows\System32\drivers\uaspstor.sys 6FD6D03B7752C78712E5CFF29A305026
C:\Windows\System32\drivers\ucx01000.sys 4834158B8D06A153FADAB6B85320FBBE
C:\Windows\System32\DRIVERS\udfs.sys DC5A461591C71AF7F19DC048A81E3F88
C:\Windows\System32\drivers\uliagpkx.sys 07FEBCDF24FABA0D47B635D85A0FFB7A
C:\Windows\System32\drivers\umbus.sys 02CEB3FE6152668A7BA420B93B664860
C:\Windows\System32\drivers\umpass.sys 991EE6B5FC41EAEF99C8AF5B92F2CA09
C:\Windows\System32\drivers\usbccgp.sys 2AF9F0E16D75B8F783A1ACE74EF51C9B
C:\Windows\System32\drivers\usbcir.sys B395B62B62F28106218FA6FB17F4C797
C:\Windows\System32\drivers\usbehci.sys 52F267AEE8CA5AA5CEB88C6A71EE1E86
C:\Windows\system32\DRIVERS\usbfilter.sys 4875DC63E548812C75D4FDEF84970C89
C:\Windows\System32\drivers\usbhub.sys ADBF89B8E0BB372FEFE2E4B84E1E20AE
C:\Windows\System32\drivers\UsbHub3.sys EA040D4C6C94F315A85F3D0EAA884B37
C:\Windows\System32\drivers\usbohci.sys 325F6179009B5A7F6118951A5BA422AB
C:\Windows\System32\drivers\usbprint.sys BA3ABE0CD1C14B3295BAD0F076B84CAC
C:\Windows\System32\drivers\USBSTOR.SYS F77177F6C95B2116EE7AD23B5EF57007
C:\Windows\System32\drivers\usbuhci.sys D25EF4A6EC244C5DE85D88A05B7C149D
C:\Windows\System32\Drivers\usbvideo.sys 09799E701B4327097E9F63D3FE221083
C:\Windows\System32\drivers\USBXHCI.SYS 1ADCF0A490C2845637B334626669CD6F
C:\Windows\System32\drivers\vdrvroot.sys BACECBFF9C97F7627A60B0E0F1FE7EE8
C:\Windows\System32\drivers\VerifierExt.sys 74FA2D4368DE6F6CE14393EDF1F342BE
C:\Windows\System32\drivers\vhdmp.sys 500BE6B2E49883720D0AE8BB859ED7A3
C:\Windows\System32\drivers\viaide.sys F5B4A14B00E89250C50982AC762DDD1D
C:\Windows\System32\drivers\vmbus.sys 78DB50F7329F6D1311658DABFFFC8BE0
C:\Windows\System32\drivers\VMBusHID.sys ECFEE2F2BA3932C7880D1A8F67D68F91
C:\Windows\System32\drivers\volmgr.sys CB60FAAED8B49B812EBBF77EB87D9B18
C:\Windows\System32\drivers\volmgrx.sys A74101DA9809251BCD0E5A26BAE0F824
C:\Windows\System32\drivers\volsnap.sys 78A5BBA3819FFFC62FFEC3E2220D102D
C:\Windows\System32\drivers\vpci.sys A8DA1C1B52ECEA3726DEBED4FF1B700D
C:\Windows\System32\drivers\vsmraid.sys 38A60CD9C009C55C6D3B5586F8E6A353
C:\Windows\System32\drivers\vstxraid.sys A0F6FE0FC2F647C22BBFD6BD4249DBCC
C:\Windows\System32\drivers\vwifibus.sys 62460A45435A26A334907E3F2EA45611
C:\Windows\system32\DRIVERS\vwififlt.sys 095E943D27025E4D588AF0A72CC2318F
C:\Windows\system32\DRIVERS\vwifimp.sys 73FA1A41A97A5C34ADC03B3577FF1A86
C:\Windows\System32\drivers\wacompen.sys 6B806E893714019969E2B50D7EF6A4D9
C:\Windows\system32\DRIVERS\wanarp.sys 61F6972FF9AC9A8D0B4D62076DC30051
C:\Windows\system32\DRIVERS\wanarp.sys 61F6972FF9AC9A8D0B4D62076DC30051
C:\Windows\System32\drivers\wd.sys B3A4D918DAB90505B6BC7B70632913CB
C:\Windows\system32\drivers\WdBoot.sys FD47DF026B32969B8A68721A0243E8EE
C:\Windows\System32\drivers\Wdf01000.sys 2ADC985B85A71BD7D99712EC0C24358B
C:\Windows\system32\drivers\WdFilter.sys 5F425D842DD6ADE9F95A51A0616AFAD7
C:\Windows\System32\DRIVERS\wfplwfs.sys FE762D3498719C3A23471BBA62F747B4
C:\Windows\System32\drivers\wimmount.sys A3C7624A42A3447EF5EDD1ED37FE4E60
C:\Windows\system32\DRIVERS\WinUsb.sys BB20956C424531003F7FA6CD36F11D5D
C:\Windows\System32\drivers\wmiacpi.sys E2A596CACFC6504306CDB7B593B90084
C:\Windows\System32\DRIVERS\wpcfltr.sys C6FF953D5D6F2EAE3B8883474D5076B3
C:\Windows\System32\drivers\WpdUpFltr.sys 0346CAFC181C91C6E2330332EB332ED6
C:\Windows\system32\drivers\ws2ifsl.sys BC8B5CB336E63BB25EAD1CE8EDD34B81
C:\Windows\System32\drivers\WSDPrint.sys 74EFDA0526862C3D8D01A776182798EA
C:\Windows\System32\drivers\WudfPf.sys AB886378EEB55C6C75B4F2D14B6C869F
C:\Windows\System32\drivers\WUDFRd.sys DDA4CAF29D8C0A297F886BFE561E6659
C:\Windows\system32\DRIVERS\WUDFRd.sys DDA4CAF29D8C0A297F886BFE561E6659
C:\Windows\system32\DRIVERS\WUDFRd.sys DDA4CAF29D8C0A297F886BFE561E6659
C:\Windows\system32\DRIVERS\WUDFRd.sys DDA4CAF29D8C0A297F886BFE561E6659
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-09-19 10:07 - 2013-09-19 10:07 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-10 22:34 - 2013-09-10 22:34 - 00002029 _____ C:\Users\Public\Desktop\Adobe Reader X.lnk
2013-09-10 11:55 - 2013-09-10 11:55 - 97004533 _____ C:\Windows\SysWOW64\᯾瞈⒨Å߿
2013-09-08 09:33 - 2013-09-08 09:33 - 00000000 ____D C:\Users\Tizi\AppData\Roaming\CyberLink
2013-09-08 09:33 - 2013-09-08 09:33 - 00000000 ____D C:\Users\Public\Documents\CyberLink
2013-09-08 09:33 - 2013-09-08 09:33 - 00000000 ____D C:\Users\Public\CyberLink
==================== One Month Modified Files and Folders =======
2013-10-07 05:13 - 2013-07-02 10:32 - 00000000 ____D C:\Users\Tizi\AppData\Roaming\Skype
2013-10-07 05:11 - 2012-07-25 23:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-07 05:06 - 2012-07-25 21:26 - 00262144 ___SH C:\Windows\System32\config\BBI
2013-10-07 05:04 - 2012-09-03 17:12 - 00780976 _____ C:\Windows\System32\perfh010.dat
2013-10-07 05:04 - 2012-09-03 17:12 - 00152608 _____ C:\Windows\System32\perfc010.dat
2013-10-07 05:04 - 2012-07-25 23:28 - 01781840 _____ C:\Windows\System32\PerfStringBackup.INI
2013-10-07 05:03 - 2012-09-03 02:18 - 00000000 ____D C:\ProgramData\WinClon
2013-10-07 04:52 - 2012-07-25 23:21 - 00029318 _____ C:\Windows\setupact.log
2013-10-07 04:51 - 2012-07-26 00:12 - 00000000 ____D C:\Windows\System32\sru
2013-10-07 04:50 - 2013-07-30 14:15 - 00323072 ___SH C:\Users\Tizi\Desktop\Thumbs.db
2013-10-07 04:50 - 2013-06-29 13:40 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-10-07 00:37 - 2013-06-29 14:37 - 00000978 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-10-07 00:19 - 2012-09-03 02:31 - 00000360 _____ C:\Windows\Tasks\Xerox PhotoCafe Communicator.job
2013-10-01 07:20 - 2013-06-30 05:25 - 00000072 _____ C:\Users\Public\LMDebug.log
2013-09-23 23:28 - 2013-07-02 10:31 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-09-22 11:29 - 2013-08-27 14:02 - 00000000 ____D C:\Program Files (x86)\Kabel BW
2013-09-19 10:07 - 2013-09-19 10:07 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-19 09:09 - 2013-04-07 12:52 - 00003600 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1161549151-3905956725-2365256691-1001
2013-09-14 23:35 - 2013-07-23 12:42 - 00000000 ____D C:\Users\Tizi\Desktop\Burda
2013-09-11 07:55 - 2013-08-03 01:05 - 00000000 ____D C:\Users\Tizi\Documents\Henrik
2013-09-11 03:51 - 2012-07-26 00:12 - 00000000 ____D C:\Windows\rescache
2013-09-10 22:34 - 2013-09-10 22:34 - 00002029 _____ C:\Users\Public\Desktop\Adobe Reader X.lnk
2013-09-10 22:22 - 2012-08-05 13:07 - 00787484 _____ C:\Windows\PFRO.log
2013-09-10 11:55 - 2013-09-10 11:55 - 97004533 _____ C:\Windows\SysWOW64\᯾瞈⒨Å߿
2013-09-10 09:53 - 2012-09-03 01:16 - 01454261 _____ C:\Windows\WindowsUpdate.log
2013-09-10 09:38 - 2013-06-29 14:37 - 00003866 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-09-08 09:33 - 2013-09-08 09:33 - 00000000 ____D C:\Users\Tizi\AppData\Roaming\CyberLink
2013-09-08 09:33 - 2013-09-08 09:33 - 00000000 ____D C:\Users\Public\Documents\CyberLink
2013-09-08 09:33 - 2013-09-08 09:33 - 00000000 ____D C:\Users\Public\CyberLink
2013-09-08 09:33 - 2012-09-03 02:27 - 00000000 ____D C:\ProgramData\CyberLink
Files to move or delete:
====================
C:\ProgramData\MakeMarkerFile.exe
==================== Known DLLs (Whitelisted) ================
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== EXE ASSOCIATION =====================
HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK
==================== Restore Points =========================
Restore point made on: 2013-09-11 03:46:11
Restore point made on: 2013-09-13 22:44:46
Restore point made on: 2013-09-13 22:44:58
Restore point made on: 2013-09-13 22:45:10
Restore point made on: 2013-09-13 22:46:42
Restore point made on: 2013-09-13 22:46:55
Restore point made on: 2013-09-13 22:47:13
Restore point made on: 2013-09-13 22:47:27
Restore point made on: 2013-09-20 00:13:21
Restore point made on: 2013-09-22 01:39:49
Restore point made on: 2013-09-22 01:40:08
Restore point made on: 2013-09-22 01:40:34
Restore point made on: 2013-09-22 01:44:19
Restore point made on: 2013-09-22 01:44:38
Restore point made on: 2013-09-22 01:45:04
Restore point made on: 2013-09-22 01:45:20
Restore point made on: 2013-09-29 05:40:22
Restore point made on: 2013-09-29 05:41:45
Restore point made on: 2013-09-29 05:42:01
Restore point made on: 2013-09-29 05:42:15
Restore point made on: 2013-09-29 05:44:08
Restore point made on: 2013-09-29 05:44:23
Restore point made on: 2013-09-29 11:34:23
Restore point made on: 2013-09-29 11:35:03
==================== BCD ================================
Firmware Boot Manager
---------------------
identifier {fwbootmgr}
displayorder {d83a5819-ff67-11e1-be84-806e6f6e6963}
{3960cf29-2fa6-11e3-a45d-806e6f6e6963}
{bootmgr}
{d83a581a-ff67-11e1-be84-806e6f6e6963}
{d83a581b-ff67-11e1-be84-806e6f6e6963}
timeout 1
Windows Boot Manager
--------------------
identifier {bootmgr}
description Windows Boot Manager
locale it-IT
inherit {globalsettings}
default {default}
resumeobject {f200729e-f62f-11e1-8d13-dc0ea1bce007}
displayorder {default}
toolsdisplayorder {memdiag}
timeout 30
Firmware Application (101fffff)
-------------------------------
identifier {3960cf29-2fa6-11e3-a45d-806e6f6e6963}
device partition=D:
description UEFI: USB 2.0 Flash Disk 5.00
Firmware Application (101fffff)
-------------------------------
identifier {d83a5819-ff67-11e1-be84-806e6f6e6963}
device partition=\Device\HarddiskVolume2
path \EFI\Microsoft\Boot\bootmgfw.efi
description Windows Boot Manager
Firmware Application (101fffff)
-------------------------------
identifier {d83a581a-ff67-11e1-be84-806e6f6e6963}
description UEFI: IP4 Realtek PCIe GBE Family Controller
Firmware Application (101fffff)
-------------------------------
identifier {d83a581b-ff67-11e1-be84-806e6f6e6963}
description UEFI: IP6 Realtek PCIe GBE Family Controller
Windows Boot Loader
-------------------
identifier {default}
device partition=C:
path \windows\system32\winload.efi
description Windows 8
locale it-IT
inherit {bootloadersettings}
recoverysequence {current}
recoveryenabled Yes
isolatedcontext Yes
allowedinmemorysettings 0x15000075
osdevice partition=C:
systemroot \windows
resumeobject {f200729e-f62f-11e1-8d13-dc0ea1bce007}
nx OptIn
bootmenupolicy Standard
Windows Boot Loader
-------------------
identifier {current}
device ramdisk=[\Device\HarddiskVolume1]\Recovery\WindowsRE\Winre.wim,{f20072a3-f62f-11e1-8d13-dc0ea1bce007}
path \windows\system32\winload.efi
description Windows Recovery Environment
locale en-gb
inherit {bootloadersettings}
displaymessage Recovery
osdevice ramdisk=[\Device\HarddiskVolume1]\Recovery\WindowsRE\Winre.wim,{f20072a3-f62f-11e1-8d13-dc0ea1bce007}
systemroot \windows
nx OptIn
bootmenupolicy Standard
winpe Yes
Resume from Hibernate
---------------------
identifier {f200729e-f62f-11e1-8d13-dc0ea1bce007}
device partition=C:
path \windows\system32\winresume.efi
description Windows Resume Application
locale it-IT
inherit {resumeloadersettings}
recoverysequence {current}
recoveryenabled Yes
isolatedcontext Yes
allowedinmemorysettings 0x15000075
filedevice partition=C:
filepath \hiberfil.sys
bootmenupolicy Standard
debugoptionenabled No
Windows Memory Tester
---------------------
identifier {memdiag}
device partition=\Device\HarddiskVolume2
path \EFI\Microsoft\Boot\memtest.efi
description Windows Memory Diagnostic
locale it-IT
inherit {globalsettings}
badmemoryaccess Yes
EMS Settings
------------
identifier {emssettings}
bootems No
Debugger Settings
-----------------
identifier {dbgsettings}
debugtype Serial
debugport 1
baudrate 115200
RAM Defects
-----------
identifier {badmemory}
Global Settings
---------------
identifier {globalsettings}
inherit {dbgsettings}
{emssettings}
{badmemory}
Boot Loader Settings
--------------------
identifier {bootloadersettings}
inherit {globalsettings}
{hypervisorsettings}
Hypervisor Settings
-------------------
identifier {hypervisorsettings}
hypervisordebugtype Serial
hypervisordebugport 1
hypervisorbaudrate 115200
Resume Loader Settings
----------------------
identifier {resumeloadersettings}
inherit {globalsettings}
Device options
--------------
identifier {f20072a3-f62f-11e1-8d13-dc0ea1bce007}
description Windows Recovery
ramdisksdidevice partition=\Device\HarddiskVolume1
ramdisksdipath \Recovery\WindowsRE\boot.sdi
==================== Memory info ===========================
Percentage of memory in use: 11%
Total physical RAM: 7641.6 MB
Available physical RAM: 6763.52 MB
Total Pagefile: 7641.6 MB
Available Pagefile: 6770.89 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:674.52 GB) (Free:592.46 GB) NTFS
Drive d: () (Removable) (Total:1.97 GB) (Free:0.33 GB) FAT
Drive e: (SAMSUNG_REC2) (Fixed) (Total:22.21 GB) (Free:0.99 GB) NTFS
Drive f: (SAMSUNG_REC) (Fixed) (Total:1 GB) (Free:0.29 GB) FAT32 ==>[System with boot components (obtained from reading drive)]
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 699 GB) (Disk ID: CFD616E9)
Partition: GPT Partition Type
========================================================
Disk: 1 (Size: 2 GB) (Disk ID: 004E2530)
Partition 1: (Active) - (Size=2 GB) - (Type=06)
LastRegBack: 2013-09-29 02:16
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-10-07 16:20:42
Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\00000028 Hitachi_HTS547575A9E384 rev.JE4OA50A 698,64GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Tizi\AppData\Local\Temp\uxloipow.sys
---- User code sections - GMER 2.1 ----
.text C:\windows\system32\atiesrxx.exe[992] C:\windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007fbb8b7177a 4 bytes [B7, B8, FB, 07]
.text C:\windows\system32\atiesrxx.exe[992] C:\windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007fbb8b71782 4 bytes [B7, B8, FB, 07]
.text C:\windows\system32\atieclxx.exe[1108] C:\windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007fbb8b7177a 4 bytes [B7, B8, FB, 07]
.text C:\windows\system32\atieclxx.exe[1108] C:\windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007fbb8b71782 4 bytes [B7, B8, FB, 07]
.text C:\windows\system32\atieclxx.exe[1108] C:\windows\system32\WSOCK32.dll!recvfrom + 742 000007fbb3fd1b32 4 bytes [FD, B3, FB, 07]
.text C:\windows\system32\atieclxx.exe[1108] C:\windows\system32\WSOCK32.dll!recvfrom + 750 000007fbb3fd1b3a 4 bytes [FD, B3, FB, 07]
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4340] C:\windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fbaa1e1532 4 bytes [1E, AA, FB, 07]
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4340] C:\windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007fbaa1e153a 4 bytes [1E, AA, FB, 07]
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4340] C:\windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fbaa1e165a 4 bytes [1E, AA, FB, 07]
.text C:\Program Files (x86)\Bluetooth Suite\BtTray.exe[4400] C:\windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fbaa1e1532 4 bytes [1E, AA, FB, 07]
.text C:\Program Files (x86)\Bluetooth Suite\BtTray.exe[4400] C:\windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007fbaa1e153a 4 bytes [1E, AA, FB, 07]
.text C:\Program Files (x86)\Bluetooth Suite\BtTray.exe[4400] C:\windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fbaa1e165a 4 bytes [1E, AA, FB, 07]
.text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4420] C:\windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fbaa1e1532 4 bytes [1E, AA, FB, 07]
.text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4420] C:\windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007fbaa1e153a 4 bytes [1E, AA, FB, 07]
.text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4420] C:\windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fbaa1e165a 4 bytes [1E, AA, FB, 07]
.text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4420] C:\windows\SYSTEM32\WSOCK32.dll!recvfrom + 742 000007fbb3fd1b32 4 bytes [FD, B3, FB, 07]
.text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4420] C:\windows\SYSTEM32\WSOCK32.dll!recvfrom + 750 000007fbb3fd1b3a 4 bytes [FD, B3, FB, 07]
.text C:\Program Files\AMD Quick Stream\AppexAcceleratorUI.exe[4612] C:\windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fbaa1e1532 4 bytes [1E, AA, FB, 07]
.text C:\Program Files\AMD Quick Stream\AppexAcceleratorUI.exe[4612] C:\windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007fbaa1e153a 4 bytes [1E, AA, FB, 07]
.text C:\Program Files\AMD Quick Stream\AppexAcceleratorUI.exe[4612] C:\windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fbaa1e165a 4 bytes [1E, AA, FB, 07]
.text C:\Program Files\AMD Quick Stream\AppexAcceleratorUI.exe[4612] C:\windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007fbb8b7177a 4 bytes [B7, B8, FB, 07]
.text C:\Program Files\AMD Quick Stream\AppexAcceleratorUI.exe[4612] C:\windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007fbb8b71782 4 bytes [B7, B8, FB, 07]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[3828] C:\windows\SYSTEM32\WSOCK32.dll!recvfrom + 742 000007fbb3fd1b32 4 bytes [FD, B3, FB, 07]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[3828] C:\windows\SYSTEM32\WSOCK32.dll!recvfrom + 750 000007fbb3fd1b3a 4 bytes [FD, B3, FB, 07]
.text C:\Program Files\Windows Defender\MsMpEng.exe[3824] C:\windows\system32\psapi.dll!GetProcessImageFileNameA + 306 000007fbb8b7177a 4 bytes [B7, B8, FB, 07]
.text C:\Program Files\Windows Defender\MsMpEng.exe[3824] C:\windows\system32\psapi.dll!GetProcessImageFileNameA + 314 000007fbb8b71782 4 bytes [B7, B8, FB, 07]
---- Threads - GMER 2.1 ----
Thread C:\windows\system32\csrss.exe [696:704] fffff960008985e8
Thread C:\windows\system32\svchost.exe [1600:3648] 000007fbabda4910
Thread C:\windows\system32\svchost.exe [1600:3604] 000007fbabcd1544
Thread C:\windows\system32\svchost.exe [1600:3856] 000007fbabb355dc
Thread C:\windows\system32\svchost.exe [1600:2840] 000007fbabda1044
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
Geändert von Mienk (07.10.2013 um 15:22 Uhr) |
|
07.10.2013, 15:33
| #2 |
| /// TB-Ausbilder   | Windows 8: Online-Banking Trojaner Hallo Mienk,
__________________warum wurde der FRST-Scan in den Reperaturoptionen durchgeführt? Wenn der Rechner normal bootet, kann man mit FRST ganz normal in Windows scannen. Hole das bitte wie folgt nach: Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ |
|
07.10.2013, 17:00
| #3 |
| | Windows 8: Online-Banking Trojaner Hi Leo,
__________________irgendwie bin ich wohl bei euren Beschreibungen auf den Link gekommen, der den Scan im Reparatur-Modus beschreibt. Hier noch mal die log files vom Scan im normalen Modus. Vielen Dank und viele Grüße, Mienk FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-10-2013
Ran by Tizi (administrator) on TIZHEN on 07-10-2013 17:49:50
Running from C:\Users\Tizi\Downloads
Windows 8 (X64) OS Language: Italian Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\windows\system32\atiesrxx.exe
(AMD) C:\windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\adminservice.exe
(Microsoft Corporation) C:\windows\system32\dashost.exe
(Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\Settings\CmdServer\EasyLauncher.exe
(F-Secure Corporation) C:\Program Files (x86)\Kabel BW\fshoster32.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\Program Files (x86)\Samsung\Settings\CmdServer\EasySettingsCmdServer.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\Settings\sSettings.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Qualcomm Atheros) C:\Program Files (x86)\Bluetooth Suite\BtTray.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(AppEx Networks Corporation) C:\Program Files\AMD Quick Stream\AppexAcceleratorUI.exe
() C:\Program Files (x86)\Bluetooth Suite\ActivateDesktop.exe
(Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
() C:\Windows\Samsung\PanelMgr\SSMMgr.exe
(F-Secure Corporation) C:\Program Files (x86)\Kabel BW\fshoster32.exe
() C:\Windows\Samsung\PanelMgr\caller64.exe
(Samsung Electronics CO., LTD.) C:\Program Files\Samsung\S Agent\CommonAgent.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Samsung Electronics CO., LTD.) C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe
(Samsung Electronics CO., LTD.) C:\Program Files\Samsung\Support Center\GuaranaAgent.exe
(Microsoft Corporation) C:\windows\ImmersiveControlPanel\SystemSettings.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13191824 2012-08-10] (Realtek Semiconductor)
HKLM\...\Run: [BtTray] - C:\Program Files (x86)\Bluetooth Suite\BtTray.exe [766080 2012-12-05] (Qualcomm Atheros)
HKLM\...\Run: [BtvStack] - C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [128640 2012-12-05] (Atheros Communications)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19875432 2013-06-21] (Skype Technologies S.A.)
HKCU\...\Run: [eecqbywt] - C:\Users\Tizi\AppData\Local\Temp\Lqph\pppazrzbywt.exe <===== ATTENTION
HKCU\...\Run: [AppEx Accelerator UI] - C:\Program Files\AMD Quick Stream\AppexAcceleratorUI.exe [1000288 2012-05-22] (AppEx Networks Corporation)
HKCU\...\Policies\system: [DisableLockWorkstation] 0
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [40312 2013-09-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [RemoteControl10] - C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [97392 2012-08-15] (CyberLink Corp.)
HKLM-x32\...\Run: [CLMLServer_For_P2G8] - C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111120 2012-06-08] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] - C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [491120 2012-07-12] (CyberLink Corp.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [681032 2013-10-07] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Samsung PanelMgr] - C:\Windows\Samsung\PanelMgr\SSMMgr.exe [618496 2010-06-23] ()
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642216 2012-09-12] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [F-Secure Hoster (47731)] - C:\Program Files (x86)\Kabel BW\fshoster32.exe [191424 2013-05-15] (F-Secure Corporation)
Startup: C:\Users\Tizi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wetter.lnk
ShortcutTarget: wetter.lnk -> C:\Program Files (x86)\wetter.com DesktopApp\wetter.com DesktopApp.exe (No File)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://samsung13.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://samsung13.msn.com
SearchScopes: HKLM - DefaultScope {A594556A-28DF-4FBF-8A03-86D260961795} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MASMJS
SearchScopes: HKLM - {A594556A-28DF-4FBF-8A03-86D260961795} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MASMJS
SearchScopes: HKLM-x32 - DefaultScope {A594556A-28DF-4FBF-8A03-86D260961795} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MASMJS
SearchScopes: HKLM-x32 - {A594556A-28DF-4FBF-8A03-86D260961795} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MASMJS
SearchScopes: HKCU - DefaultScope {A594556A-28DF-4FBF-8A03-86D260961795} URL =
SearchScopes: HKCU - {A594556A-28DF-4FBF-8A03-86D260961795} URL =
BHO: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Qualcomm Atheros Commnucations)
BHO: Skype add-on for Internet Explorer - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM-x32 {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files (x86)\Yahoo!\Common\Yinsthelper.dll
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Tizi\AppData\Roaming\Mozilla\Firefox\Profiles\dz8hlq9r.default
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3503.0728 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: yaxmpb@yahoo.com/YahooActiveXPluginBridge;version=1.0.0.1 - C:\Program Files (x86)\Yahoo!\Common\npyaxmpb.dll (Yahoo! Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440392 2013-10-07] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440392 2013-10-07] (Avira Operations GmbH & Co. KG)
R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [231552 2012-12-05] (Qualcomm Atheros Commnucations)
R2 Easy Launcher; C:\Program Files (x86)\Samsung\Settings\CmdServer\EasyLauncher.exe [1593976 2012-08-26] (Samsung Electronics CO., LTD.)
R2 fshoster; C:\Program Files (x86)\Kabel BW\fshoster32.exe [191424 2013-05-15] (F-Secure Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 SWUpdateService; C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe [3017776 2013-07-12] (Samsung Electronics CO., LTD.)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)
R2 ZAtheros Bt and Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [323584 2012-12-05] (Atheros)
==================== Drivers (Whitelisted) ====================
R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [35496 2012-07-09] (Advanced Micro Devices, Inc.)
R2 APXACC; C:\Windows\system32\DRIVERS\appexDrv.sys [199008 2012-06-23] (AppEx Networks Corporation)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [91648 2012-08-21] (Advanced Micro Devices)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105856 2013-10-07] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [132600 2013-10-07] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-10-07] (Avira Operations GmbH & Co. KG)
R3 BTATH_HID; C:\Windows\system32\DRIVERS\btath_hid.sys [222360 2012-12-05] (Qualcomm Atheros)
R3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2012-12-05] (Qualcomm Atheros)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 RadioHIDMini; C:\Windows\System32\drivers\RadioHIDMini.sys [23408 2012-07-27] (Windows (R) Win 7 DDK provider)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-10-08 01:16 - 2013-10-08 01:16 - 00000000 ____D C:\FRST
2013-10-07 17:48 - 2013-10-07 17:48 - 01954124 _____ (Farbar) C:\Users\Tizi\Downloads\FRST64.exe
2013-10-07 16:25 - 2013-10-07 16:31 - 00000000 ___RD C:\Users\Tizi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2013-10-07 15:38 - 2013-08-07 07:15 - 00144896 _____ (Microsoft Corporation) C:\windows\system32\tssdisai.dll
2013-10-07 15:36 - 2013-10-07 15:36 - 00377856 _____ C:\Users\Tizi\Downloads\gmer_2.1.19163.exe
2013-10-07 15:32 - 2013-05-02 17:29 - 00278800 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe
2013-09-19 20:07 - 2013-09-19 20:07 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-11 08:34 - 2013-09-11 08:34 - 00002029 _____ C:\Users\Public\Desktop\Adobe Reader X.lnk
2013-09-10 21:55 - 2013-09-10 21:55 - 97004533 _____ C:\windows\SysWOW64\᯾瞈⒨Å߿
2013-09-08 19:33 - 2013-09-08 19:33 - 00000000 ____D C:\Users\Tizi\AppData\Roaming\CyberLink
2013-09-08 19:33 - 2013-09-08 19:33 - 00000000 ____D C:\Users\Public\Documents\CyberLink
2013-09-08 19:33 - 2013-09-08 19:33 - 00000000 ____D C:\Users\Public\CyberLink
==================== One Month Modified Files and Folders =======
2013-10-08 01:16 - 2013-10-08 01:16 - 00000000 ____D C:\FRST
2013-10-07 17:49 - 2013-04-07 22:45 - 00000000 ____D C:\Users\Tizi\AppData\Local\CrashDumps
2013-10-07 17:49 - 2012-09-03 11:16 - 01792973 _____ C:\windows\WindowsUpdate.log
2013-10-07 17:48 - 2013-10-07 17:48 - 01954124 _____ (Farbar) C:\Users\Tizi\Downloads\FRST64.exe
2013-10-07 17:41 - 2013-07-02 20:32 - 00000000 ____D C:\Users\Tizi\AppData\Roaming\Skype
2013-10-07 17:41 - 2012-09-04 03:12 - 00780976 _____ C:\windows\system32\perfh010.dat
2013-10-07 17:41 - 2012-09-04 03:12 - 00152608 _____ C:\windows\system32\perfc010.dat
2013-10-07 17:41 - 2012-07-26 09:28 - 01781840 _____ C:\windows\system32\PerfStringBackup.INI
2013-10-07 17:40 - 2013-04-07 22:48 - 00000000 ____D C:\Users\Tizi\Documents\Bluetooth Folder
2013-10-07 17:19 - 2012-09-03 12:31 - 00000360 _____ C:\windows\Tasks\Xerox PhotoCafe Communicator.job
2013-10-07 17:05 - 2013-08-15 15:21 - 00000000 ____D C:\windows\system32\MRT
2013-10-07 17:02 - 2013-06-30 01:04 - 79143768 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2013-10-07 17:00 - 2012-07-26 10:12 - 00000000 ____D C:\windows\system32\sru
2013-10-07 16:37 - 2013-06-30 00:37 - 00000978 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2013-10-07 16:31 - 2013-10-07 16:25 - 00000000 ___RD C:\Users\Tizi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2013-10-07 16:31 - 2013-08-10 17:12 - 00000000 ____D C:\ProgramData\Atheros
2013-10-07 16:27 - 2012-09-03 12:18 - 00000000 ____D C:\ProgramData\WinClon
2013-10-07 16:26 - 2013-07-31 00:15 - 00323072 ___SH C:\Users\Tizi\Desktop\Thumbs.db
2013-10-07 16:23 - 2012-07-26 09:22 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-10-07 16:10 - 2013-06-30 00:05 - 00083160 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avnetflt.sys
2013-10-07 16:10 - 2013-06-30 00:03 - 00132600 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys
2013-10-07 16:10 - 2013-06-30 00:03 - 00105856 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys
2013-10-07 16:10 - 2013-06-30 00:03 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avkmgr.sys
2013-10-07 15:55 - 2012-07-26 10:12 - 00000000 ____D C:\windows\AUInstallAgent
2013-10-07 15:36 - 2013-10-07 15:36 - 00377856 _____ C:\Users\Tizi\Downloads\gmer_2.1.19163.exe
2013-10-07 15:06 - 2012-07-26 07:26 - 00262144 ___SH C:\windows\system32\config\BBI
2013-10-07 14:55 - 2013-06-29 23:40 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-10-07 14:52 - 2012-07-26 09:21 - 00029318 _____ C:\windows\setupact.log
2013-10-01 17:20 - 2013-06-30 15:25 - 00000072 _____ C:\Users\Public\LMDebug.log
2013-09-24 09:28 - 2013-07-02 20:31 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-09-22 21:29 - 2013-08-28 00:02 - 00000000 ____D C:\Program Files (x86)\Kabel BW
2013-09-19 20:07 - 2013-09-19 20:07 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-19 19:09 - 2013-04-07 22:52 - 00003600 _____ C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1161549151-3905956725-2365256691-1001
2013-09-15 09:35 - 2013-07-23 22:42 - 00000000 ____D C:\Users\Tizi\Desktop\Burda
2013-09-11 17:55 - 2013-08-03 11:05 - 00000000 ____D C:\Users\Tizi\Documents\Henrik
2013-09-11 13:51 - 2012-07-26 10:12 - 00000000 ____D C:\windows\rescache
2013-09-11 08:34 - 2013-09-11 08:34 - 00002029 _____ C:\Users\Public\Desktop\Adobe Reader X.lnk
2013-09-11 08:22 - 2012-08-05 23:07 - 00787484 _____ C:\windows\PFRO.log
2013-09-10 21:55 - 2013-09-10 21:55 - 97004533 _____ C:\windows\SysWOW64\᯾瞈⒨Å߿
2013-09-10 19:38 - 2013-06-30 00:37 - 00003866 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2013-09-08 19:33 - 2013-09-08 19:33 - 00000000 ____D C:\Users\Tizi\AppData\Roaming\CyberLink
2013-09-08 19:33 - 2013-09-08 19:33 - 00000000 ____D C:\Users\Public\Documents\CyberLink
2013-09-08 19:33 - 2013-09-08 19:33 - 00000000 ____D C:\Users\Public\CyberLink
2013-09-08 19:33 - 2012-09-03 12:27 - 00000000 ____D C:\ProgramData\CyberLink
Files to move or delete:
====================
C:\ProgramData\MakeMarkerFile.exe
Some content of TEMP:
====================
C:\Users\Tizi\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-09-29 12:16
==================== End Of Log ============================
--- --- --- Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 02-10-2013
Ran by Tizi at 2013-10-07 17:51:47
Running from C:\Users\Tizi\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Avira Desktop (Disabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Disabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
Adobe AIR (x32 Version: 3.7.0.2090)
Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.168)
Adobe Reader X (10.1.8) MUI (x32 Version: 10.1.8)
Allshare Play Link (x32 Version: 1.0.0)
AllSharePlayLink (x32 Version: 1.0.0)
AMD Accelerated Video Transcoding (Version: 12.5.100.20912)
AMD APP SDK Runtime (Version: 10.0.938.2)
AMD Catalyst Install Manager (Version: 8.0.881.0)
AMD Quick Stream (Version: 3.3.26.0)
AMD VISION Engine Control Center (x32 Version: 2012.0912.1709.28839)
Avira Free Antivirus (x32 Version: 14.0.0.383)
Catalyst Control Center - Branding (x32 Version: 1.00.0000)
Catalyst Control Center InstallProxy (x32 Version: 2012.0912.1709.28839)
Catalyst Control Center Localization All (x32 Version: 2012.0912.1709.28839)
CCC Help Chinese Standard (x32 Version: 2012.0912.1708.28839)
CCC Help Chinese Traditional (x32 Version: 2012.0912.1708.28839)
CCC Help Czech (x32 Version: 2012.0912.1708.28839)
CCC Help Danish (x32 Version: 2012.0912.1708.28839)
CCC Help Dutch (x32 Version: 2012.0912.1708.28839)
CCC Help English (x32 Version: 2012.0912.1708.28839)
CCC Help Finnish (x32 Version: 2012.0912.1708.28839)
CCC Help French (x32 Version: 2012.0912.1708.28839)
CCC Help German (x32 Version: 2012.0912.1708.28839)
CCC Help Greek (x32 Version: 2012.0912.1708.28839)
CCC Help Hungarian (x32 Version: 2012.0912.1708.28839)
CCC Help Italian (x32 Version: 2012.0912.1708.28839)
CCC Help Japanese (x32 Version: 2012.0912.1708.28839)
CCC Help Korean (x32 Version: 2012.0912.1708.28839)
CCC Help Norwegian (x32 Version: 2012.0912.1708.28839)
CCC Help Polish (x32 Version: 2012.0912.1708.28839)
CCC Help Portuguese (x32 Version: 2012.0912.1708.28839)
CCC Help Russian (x32 Version: 2012.0912.1708.28839)
CCC Help Spanish (x32 Version: 2012.0912.1708.28839)
CCC Help Swedish (x32 Version: 2012.0912.1708.28839)
CCC Help Thai (x32 Version: 2012.0912.1708.28839)
CCC Help Turkish (x32 Version: 2012.0912.1708.28839)
ccc-utility64 (Version: 2012.0912.1709.28839)
CyberLink Power2Go 8 (x32 Version: 8.0.0.1912)
CyberLink PowerDVD 10 (x32 Version: 10.0.4421.02)
D3DX10 (x32 Version: 15.4.2368.0902)
Easy File Share (x32 Version: 1.3.4)
E-POP (x32 Version: 1.0.1)
Fotogalerie (x32 Version: 16.4.3503.0728)
Galerie de photos (x32 Version: 16.4.3503.0728)
Help Desk (Version: 1.0.9)
Java 7 Update 25 (x32 Version: 7.0.250)
Java Auto Updater (x32 Version: 2.1.9.5)
Kabel BW Programme (x32 Version: 1.83.311.0)
Malwarebytes Anti-Malware versione 1.75.0.1300 (x32 Version: 1.75.0.1300)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Office (x32 Version: 14.0.6120.5004)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Movie Maker (x32 Version: 16.4.3503.0728)
Mozilla Firefox 24.0 (x86 de) (x32 Version: 24.0)
Mozilla Maintenance Service (x32 Version: 24.0)
Mozilla Thunderbird 17.0.8 (x86 de) (x32 Version: 17.0.8)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT110 (x32 Version: 16.4.1108.0727)
MSVCRT110_amd64 (Version: 16.4.1108.0727)
OpenOffice.org 3.4.1 (x32 Version: 3.41.9593)
Photo Common (x32 Version: 16.4.3503.0728)
Photo Gallery (x32 Version: 16.4.3503.0728)
Plants vs. Zombies (x32)
Qualcomm Atheros Bluetooth Suite (64) (Version: 8.0.0.216)
Qualcomm Atheros Client Installation Program (x32 Version: 10.0)
Quick Starter (Version: 1.0.0)
Raccolta foto (x32 Version: 16.4.3503.0728)
Realtek Ethernet Controller Driver (x32 Version: 8.3.730.2012)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6702)
Realtek USB 2.0 Card Reader (x32 Version: 6.1.8400.39030)
Recovery (x32 Version: 6.0.9.10)
S Agent (Version: 1.1.42)
Samsung ML-1865W Series (x32)
Settings (x32 Version: 2.0.0)
Skype Click to Call (x32 Version: 6.12.13601)
Skype™ 6.6 (x32 Version: 6.6.106)
Support Center (Version: 2.1.1106)
Support Center FAQ (x32 Version: 1.0.11)
SW Update (x32 Version: 2.1.17)
Synaptics Pointing Device Driver (Version: 16.2.14.2)
User Guide (x32 Version: 1.2.00)
Windows Driver Package - Samsung Electronics Co. Ltd. (RadioHIDMini) HIDClass (07/27/2012 20.57.1.735) (Version: 07/27/2012 20.57.1.735)
Windows Live (x32 Version: 16.4.3503.0728)
Windows Live Communications Platform (x32 Version: 16.4.3503.0728)
Windows Live Essentials (x32 Version: 16.4.3503.0728)
Windows Live Installer (x32 Version: 16.4.3503.0728)
Windows Live Photo Common (x32 Version: 16.4.3503.0728)
Windows Live PIMT Platform (x32 Version: 16.4.3503.0728)
Windows Live SOXE (x32 Version: 16.4.3503.0728)
Windows Live SOXE Definitions (x32 Version: 16.4.3503.0728)
Windows Live UX Platform (x32 Version: 16.4.3503.0728)
Windows Live UX Platform Language Pack (x32 Version: 16.4.3503.0728)
Xerox PhotoCafe (x32 Version: 1.0.0.6162)
Yahoo! Install Manager (x32)
Yahoo! Widgets (x32 Version: 4.5.2.0)
==================== Restore Points =========================
11-09-2013 11:45:36 Punto di controllo pianificato
20-09-2013 08:12:52 Punto di controllo pianificato
29-09-2013 13:39:35 Punto di controllo pianificato
07-10-2013 14:54:12 Windows Update
07-10-2013 14:54:12 Programma di installazione dei moduli di Windows
==================== Hosts content: ==========================
2012-07-26 07:26 - 2012-07-26 07:26 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {078146A6-DD7A-45ED-B49B-098266807009} - System32\Tasks\advRecovery => C:\Program Files\Samsung\Recovery\WCScheduler.exe [2013-06-19] (SEC)
Task: {5A658960-C4D8-49B9-AAE5-020CA1C00C04} - System32\Tasks\WLANStartup => C:\Program Files (x86)\Samsung\Easy Settings\WLANStartup.exe
Task: {7E9A7801-60D5-4F89-A549-9B9B5971D241} - System32\Tasks\SAgent => C:\Program Files\Samsung\S Agent\CommonAgent.exe [2013-06-05] (Samsung Electronics CO., LTD.)
Task: {7F179043-FAD8-4DC8-B03A-A354ACB882B6} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-09-10] (Adobe Systems Incorporated)
Task: {82E10DB0-CE12-403B-96FF-EBA93E11A136} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\windows\System32\lpksetup.exe [2013-08-04] (Microsoft Corporation)
Task: {94012B29-2AE0-4BC6-AB61-AC36E0CBCD57} - System32\Tasks\Xerox PhotoCafe Communicator => C:\ProgramData\Xerox PhotoCafe\MessageCheck.exe [2011-10-26] ()
Task: {9DC45743-D9E9-493E-815D-CC654FCD7521} - System32\Tasks\Settings => C:\Program Files (x86)\Samsung\Settings\sSettings.exe [2012-08-26] (Samsung Electronics CO., LTD.)
Task: {F9E95014-2B7F-4C2A-9774-475227BA45AD} - System32\Tasks\Synaptics TouchPad Enhancements => \Program Files\Synaptics\SynTP\SynTPEnh.exe [2012-10-16] (Synaptics Incorporated)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\Xerox PhotoCafe Communicator.job => C:\ProgramData\Xerox PhotoCafe\MessageCheck.exe
==================== Loaded Modules (whitelisted) =============
2012-12-05 20:44 - 2012-12-05 20:44 - 00384128 _____ () C:\Program Files (x86)\Bluetooth Suite\ContactsApi.dll
2012-12-05 20:38 - 2012-12-05 20:38 - 00020480 _____ () C:\Program Files (x86)\Bluetooth Suite\L10n\it-IT\BtTray.it-IT.dll
2012-12-05 20:41 - 2012-12-05 20:41 - 00011264 _____ () C:\Program Files (x86)\Bluetooth Suite\Modules\ActivateDesktopDebugger\ActivateDesktopDebugger.dll
2013-06-05 07:28 - 2013-06-05 07:28 - 00088624 _____ () C:\Program Files\Samsung\S Agent\ToastX64.dll
2012-09-12 17:07 - 2012-09-12 17:07 - 00369664 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2013-06-30 00:03 - 2013-01-25 10:25 - 00397704 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2012-08-26 11:48 - 2012-08-26 11:48 - 00028280 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\EasySettingsCmdWrapper.dll
2012-08-26 11:48 - 2012-08-26 11:48 - 01015416 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\EasySettingsCmd.dll
2012-08-26 11:48 - 2012-08-26 11:48 - 00110712 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\EasySettingsBase.dll
2012-08-26 11:48 - 2012-08-26 11:48 - 00056440 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\HookDllPS2.dll
2012-08-26 11:48 - 2012-08-26 11:48 - 00211064 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\WinCRT.dll
2012-08-26 11:48 - 2012-08-26 11:48 - 00026232 _____ () C:\Program Files (x86)\Samsung\Settings\EasySettingsAPI.dll
2012-08-26 11:48 - 2012-08-26 11:48 - 00110712 _____ () C:\Program Files (x86)\Samsung\Settings\EasySettingsBase.dll
2012-08-26 11:48 - 2012-08-26 11:48 - 00029816 _____ () C:\Program Files (x86)\Samsung\Settings\EasyMovieEnhancer.dll
2012-08-26 11:48 - 2012-08-26 11:48 - 00091768 _____ () C:\Program Files (x86)\Samsung\Settings\EasySettingsCmdClient.dll
2012-09-03 12:27 - 2012-06-08 05:34 - 00627216 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll
2012-06-08 04:34 - 2012-06-08 04:34 - 00016400 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll
2013-08-28 00:02 - 2013-08-28 00:02 - 00593464 _____ () C:\windows\WinSxS\x86_f-secure.qt_4_6_2_2e112a926211c0a3_4.6.482.65_none_b59e1e0911fd55ab\QtMultimediaKit1.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (10/07/2013 05:49:46 PM) (Source: Application Error) (User: )
Description: Nome dell'applicazione che ha generato l'errore: firefox.exe, versione: 24.0.0.5001, timestamp: 0x522fd29f
Nome del modulo che ha generato l'errore: xul.dll, versione: 24.0.0.5001, timestamp: 0x522fd1a4
Codice eccezione: 0xc0000005
Offset errore 0x001b72a8
ID processo che ha generato l'errore: 0x1610
Ora di avvio dell'applicazione che ha generato l'errore: 0xfirefox.exe0
Percorso dell'applicazione che ha generato l'errore: firefox.exe1
Percorso del modulo che ha generato l'errore: firefox.exe2
ID segnalazione: firefox.exe3
Nome completo pacchetto che ha generato l'errore: firefox.exe4
ID applicazione relativo al pacchetto che ha generato l'errore: firefox.exe5
Error: (10/07/2013 04:24:20 PM) (Source: ESENT) (User: )
Description: taskhostex (2744) WebCacheLocal: Ripristino database non riuscito. Errore imprevisto -1032.
Error: (10/07/2013 04:24:20 PM) (Source: ESENT) (User: )
Description: taskhostex (2744) WebCacheLocal: Errore -1032 (0xfffffbf8) durante l'apertura del file di registro C:\Users\Tizi\AppData\Local\Microsoft\Windows\WebCache\V01.log.
Error: (10/07/2013 04:24:20 PM) (Source: ESENT) (User: )
Description: taskhostex (2744) WebCacheLocal: Tentativo di apertura del file "C:\Users\Tizi\AppData\Local\Microsoft\Windows\WebCache\V01.log" per accesso lettura e scrittura non riuscito con errore di sistema 32 (0x00000020): "Impossibile accedere al file. Il file è utilizzato da un altro processo. ". L'operazione di apertura file non verrà effettuata con errore -1032 (0xfffffbf8).
Error: (10/07/2013 04:11:13 PM) (Source: Application Error) (User: )
Description: Nome dell'applicazione che ha generato l'errore: soffice.bin, versione: 3.4.9593.500, timestamp: 0x5028bfc0
Nome del modulo che ha generato l'errore: RPCRT4.dll, versione: 6.2.9200.16622, timestamp: 0x519e974e
Codice eccezione: 0xc0000005
Offset errore 0x0001f035
ID processo che ha generato l'errore: 0xaa8
Ora di avvio dell'applicazione che ha generato l'errore: 0xsoffice.bin0
Percorso dell'applicazione che ha generato l'errore: soffice.bin1
Percorso del modulo che ha generato l'errore: soffice.bin2
ID segnalazione: soffice.bin3
Nome completo pacchetto che ha generato l'errore: soffice.bin4
ID applicazione relativo al pacchetto che ha generato l'errore: soffice.bin5
Error: (10/02/2013 08:20:55 PM) (Source: Customer Experience Improvement Program) (User: )
Description: 80070005
Error: (09/24/2013 10:03:31 AM) (Source: Customer Experience Improvement Program) (User: )
Description: 80070005
Error: (09/23/2013 10:45:44 PM) (Source: Application Error) (User: )
Description: Nome dell'applicazione che ha generato l'errore: EasySettingsCmdServer.exe, versione: 0.0.0.0, timestamp: 0x50376629
Nome del modulo che ha generato l'errore: EasySettingsBase.dll, versione: 0.0.0.0, timestamp: 0x5039da3f
Codice eccezione: 0xc0000005
Offset errore 0x00001f7b
ID processo che ha generato l'errore: 0xa44
Ora di avvio dell'applicazione che ha generato l'errore: 0xEasySettingsCmdServer.exe0
Percorso dell'applicazione che ha generato l'errore: EasySettingsCmdServer.exe1
Percorso del modulo che ha generato l'errore: EasySettingsCmdServer.exe2
ID segnalazione: EasySettingsCmdServer.exe3
Nome completo pacchetto che ha generato l'errore: EasySettingsCmdServer.exe4
ID applicazione relativo al pacchetto che ha generato l'errore: EasySettingsCmdServer.exe5
Error: (09/19/2013 07:10:27 PM) (Source: Customer Experience Improvement Program) (User: )
Description: 80070005
Error: (09/10/2013 08:57:31 PM) (Source: Customer Experience Improvement Program) (User: )
Description: 80070005
System errors:
=============
Error: (10/07/2013 05:29:42 PM) (Source: cdrom) (User: )
Description: Rilevato blocco danneggiato sul dispositivo \Device\CdRom0.
Error: (10/07/2013 04:29:53 PM) (Source: BTHUSB) (User: )
Description: L'autenticazione reciproca tra la scheda Bluetooth locale e un dispositivo con indirizzo di scheda Bluetooth (a0:4e:04:e1:fc:97) non è riuscita.
Error: (10/07/2013 04:29:50 PM) (Source: BTHUSB) (User: )
Description: L'autenticazione reciproca tra la scheda Bluetooth locale e un dispositivo con indirizzo di scheda Bluetooth (a0:4e:04:e1:fc:97) non è riuscita.
Error: (10/07/2013 04:29:50 PM) (Source: BTHUSB) (User: )
Description: L'autenticazione reciproca tra la scheda Bluetooth locale e un dispositivo con indirizzo di scheda Bluetooth (a0:4e:04:e1:fc:97) non è riuscita.
Error: (10/07/2013 04:24:35 PM) (Source: DCOM) (User: TizHen)
Description: impostazioni specifiche dell'applicazioneLocaleAvvio{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}TizHenTiziS-1-5-21-1161549151-3905956725-2365256691-1001LocalHost (tramite LRPC)Non disponibileNon disponibile
Error: (10/07/2013 04:24:35 PM) (Source: DCOM) (User: TizHen)
Description: impostazioni specifiche dell'applicazioneLocaleAvvio{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}TizHenTiziS-1-5-21-1161549151-3905956725-2365256691-1001LocalHost (tramite LRPC)Non disponibileNon disponibile
Error: (10/07/2013 04:24:35 PM) (Source: DCOM) (User: TizHen)
Description: impostazioni specifiche dell'applicazioneLocaleAvvio{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}TizHenTiziS-1-5-21-1161549151-3905956725-2365256691-1001LocalHost (tramite LRPC)Non disponibileNon disponibile
Error: (10/07/2013 03:20:56 PM) (Source: DCOM) (User: TizHen)
Description: impostazioni specifiche dell'applicazioneLocaleAvvio{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}TizHenTiziS-1-5-21-1161549151-3905956725-2365256691-1001LocalHost (tramite LRPC)Non disponibileNon disponibile
Error: (10/07/2013 03:20:56 PM) (Source: DCOM) (User: TizHen)
Description: impostazioni specifiche dell'applicazioneLocaleAvvio{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}TizHenTiziS-1-5-21-1161549151-3905956725-2365256691-1001LocalHost (tramite LRPC)Non disponibileNon disponibile
Error: (10/07/2013 03:20:56 PM) (Source: DCOM) (User: TizHen)
Description: impostazioni specifiche dell'applicazioneLocaleAvvio{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}TizHenTiziS-1-5-21-1161549151-3905956725-2365256691-1001LocalHost (tramite LRPC)Non disponibileNon disponibile
Microsoft Office Sessions:
=========================
Error: (10/07/2013 05:49:46 PM) (Source: Application Error)(User: )
Description: firefox.exe24.0.0.5001522fd29fxul.dll24.0.0.5001522fd1a4c0000005001b72a8161001cec3744dace284C:\Program Files (x86)\Mozilla Firefox\firefox.exeC:\Program Files (x86)\Mozilla Firefox\xul.dll1669edb3-2f68-11e3-be99-50b7c3293f32
Error: (10/07/2013 04:24:20 PM) (Source: ESENT)(User: )
Description: taskhostex2744WebCacheLocal: -1032
Error: (10/07/2013 04:24:20 PM) (Source: ESENT)(User: )
Description: taskhostex2744WebCacheLocal: C:\Users\Tizi\AppData\Local\Microsoft\Windows\WebCache\V01.log-1032 (0xfffffbf8)
Error: (10/07/2013 04:24:20 PM) (Source: ESENT)(User: )
Description: taskhostex2744WebCacheLocal: C:\Users\Tizi\AppData\Local\Microsoft\Windows\WebCache\V01.log-1032 (0xfffffbf8)32 (0x00000020)Impossibile accedere al file. Il file è utilizzato da un altro processo.
Error: (10/07/2013 04:11:13 PM) (Source: Application Error)(User: )
Description: soffice.bin3.4.9593.5005028bfc0RPCRT4.dll6.2.9200.16622519e974ec00000050001f035aa801cec366af789c55C:\Program Files (x86)\OpenOffice.org 3\program\soffice.binC:\windows\SYSTEM32\RPCRT4.dll525c1dbe-2f5a-11e3-be98-50b7c3293f32
Error: (10/02/2013 08:20:55 PM) (Source: Customer Experience Improvement Program)(User: )
Description: 80070005
Error: (09/24/2013 10:03:31 AM) (Source: Customer Experience Improvement Program)(User: )
Description: 80070005
Error: (09/23/2013 10:45:44 PM) (Source: Application Error)(User: )
Description: EasySettingsCmdServer.exe0.0.0.050376629EasySettingsBase.dll0.0.0.05039da3fc000000500001f7ba4401ceaeb77f95759eC:\Program Files (x86)\Samsung\Settings\CmdServer\EasySettingsCmdServer.exeC:\Program Files (x86)\Samsung\Settings\CmdServer\EasySettingsBase.dll1d61d05f-2491-11e3-be92-50b7c3293f32
Error: (09/19/2013 07:10:27 PM) (Source: Customer Experience Improvement Program)(User: )
Description: 80070005
Error: (09/10/2013 08:57:31 PM) (Source: Customer Experience Improvement Program)(User: )
Description: 80070005
==================== Memory info ===========================
Percentage of memory in use: 23%
Total physical RAM: 7641.6 MB
Available physical RAM: 5881.77 MB
Total Pagefile: 9561.6 MB
Available Pagefile: 7065.52 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:674.52 GB) (Free:590.76 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 699 GB) (Disk ID: CFD616E9)
Partition: GPT Partition Type
==================== End Of Log ============================
|
|
07.10.2013, 17:25
| #4 |
| /// TB-Ausbilder | Windows 8: Online-Banking Trojaner Hallo, dann mach bitte so weiter: Schritt 1 Scan mit Combofix
Schritt 2 Starte noch einmal FRST.
__________________ cheers, Leo |
|
07.10.2013, 20:54
| #5 |
| | Windows 8: Online-Banking Trojaner Hi Leo, Combofix ist durchgelaufen ohne zu meckern. Allerdings hat Avira Antivir am Anfang eine Meldung gebracht, dass ein Zugriff auf die Registry blockiert wurde (obwohl ich den Echtzeit-Scanner ausgeschaltet habe). Anbei die Logfiles von Combofix und frst. Cheers, Mienk Code:
ATTFilter ComboFix 13-10-04.02 - Tizi 07.10.2013 19:47:54.1.2 - x64
Microsoft Windows 8 6.2.9200.0.1252.49.1040.18.7642.5461 [GMT 2:00]
ausgeführt von:: c:\users\Tizi\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AV: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-09-07 bis 2013-10-07 ))))))))))))))))))))))))))))))
.
.
2013-10-07 23:16 . 2013-10-07 23:16 -------- d-----w- C:\FRST
2013-10-07 17:28 . 2013-09-04 20:32 9694160 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{AEA7A371-B194-4BA3-B6BA-1DFC44ED6498}\mpengine.dll
2013-10-07 13:38 . 2013-08-07 05:15 144896 ----a-w- c:\windows\system32\tssdisai.dll
2013-10-07 13:32 . 2013-05-02 15:29 278800 ------w- c:\windows\system32\MpSigStub.exe
2013-10-03 15:01 . 2013-10-03 15:01 290480 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10219.bin
2013-09-08 17:33 . 2013-09-08 17:33 -------- d-----w- c:\users\Tizi\AppData\Roaming\CyberLink
2013-09-08 17:33 . 2013-09-08 17:33 -------- d-----w- c:\users\Public\CyberLink
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-10-07 15:02 . 2013-06-29 23:04 79143768 ----a-w- c:\windows\system32\MRT.exe
2013-10-07 14:10 . 2013-06-29 22:05 83160 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2013-10-07 14:10 . 2013-06-29 22:03 28600 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2013-10-07 14:10 . 2013-06-29 22:03 132600 ----a-w- c:\windows\system32\drivers\avipbb.sys
2013-10-07 14:10 . 2013-06-29 22:03 105856 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2013-08-04 06:20 . 2013-08-04 06:20 1019392 ----a-w- c:\windows\system32\MsSpellCheckingFacility.dll
2013-08-04 06:20 . 2013-08-04 06:20 163328 ----a-w- c:\windows\system32\sspicli.dll
2013-08-04 06:20 . 2013-08-04 06:20 100072 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2013-08-04 06:20 . 2013-08-04 06:20 35840 ----a-w- c:\windows\system32\lsass.exe
2013-08-04 06:20 . 2013-08-04 06:20 27648 ----a-w- c:\windows\system32\sspisrv.dll
2013-08-04 06:20 . 2013-08-04 06:20 274432 ----a-w- c:\windows\apppatch\apppatch64\AcGenral.dll
2013-08-04 06:20 . 2013-08-04 06:20 11264 ----a-w- c:\windows\apppatch\apppatch64\AcWinRT.dll
2013-08-04 06:20 . 2013-08-04 06:20 1739264 ----a-w- c:\windows\system32\RacEngn.dll
2013-08-04 06:20 . 2013-08-04 06:20 3847168 ----a-w- c:\windows\system32\d2d1.dll
2013-08-04 06:20 . 2013-08-04 06:20 112128 ----a-w- c:\windows\system32\PackageStateRoaming.dll
2013-08-04 06:20 . 2013-08-04 06:20 103936 ----a-w- c:\windows\system32\microsoft-windows-kernel-power-events.dll
2013-08-04 06:20 . 2013-08-04 06:20 117760 ----a-w- c:\windows\system32\dwm.exe
2013-08-04 06:20 . 2013-08-04 06:20 62488 ----a-w- c:\windows\system32\drivers\dumpfve.sys
2013-08-04 06:20 . 2013-08-04 06:20 465128 ----a-w- c:\windows\system32\drivers\fvevol.sys
2013-08-04 06:20 . 2013-08-04 06:20 2016256 ----a-w- c:\windows\system32\batmeter.dll
2013-08-04 06:20 . 2013-08-04 06:20 389360 ----a-w- c:\windows\system32\MMDevAPI.dll
2013-08-04 06:20 . 2013-08-04 06:20 101888 ----a-w- c:\windows\system32\SettingSyncHost.exe
2013-08-04 06:20 . 2013-08-04 06:20 180736 ----a-w- c:\windows\system32\bcdsrv.dll
2013-08-04 06:20 . 2013-08-04 06:20 156672 ----a-w- c:\windows\system32\DAFWSD.dll
2013-08-04 06:20 . 2013-08-04 06:20 410624 ----a-w- c:\windows\system32\services.exe
2013-08-04 06:20 . 2013-08-04 06:20 2397184 ----a-w- c:\windows\system32\WpcMon.exe
2013-08-04 06:20 . 2013-08-04 06:20 755200 ----a-w- c:\windows\system32\fveapi.dll
2013-08-04 06:20 . 2013-08-04 06:20 459776 ----a-w- c:\windows\system32\dxgi.dll
2013-08-04 06:20 . 2013-08-04 06:20 240640 ----a-w- c:\windows\system32\fveapibase.dll
2013-08-04 06:20 . 2013-08-04 06:20 228352 ----a-w- c:\windows\system32\ProximityService.dll
2013-08-04 06:20 . 2013-08-04 06:20 355328 ----a-w- c:\windows\system32\mfsvr.dll
2013-08-04 06:20 . 2013-08-04 06:20 617984 ----a-w- c:\windows\system32\mfsrcsnk.dll
2013-08-04 06:20 . 2013-08-04 06:20 177152 ----a-w- c:\windows\system32\WSSync.dll
2013-08-04 06:20 . 2013-08-04 06:20 604672 ----a-w- c:\windows\system32\dnsapi.dll
2013-08-04 06:20 . 2013-08-04 06:20 210432 ----a-w- c:\windows\system32\dnsrslvr.dll
2013-08-04 06:20 . 2013-08-04 06:20 249344 ----a-w- c:\windows\system32\wpnprv.dll
2013-08-04 06:20 . 2013-08-04 06:20 751104 ----a-w- c:\windows\system32\appwiz.cpl
2013-08-04 06:20 . 2013-08-04 06:20 118272 ----a-w- c:\windows\system32\DevPropMgr.dll
2013-08-04 06:20 . 2013-08-04 06:20 37888 ----a-w- c:\windows\system32\LangCleanupSysprepAction.dll
2013-08-04 06:20 . 2013-08-04 06:20 92160 ----a-w- c:\windows\system32\lpremove.exe
2013-08-04 06:20 . 2013-08-04 06:20 8704 ----a-w- c:\windows\system32\lpksetupproxyserv.dll
2013-08-04 06:20 . 2013-08-04 06:20 627712 ----a-w- c:\windows\system32\lpksetup.exe
2013-08-04 06:20 . 2013-08-04 06:20 242176 ----a-w- c:\windows\apppatch\apppatch64\AcLayers.dll
2013-08-04 06:20 . 2013-08-04 06:20 13824 ----a-w- c:\windows\system32\MUILanguageCleanup.dll
2013-08-04 06:20 . 2013-08-04 06:20 13312 ----a-w- c:\windows\apppatch\apppatch64\AcXtrnal.dll
2013-08-04 06:20 . 2013-08-04 06:20 866304 ----a-w- c:\windows\system32\WinTypes.dll
2013-08-04 06:20 . 2013-08-04 06:20 1743872 ----a-w- c:\windows\system32\combase.dll
2013-08-04 06:20 . 2013-08-04 06:20 2219008 ----a-w- c:\windows\system32\d3d10warp.dll
2013-08-04 06:20 . 2013-08-04 06:20 29696 ----a-w- c:\windows\system32\svchost.exe
2013-08-04 06:20 . 2013-08-04 06:20 6656 ----a-w- c:\windows\system32\shimeng.dll
2013-08-04 06:20 . 2013-08-04 06:20 634880 ----a-w- c:\windows\system32\apphelp.dll
2013-08-04 06:20 . 2013-08-04 06:20 25088 ----a-w- c:\windows\system32\sdbinst.exe
2013-08-04 06:20 . 2013-08-04 06:20 236544 ----a-w- c:\windows\system32\MFPlay.dll
2013-08-04 06:20 . 2013-08-04 06:20 190976 ----a-w- c:\windows\system32\aelupsvc.dll
2013-08-04 06:20 . 2013-08-04 06:20 65536 ----a-w- c:\windows\system32\setbcdlocale.dll
2013-08-04 06:20 . 2013-08-04 06:20 76288 ----a-w- c:\windows\system32\RpcEpMap.dll
2013-08-04 06:20 . 2013-08-04 06:20 757248 ----a-w- c:\windows\system32\uDWM.dll
2013-08-04 06:20 . 2013-08-04 06:20 1304064 ----a-w- c:\windows\system32\Windows.Media.Streaming.dll
2013-08-04 06:20 . 2013-08-04 06:20 762368 ----a-w- c:\windows\system32\provcore.dll
2013-08-04 06:20 . 2013-08-04 06:20 80896 ----a-w- c:\windows\system32\mmcss.dll
2013-08-04 06:20 . 2013-08-04 06:20 27280 ----a-w- c:\windows\system32\avrt.dll
2013-08-04 06:20 . 2013-08-04 06:20 120040 ----a-w- c:\windows\system32\drivers\msgpioclx.sys
2013-08-04 06:20 . 2013-08-04 06:20 1400832 ----a-w- c:\windows\system32\propsys.dll
2013-08-04 06:20 . 2013-08-04 06:20 92672 ----a-w- c:\windows\system32\drvinst.exe
2013-08-04 06:20 . 2013-08-04 06:20 107008 ----a-w- c:\windows\system32\umpnpmgr.dll
2013-08-04 06:20 . 2013-08-04 06:20 44544 ----a-w- c:\windows\system32\perfctrs.dll
2013-08-04 06:20 . 2013-08-04 06:20 37888 ----a-w- c:\windows\system32\perfproc.dll
2013-08-04 06:20 . 2013-08-04 06:20 34816 ----a-w- c:\windows\system32\perfdisk.dll
2013-08-04 06:20 . 2013-08-04 06:20 23552 ----a-w- c:\windows\system32\perfnet.dll
2013-08-04 06:20 . 2013-08-04 06:20 189952 ----a-w- c:\windows\system32\perfos.dll
2013-08-04 06:20 . 2013-08-04 06:20 437760 ----a-w- c:\windows\system32\mfh264enc.dll
2013-08-04 06:20 . 2013-08-04 06:20 2066432 ----a-w- c:\windows\system32\d3d11.dll
2013-07-30 20:54 . 2013-07-30 20:54 245248 ----a-w- c:\windows\system32\usbmon.dll
2013-07-30 20:54 . 2013-07-30 20:54 645120 ----a-w- c:\windows\system32\Windows.Security.Authentication.OnlineId.dll
2013-07-30 20:54 . 2013-07-30 20:54 156160 ----a-w- c:\windows\system32\powercfg.cpl
2013-07-30 20:54 . 2013-07-30 20:54 150016 ----a-w- c:\windows\system32\discan.dll
2013-07-30 20:54 . 2013-07-30 20:54 951808 ----a-w- c:\windows\system32\Windows.Globalization.dll
2013-07-30 20:54 . 2013-07-30 20:54 1161728 ----a-w- c:\windows\system32\sppobjs.dll
2013-07-30 20:54 . 2013-07-30 20:54 448512 ----a-w- c:\windows\system32\SettingSync.dll
2013-07-30 20:54 . 2013-07-30 20:54 128512 ----a-w- c:\windows\system32\SettingSyncInfo.dll
2013-07-30 20:54 . 2013-07-30 20:54 117248 ----a-w- c:\windows\system32\NdisImPlatform.dll
2013-07-30 20:54 . 2013-07-30 20:54 455168 ----a-w- c:\windows\system32\netcfgx.dll
2013-07-30 20:54 . 2013-07-30 20:54 703488 ----a-w- c:\windows\system32\drvstore.dll
2013-07-30 20:54 . 2013-07-30 20:54 327912 ----a-w- c:\windows\system32\drivers\Classpnp.sys
2013-07-30 20:54 . 2013-07-30 20:54 49152 ----a-w- c:\windows\system32\DevDispItemProvider.dll
2013-07-30 20:54 . 2013-07-30 20:54 71168 ----a-w- c:\windows\system32\WSDPrintProxy.DLL
2013-07-30 20:52 . 2013-07-30 20:52 1265152 ----a-w- c:\windows\system32\lsasrv.dll
2013-07-30 20:52 . 2013-07-30 20:52 562392 ----a-w- c:\windows\system32\drivers\cng.sys
2013-07-30 20:52 . 2013-07-30 20:52 172264 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2013-07-30 20:51 . 2013-07-30 20:51 590848 ----a-w- c:\windows\system32\SHCore.dll
2013-07-30 20:51 . 2013-07-30 20:51 441576 ----a-w- c:\windows\system32\drivers\netio.sys
2013-07-30 20:51 . 2013-07-30 20:51 7680 ----a-w- c:\windows\system32\kbdhebl3.dll
2013-07-30 20:51 . 2013-07-30 20:51 49664 ----a-w- c:\windows\system32\BdeUISrv.exe
2013-07-30 20:51 . 2013-07-30 20:51 190976 ----a-w- c:\windows\system32\bdesvc.dll
2013-07-30 20:51 . 2013-07-30 20:51 58088 ----a-w- c:\windows\system32\drivers\dam.sys
2013-07-30 20:51 . 2013-07-30 20:51 55808 ----a-w- c:\windows\system32\PCPKsp.dll
2013-07-30 20:51 . 2013-07-30 20:51 264704 ----a-w- c:\windows\system32\ListSvc.dll
2013-07-30 20:51 . 2013-07-30 20:51 81920 ----a-w- c:\windows\system32\dhcpcsvc.dll
2013-07-30 20:51 . 2013-07-30 20:51 62976 ----a-w- c:\windows\system32\dhcpcsvc6.dll
2013-07-30 20:51 . 2013-07-30 20:51 331776 ----a-w- c:\windows\system32\dhcpcore.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-06-21 19875432]
"AppEx Accelerator UI"="c:\program files\AMD Quick Stream\AppexAcceleratorUI.exe" [2012-05-22 1000288]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2013-09-03 40312]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"RemoteControl10"="c:\program files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe" [2012-08-15 97392]
"CLMLServer_For_P2G8"="c:\program files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe" [2012-06-08 111120]
"CLVirtualDrive"="c:\program files (x86)\CyberLink\Power2Go8\VirtualDrive.exe" [2012-07-12 491120]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-10-07 681032]
"Samsung PanelMgr"="c:\windows\Samsung\PanelMgr\SSMMgr.exe" [2010-06-23 618496]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-09-12 642216]
"F-Secure Hoster (47731)"="c:\program files (x86)\Kabel BW\fshoster32.exe" [2013-05-15 191424]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableCursorSuppression"= 1 (0x1)
"ConsentPromptBehaviorUser"= 3 (0x3)
"DisableCAD"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
R2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x]
R2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R2 SWUpdateService;SW Update Service;c:\programdata\Samsung\SW Update Service\SWMAgent.exe;c:\programdata\Samsung\SW Update Service\SWMAgent.exe [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
R3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;c:\windows\System32\Drivers\RtsUVStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUVStor.sys [x]
R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 WUDFWpdMtp;WUDFWpdMtp;c:\windows\system32\DRIVERS\WUDFRd.sys;c:\windows\SYSNATIVE\DRIVERS\WUDFRd.sys [x]
S0 amd_sata;amd_sata;c:\windows\System32\drivers\amd_sata.sys;c:\windows\SYSNATIVE\drivers\amd_sata.sys [x]
S0 amd_xata;amd_xata;c:\windows\System32\drivers\amd_xata.sys;c:\windows\SYSNATIVE\drivers\amd_xata.sys [x]
S0 amdkmpfd;AMD PCI Root Bus Lower Filter;c:\windows\System32\drivers\amdkmpfd.sys;c:\windows\SYSNATIVE\drivers\amdkmpfd.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S1 CLVirtualDrive;CLVirtualDrive;c:\windows\system32\DRIVERS\CLVirtualDrive.sys;c:\windows\SYSNATIVE\DRIVERS\CLVirtualDrive.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 APXACC;AppEx Networks Accelerator LWF;c:\windows\system32\DRIVERS\appexDrv.sys;c:\windows\SYSNATIVE\DRIVERS\appexDrv.sys [x]
S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Bluetooth Suite\adminservice.exe;c:\program files (x86)\Bluetooth Suite\adminservice.exe [x]
S2 Easy Launcher;Easy Launcher;c:\program files (x86)\Samsung\Settings\CmdServer\EasyLauncher.exe;c:\program files (x86)\Samsung\Settings\CmdServer\EasyLauncher.exe [x]
S2 fshoster;F-Secure Dll Hoster;c:\program files (x86)\Kabel BW\fshoster32.exe;c:\program files (x86)\Kabel BW\fshoster32.exe [x]
S2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys;c:\windows\SYSNATIVE\Drivers\SSPORT.sys [x]
S2 ZAtheros Bt and Wlan Coex Agent;ZAtheros Bt and Wlan Coex Agent;c:\program files (x86)\Bluetooth Suite\Ath_CoexAgent.exe;c:\program files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [x]
S3 AthBTPort;Qualcomm Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_flt.sys [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW86.sys;c:\windows\SYSNATIVE\drivers\AtihdW86.sys [x]
S3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys;c:\windows\SYSNATIVE\drivers\btath_a2dp.sys [x]
S3 btath_avdt;Qualcomm Atheros Bluetooth AVDT Service;c:\windows\system32\drivers\btath_avdt.sys;c:\windows\SYSNATIVE\drivers\btath_avdt.sys [x]
S3 BTATH_BUS;Qualcomm Atheros Bluetooth Bus;c:\windows\System32\drivers\btath_bus.sys;c:\windows\SYSNATIVE\drivers\btath_bus.sys [x]
S3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\System32\drivers\btath_hcrp.sys;c:\windows\SYSNATIVE\drivers\btath_hcrp.sys [x]
S3 BTATH_HID;Bluetooth HID Device;c:\windows\system32\DRIVERS\btath_hid.sys;c:\windows\SYSNATIVE\DRIVERS\btath_hid.sys [x]
S3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_lwflt.sys [x]
S3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\System32\drivers\btath_rcp.sys;c:\windows\SYSNATIVE\drivers\btath_rcp.sys [x]
S3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys;c:\windows\SYSNATIVE\DRIVERS\btfilter.sys [x]
S3 BthLEEnum;Driver Bluetooth a basso consumo;c:\windows\system32\DRIVERS\BthLEEnum.sys;c:\windows\SYSNATIVE\DRIVERS\BthLEEnum.sys [x]
S3 RadioHIDMini;Radio HID Mini-driver;c:\windows\System32\drivers\RadioHIDMini.sys;c:\windows\SYSNATIVE\drivers\RadioHIDMini.sys [x]
S3 RTL8168;Realtek 8168 NT Driver;c:\windows\system32\DRIVERS\Rt630x64.sys;c:\windows\SYSNATIVE\DRIVERS\Rt630x64.sys [x]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys;c:\windows\SYSNATIVE\DRIVERS\usbfilter.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2013-10-07 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-29 17:38]
.
2013-10-07 c:\windows\Tasks\Xerox PhotoCafe Communicator.job
- c:\programdata\Xerox PhotoCafe\MessageCheck.exe [2011-10-26 09:11]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2012-08-10 13191824]
"BtTray"="c:\program files (x86)\Bluetooth Suite\BtTray.exe" [2012-12-05 766080]
"BtvStack"="c:\program files (x86)\Bluetooth Suite\BtvStack.exe" [2012-12-05 128640]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://samsung13.msn.com
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\Tizi\AppData\Roaming\Mozilla\Firefox\Profiles\dz8hlq9r.default\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
c:\users\Tizi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wetter.lnk - c:\program files (x86)\wetter.com DesktopApp\wetter.com DesktopApp.exe
Toolbar-Locked - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\fshoster]
"ImagePath"="\"c:\program files (x86)\Kabel BW\fshoster32.exe\" -hosterid:0"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\F-Secure\My Services Agent\Protected]
@Denied: ) (Everyone)
"AgentIdentifier"="00f9337a-6382-4c4c-ae00-46f007ba30b0"
"AuthorizationCode"=""
"47731_AgentIdentifier"="00f9337a-6382-4c4c-ae00-46f007ba30b0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e96d-e325-11ce-bfc1-08002be10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e96d-e325-11ce-bfc1-08002be10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
@SACL=(02 0000)
.
Zeit der Fertigstellung: 2013-10-07 20:08:19
ComboFix-quarantined-files.txt 2013-10-07 18:08
.
Vor Suchlauf: 638.248.878.080 byte disponibili
Nach Suchlauf: 637.966.376.960 byte disponibili
.
- - End Of File - - C6D07AAE5C73EA50A0E2CFC49A6450BD
5FB38429D5D77768867C76DCBDB35194
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-10-2013
Ran by Tizi (administrator) on TIZHEN on 07-10-2013 21:49:26
Running from C:\Users\Tizi\Downloads
Windows 8 (X64) OS Language: Italian Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\windows\system32\atiesrxx.exe
(AMD) C:\windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\adminservice.exe
(Microsoft Corporation) C:\windows\system32\dashost.exe
(Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\Settings\CmdServer\EasyLauncher.exe
(F-Secure Corporation) C:\Program Files (x86)\Kabel BW\fshoster32.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\Program Files (x86)\Samsung\Settings\CmdServer\EasySettingsCmdServer.exe
(Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\Settings\sSettings.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Qualcomm Atheros) C:\Program Files (x86)\Bluetooth Suite\BtTray.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(AppEx Networks Corporation) C:\Program Files\AMD Quick Stream\AppexAcceleratorUI.exe
() C:\Program Files (x86)\Bluetooth Suite\ActivateDesktop.exe
(Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
() C:\Windows\Samsung\PanelMgr\SSMMgr.exe
(F-Secure Corporation) C:\Program Files (x86)\Kabel BW\fshoster32.exe
() C:\Windows\Samsung\PanelMgr\caller64.exe
(Samsung Electronics CO., LTD.) C:\Program Files\Samsung\S Agent\CommonAgent.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Samsung Electronics CO., LTD.) C:\Program Files\Samsung\Support Center\GuaranaAgent.exe
(Microsoft Corporation) C:\windows\ImmersiveControlPanel\SystemSettings.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
(Adobe Systems, Inc.) C:\windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
(Microsoft Corporation) \\?\C:\windows\system32\wbem\WMIADAP.EXE
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13191824 2012-08-10] (Realtek Semiconductor)
HKLM\...\Run: [BtTray] - C:\Program Files (x86)\Bluetooth Suite\BtTray.exe [766080 2012-12-05] (Qualcomm Atheros)
HKLM\...\Run: [BtvStack] - C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [128640 2012-12-05] (Atheros Communications)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19875432 2013-06-21] (Skype Technologies S.A.)
HKCU\...\Run: [AppEx Accelerator UI] - C:\Program Files\AMD Quick Stream\AppexAcceleratorUI.exe [1000288 2012-05-22] (AppEx Networks Corporation)
HKCU\...\Policies\system: [DisableLockWorkstation] 0
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [40312 2013-09-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [RemoteControl10] - C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [97392 2012-08-15] (CyberLink Corp.)
HKLM-x32\...\Run: [CLMLServer_For_P2G8] - C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111120 2012-06-08] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] - C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [491120 2012-07-12] (CyberLink Corp.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [681032 2013-10-07] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Samsung PanelMgr] - C:\Windows\Samsung\PanelMgr\SSMMgr.exe [618496 2010-06-23] ()
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642216 2012-09-12] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [F-Secure Hoster (47731)] - C:\Program Files (x86)\Kabel BW\fshoster32.exe [191424 2013-05-15] (F-Secure Corporation)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://samsung13.msn.com
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {A594556A-28DF-4FBF-8A03-86D260961795} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MASMJS
SearchScopes: HKLM - {A594556A-28DF-4FBF-8A03-86D260961795} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MASMJS
SearchScopes: HKLM-x32 - DefaultScope {A594556A-28DF-4FBF-8A03-86D260961795} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MASMJS
SearchScopes: HKLM-x32 - {A594556A-28DF-4FBF-8A03-86D260961795} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MASMJS
SearchScopes: HKCU - DefaultScope {A594556A-28DF-4FBF-8A03-86D260961795} URL =
SearchScopes: HKCU - {A594556A-28DF-4FBF-8A03-86D260961795} URL =
BHO: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Qualcomm Atheros Commnucations)
BHO: Skype add-on for Internet Explorer - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM-x32 {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files (x86)\Yahoo!\Common\Yinsthelper.dll
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Tizi\AppData\Roaming\Mozilla\Firefox\Profiles\dz8hlq9r.default
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3503.0728 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: yaxmpb@yahoo.com/YahooActiveXPluginBridge;version=1.0.0.1 - C:\Program Files (x86)\Yahoo!\Common\npyaxmpb.dll (Yahoo! Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440392 2013-10-07] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440392 2013-10-07] (Avira Operations GmbH & Co. KG)
R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [231552 2012-12-05] (Qualcomm Atheros Commnucations)
R2 Easy Launcher; C:\Program Files (x86)\Samsung\Settings\CmdServer\EasyLauncher.exe [1593976 2012-08-26] (Samsung Electronics CO., LTD.)
R2 fshoster; C:\Program Files (x86)\Kabel BW\fshoster32.exe [191424 2013-05-15] (F-Secure Corporation)
S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S2 SWUpdateService; C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe [3017776 2013-07-12] (Samsung Electronics CO., LTD.)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)
R2 ZAtheros Bt and Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [323584 2012-12-05] (Atheros)
==================== Drivers (Whitelisted) ====================
R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [35496 2012-07-09] (Advanced Micro Devices, Inc.)
R2 APXACC; C:\Windows\system32\DRIVERS\appexDrv.sys [199008 2012-06-23] (AppEx Networks Corporation)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [91648 2012-08-21] (Advanced Micro Devices)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105856 2013-10-07] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [132600 2013-10-07] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-10-07] (Avira Operations GmbH & Co. KG)
R3 BTATH_HID; C:\Windows\system32\DRIVERS\btath_hid.sys [222360 2012-12-05] (Qualcomm Atheros)
R3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2012-12-05] (Qualcomm Atheros)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
S3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 RadioHIDMini; C:\Windows\System32\drivers\RadioHIDMini.sys [23408 2012-07-27] (Windows (R) Win 7 DDK provider)
U5 AppMgmt; C:\Windows\system32\svchost.exe [29696 2013-08-04] (Microsoft Corporation)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-10-08 01:16 - 2013-10-08 01:16 - 00000000 ____D C:\FRST
2013-10-07 20:08 - 2013-10-07 20:08 - 00019824 _____ C:\ComboFix.txt
2013-10-07 19:43 - 2011-06-26 08:45 - 00256000 _____ C:\windows\PEV.exe
2013-10-07 19:43 - 2010-11-07 19:20 - 00208896 _____ C:\windows\MBR.exe
2013-10-07 19:43 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2013-10-07 19:43 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2013-10-07 19:43 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2013-10-07 19:43 - 2000-08-31 02:00 - 00212480 _____ (SteelWerX) C:\windows\SWXCACLS.exe
2013-10-07 19:43 - 2000-08-31 02:00 - 00098816 _____ C:\windows\sed.exe
2013-10-07 19:43 - 2000-08-31 02:00 - 00080412 _____ C:\windows\grep.exe
2013-10-07 19:43 - 2000-08-31 02:00 - 00068096 _____ C:\windows\zip.exe
2013-10-07 19:42 - 2013-10-07 20:08 - 00000000 ____D C:\Qoobox
2013-10-07 19:42 - 2013-10-07 20:02 - 00000000 ____D C:\windows\erdnt
2013-10-07 19:35 - 2013-10-07 19:35 - 05130782 ____R (Swearware) C:\Users\Tizi\Desktop\ComboFix.exe
2013-10-07 17:51 - 2013-10-07 17:55 - 00020222 _____ C:\Users\Tizi\Downloads\Addition.txt
2013-10-07 17:48 - 2013-10-07 17:48 - 01954124 _____ (Farbar) C:\Users\Tizi\Downloads\FRST64.exe
2013-10-07 16:25 - 2013-10-07 16:31 - 00000000 ___RD C:\Users\Tizi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2013-10-07 15:38 - 2013-08-07 07:15 - 00144896 _____ (Microsoft Corporation) C:\windows\system32\tssdisai.dll
2013-10-07 15:36 - 2013-10-07 15:36 - 00377856 _____ C:\Users\Tizi\Downloads\gmer_2.1.19163.exe
2013-10-07 15:32 - 2013-05-02 17:29 - 00278800 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe
2013-09-19 20:07 - 2013-09-19 20:07 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-11 08:34 - 2013-09-11 08:34 - 00002029 _____ C:\Users\Public\Desktop\Adobe Reader X.lnk
2013-09-10 21:55 - 2013-09-10 21:55 - 97004533 _____ C:\windows\SysWOW64\᯾瞈⒨Å߿
2013-09-08 19:33 - 2013-09-08 19:33 - 00000000 ____D C:\Users\Tizi\AppData\Roaming\CyberLink
2013-09-08 19:33 - 2013-09-08 19:33 - 00000000 ____D C:\Users\Public\Documents\CyberLink
2013-09-08 19:33 - 2013-09-08 19:33 - 00000000 ____D C:\Users\Public\CyberLink
==================== One Month Modified Files and Folders =======
2013-10-08 01:16 - 2013-10-08 01:16 - 00000000 ____D C:\FRST
2013-10-07 21:48 - 2013-07-02 20:32 - 00000000 ____D C:\Users\Tizi\AppData\Roaming\Skype
2013-10-07 20:19 - 2012-09-03 12:31 - 00000360 _____ C:\windows\Tasks\Xerox PhotoCafe Communicator.job
2013-10-07 20:08 - 2013-10-07 20:08 - 00019824 _____ C:\ComboFix.txt
2013-10-07 20:08 - 2013-10-07 19:42 - 00000000 ____D C:\Qoobox
2013-10-07 20:08 - 2012-07-26 07:37 - 00000000 __RHD C:\Users\Default
2013-10-07 20:04 - 2013-04-07 22:46 - 00000000 ___RD C:\Users\Tizi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-10-07 20:02 - 2013-10-07 19:42 - 00000000 ____D C:\windows\erdnt
2013-10-07 20:02 - 2012-07-26 10:12 - 00000000 ____D C:\windows\system32\sru
2013-10-07 20:01 - 2012-07-26 07:26 - 00000215 _____ C:\windows\system.ini
2013-10-07 19:37 - 2013-06-30 00:37 - 00000978 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2013-10-07 19:35 - 2013-10-07 19:35 - 05130782 ____R (Swearware) C:\Users\Tizi\Desktop\ComboFix.exe
2013-10-07 18:15 - 2012-09-04 03:12 - 00780976 _____ C:\windows\system32\perfh010.dat
2013-10-07 18:15 - 2012-09-04 03:12 - 00152608 _____ C:\windows\system32\perfc010.dat
2013-10-07 18:15 - 2012-07-26 09:28 - 01781840 _____ C:\windows\system32\PerfStringBackup.INI
2013-10-07 17:55 - 2013-10-07 17:51 - 00020222 _____ C:\Users\Tizi\Downloads\Addition.txt
2013-10-07 17:49 - 2013-04-07 22:45 - 00000000 ____D C:\Users\Tizi\AppData\Local\CrashDumps
2013-10-07 17:49 - 2012-09-03 11:16 - 01792973 _____ C:\windows\WindowsUpdate.log
2013-10-07 17:48 - 2013-10-07 17:48 - 01954124 _____ (Farbar) C:\Users\Tizi\Downloads\FRST64.exe
2013-10-07 17:40 - 2013-04-07 22:48 - 00000000 ____D C:\Users\Tizi\Documents\Bluetooth Folder
2013-10-07 17:05 - 2013-08-15 15:21 - 00000000 ____D C:\windows\system32\MRT
2013-10-07 17:02 - 2013-06-30 01:04 - 79143768 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2013-10-07 16:31 - 2013-10-07 16:25 - 00000000 ___RD C:\Users\Tizi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2013-10-07 16:31 - 2013-08-10 17:12 - 00000000 ____D C:\ProgramData\Atheros
2013-10-07 16:27 - 2012-09-03 12:18 - 00000000 ____D C:\ProgramData\WinClon
2013-10-07 16:26 - 2013-07-31 00:15 - 00323072 ___SH C:\Users\Tizi\Desktop\Thumbs.db
2013-10-07 16:23 - 2012-07-26 09:22 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-10-07 16:10 - 2013-06-30 00:05 - 00083160 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avnetflt.sys
2013-10-07 16:10 - 2013-06-30 00:03 - 00132600 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys
2013-10-07 16:10 - 2013-06-30 00:03 - 00105856 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys
2013-10-07 16:10 - 2013-06-30 00:03 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avkmgr.sys
2013-10-07 15:55 - 2012-07-26 10:12 - 00000000 ____D C:\windows\AUInstallAgent
2013-10-07 15:36 - 2013-10-07 15:36 - 00377856 _____ C:\Users\Tizi\Downloads\gmer_2.1.19163.exe
2013-10-07 15:06 - 2012-07-26 07:26 - 00262144 ___SH C:\windows\system32\config\BBI
2013-10-07 14:55 - 2013-06-29 23:40 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-10-07 14:52 - 2012-07-26 09:21 - 00029318 _____ C:\windows\setupact.log
2013-10-01 17:20 - 2013-06-30 15:25 - 00000072 _____ C:\Users\Public\LMDebug.log
2013-09-24 09:28 - 2013-07-02 20:31 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-09-22 21:29 - 2013-08-28 00:02 - 00000000 ____D C:\Program Files (x86)\Kabel BW
2013-09-19 20:07 - 2013-09-19 20:07 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-19 19:09 - 2013-04-07 22:52 - 00003600 _____ C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1161549151-3905956725-2365256691-1001
2013-09-15 09:35 - 2013-07-23 22:42 - 00000000 ____D C:\Users\Tizi\Desktop\Burda
2013-09-11 17:55 - 2013-08-03 11:05 - 00000000 ____D C:\Users\Tizi\Documents\Henrik
2013-09-11 13:51 - 2012-07-26 10:12 - 00000000 ____D C:\windows\rescache
2013-09-11 08:34 - 2013-09-11 08:34 - 00002029 _____ C:\Users\Public\Desktop\Adobe Reader X.lnk
2013-09-11 08:22 - 2012-08-05 23:07 - 00787484 _____ C:\windows\PFRO.log
2013-09-10 21:55 - 2013-09-10 21:55 - 97004533 _____ C:\windows\SysWOW64\᯾瞈⒨Å߿
2013-09-10 19:38 - 2013-06-30 00:37 - 00003866 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2013-09-08 19:33 - 2013-09-08 19:33 - 00000000 ____D C:\Users\Tizi\AppData\Roaming\CyberLink
2013-09-08 19:33 - 2013-09-08 19:33 - 00000000 ____D C:\Users\Public\Documents\CyberLink
2013-09-08 19:33 - 2013-09-08 19:33 - 00000000 ____D C:\Users\Public\CyberLink
2013-09-08 19:33 - 2012-09-03 12:27 - 00000000 ____D C:\ProgramData\CyberLink
Files to move or delete:
====================
C:\ProgramData\MakeMarkerFile.exe
Some content of TEMP:
====================
C:\Users\Tizi\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-09-29 12:16
==================== End Of Log ============================
--- --- --- |
|
07.10.2013, 22:12
| #6 | |
| /// TB-Ausbilder | Windows 8: Online-Banking Trojaner Hallo, Zitat:
__________________ --> Windows 8: Online-Banking Trojaner |
|
08.10.2013, 08:35
| #7 |
| | Windows 8: Online-Banking Trojaner Hallo Leo, das Online-Banking scheint jetzt normal zu funktionieren und das Fenster erscheint nicht mehr. Vielen Dank schon mal und Gruß, Mienk |
|
08.10.2013, 09:01
| #8 |
| /// TB-Ausbilder | Windows 8: Online-Banking Trojaner Hallo, das ist gut. Dann noch ein Kontrollscan (könnte etwas länger dauern): ESET Online Scanner
__________________ cheers, Leo |
|
08.10.2013, 15:32
| #9 |
| | Windows 8: Online-Banking Trojaner Hallo Leo, habe ESET durchlaufen lassen. Hier die Log-Datei. Cheers, Mienk Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=6ab524b509644f43858dd0f6323350dd
# engine=15398
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-10-08 02:26:30
# local_time=2013-10-08 04:26:30 (+0100, ora legale Europa occidentale)
# country="Germany"
# lang=1033
# osver=6.2.9200 NT
# compatibility_mode=1799 16775165 100 96 30320 246665680 23021 0
# compatibility_mode=5893 16776574 100 94 72761 8525865 0 0
# scanned=224247
# found=0
# cleaned=0
# scan_time=21856
|
|
08.10.2013, 16:03
| #10 |
| /// TB-Ausbilder | Windows 8: Online-Banking Trojaner Hallo, ok, sieht gut aus, wir räumen auf. Überprüfe noch mit diesem Plugin-Check (mit dem Firefox hier), ob alle deine verwendeten Versionen aktuell sind und update sie anderenfalls. Cleanup Zum Schluss werden wir jetzt noch unsere Tools (inklusive der Quarantäne-Ordner) wegräumen, die verseuchten Systemwiederherstellungspunkte löschen und alle Einstellungen wieder herrichten. Auch diese Schritte sind noch wichtig und sollten in der angegebenen Reihenfolge ausgeführt werden.
>> OK << Wir sind durch, deine Logs sehen für mich im Moment sauber aus.  Ich habe dir nachfolgend ein paar Hinweise und Tipps zusammengestellt, die dazu beitragen sollen, dass du in Zukunft unsere Hilfe nicht mehr brauchen wirst. Bitte gib mir danach noch eine kurze Rückmeldung, wenn auch von deiner Seite keine Probleme oder Fragen mehr offen sind, damit ich dieses Thema als erledigt betrachten kann. Epilog: Tipps, Dos & Don'ts  Aktualität von System und SoftwareDas Betriebsystem Windows muss zwingend immer auf dem neusten Stand sein. Stelle sicher, dass die automatischen Updates aktiviert sind:
Auch die installierte Software sollte immer in der aktuellsten Version vorliegen. Speziell gilt das für den Browser, Java, Flash-Player und PDF-Reader, denn bekannte Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim blossen Besuch einer präparierten Website per Drive-by Download Malware zu installieren. Das kann sogar auf normalerweise legitimen Websites geschehen, wenn es einem Angreifer gelungen ist, seinen Code in die Seite einzuschleusen, und ist deshalb relativ unberechenbar.
Sicherheits-SoftwareEine Bemerkung vorneweg: Jede Softwarelösung hat ihre Schwächen. Die gesamte Verantwortung für die Sicherheit auf Software zu übertragen und einen Rundum-Schutz zu erwarten, wäre eine gefährliche Illusion. Bei unbedachtem oder bewusst risikoreichem Verhalten wird auch das beste Programm früher oder später seinen Dienst versagen (z.B. ein Virenscanner, der eine verseuchte Datei nicht erkennt). Trotzdem ist entsprechende Software natürlich wichtig und hilft dir in Kombination mit einem gut gewarteten (up-to-date) System und durchdachtem Verhalten, deinen Rechner sauber zu halten.
Es liegt in der Natur der Sache, dass die am weitesten verbreitete Anwendungs-Software auch am häufigsten von Malware-Autoren attackiert wird. Es kann daher bereits einen kleinen Sicherheitsgewinn darstellen, wenn man alternative Software (z.B. einen alternativen PDF Reader) benutzt. Anstelle des Internet Explorers kann man beispielsweise den Mozilla Firefox einsetzen, für welchen es zwei nützliche Addons zur Empfehlung gibt:
(Un-)Sicheres Verhalten im InternetNebst unbemerkten Drive-by Installationen wird Malware aber auch oft mehr oder weniger aktiv vom Benutzer selbst installiert. Der Besuch zwielichtiger Websites kann bereits Risiken bergen. Und Downloads aus dubiosen Quellen sind immer russisches Roulette. Auch wenn der Virenscanner im Moment darin keine Bedrohung erkennt, muss das nichts bedeuten.
Oft wird auch versucht, den Benutzer mit mehr oder weniger trickreichen Methoden dazu zu bringen, eine für ihn verhängnisvolle Handlung selbst auszuführen (Überbegriff Social Engineering).
Nervige Adware (Werbung) und unnötige Toolbars werden auch meist durch den Benutzer selbst mitinstalliert.
Allgemeine HinweiseAbschliessend noch ein paar grundsätzliche Bemerkungen:
Wenn du möchtest, kannst du das Forum mit einer kleinen Spende unterstützen. Es bleibt mir nur noch, dir unbeschwertes und sicheres Surfen zu wünschen und dass wir uns hier so bald nicht wiedersehen. 
__________________ cheers, Leo |
|
08.10.2013, 23:23
| #11 |
| | Windows 8: Online-Banking Trojaner Hallo Leo, besten Dank für die Hilfe! Ich finde es echt klasse, dass ihr gemeinen PC-Nutzern wie mir eure Unterstützung bei Virenproblemen anbietet, Spende ist auch schon raus.  All the best, Mienk |
|
09.10.2013, 08:54
| #12 |
| /// TB-Ausbilder | Windows 8: Online-Banking Trojaner Danke für die Rückmeldung. Und im Namen des Teams vielen Dank für die Spende! Freut mich, dass wir helfen konnten.  Falls du dem Forum noch Verbesserungsvorschläge, Kritik oder ein Lob mitgeben möchtest, kannst du das hier tun. Dieses Thema scheint erledigt und wird aus meinen Abos gelöscht. Ich bekomme somit keine Benachrichtigung mehr über neue Antworten. Solltest du das Thema erneut brauchen, schicke mir bitte eine PM und wir machen hier weiter. Jeder andere bitte diese Anleitung lesen und einen eigenen Thread erstellen.
__________________ cheers, Leo |
|
| Themen zu Windows 8: Online-Banking Trojaner |
| .dll, adobe, adobe flash player, antivir, association, avg, avira, defender, desktop, e-banking, email, explorer, farbar, farbar recovery scan tool, flash player, hdaudio.sys, kabel bw, log-file, mailanhang, mozilla, online-banking, opera, realtek, registry, scan, services.exe, smartphone, svchost.exe, system, temp, trojaner, usbvideo.sys, windows, windows 8, winlogon.exe, wlan, yakes.dbwb |
Linear-Darstellung
