![]() |
|
Log-Analyse und Auswertung: Internet Game, Passwort wird immer geändertWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
![]() | #1 |
![]() | ![]() Internet Game, Passwort wird immer geändert Hallo Mir wurde im Game Aion mein Account gestohlen. Ich hab versucht mein Passwort zu ändern, doch kurz darauf hatte ich wieder keinen zugriff da mein Passwort wieder nicht stimmte. Nun befürchte ich das ich einen Trojaner am Pc habe. Da ich mit meiner Konzentration Probleme habe kann es sein das ich Fehler mache, deswegen bitte ich um Nachsicht und mir meine Fehler mitzuteilen. Ich bedanke mich dafür. Schritt 1: Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1) Log created at 21:17 on 16/10/2013 (Rainer) Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers... -=E.O.F=- Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-10-2013 Ran by Rainer (administrator) on RAINER-HP on 17-10-2013 06:49:44 Running from C:\Users\Rainer\Desktop Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 10 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (AMD) C:\Windows\system32\atiesrxx.exe (AMD) C:\Windows\system32\atieclxx.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe (EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe (AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Adobe Systems Incorporated) C:\Windows\system32\Macromed\Flash\FlashUtil64_11_8_800_175_ActiveX.exe (Emsisoft GmbH) C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe (Emsisoft GmbH) C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\a2guard.exe (Avira Operations GmbH & Co. KG) C:\program files (x86)\avira\antivir desktop\avcenter.exe (Avira Operations GmbH & Co. KG) C:\program files (x86)\avira\antivir desktop\avscan.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [Logitech Download Assistant] - C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.) HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1 HKCU\...\Run: [AdobeBridge] - [x] HKCU\...\Run: [] - [x] HKCU\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2010-12-22] (Google Inc.) HKCU\...\Run: [HydraVisionDesktopManager] - C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe [385024 2010-05-17] (AMD) HKCU\...\Policies\system: [DisableLockWorkstation] 0 HKCU\...\Policies\system: [DisableChangePassword] 0 HKLM-x32\...\Run: [AMD AVT] - C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe [10752 2012-02-20] () HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [248040 2010-02-18] (Sun Microsystems, Inc.) HKLM-x32\...\Run: [NPSStartup] - [x] HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-10-17] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [emsisoft anti-malware] - c:\program files (x86)\emsisoft anti-malware\a2guard.exe [4329408 2013-09-30] (Emsisoft GmbH) HKU\Default\...\Run: [HPAdvisorDock] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\DOCK\HPAdvisorDock.exe [1715768 2010-09-28] (Hewlett-Packard) Lsa: [Notification Packages] scecli C:\Program Files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll Startup: C:\Users\Rainer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gtfylcyrkalmndvmsmq.lnk ShortcutTarget: gtfylcyrkalmndvmsmq.lnk -> C:\Users\Rainer\AppData\Local\Temp\qmsmvdnmlakryclyftg.bfg (No File) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.at/ SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM - {64B0C37F-540F-4D57-9225-53352999F0F6} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms} SearchScopes: HKLM - {FD50D5E2-E74F-4FD6-803E-49E752A7B2D8} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPDTDF SearchScopes: HKLM-x32 - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=AT&userid=d4ad096b-36bc-4586-8d7b-028bc18d901c&searchtype=ds&q={searchTerms} SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM-x32 - {64B0C37F-540F-4D57-9225-53352999F0F6} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms} SearchScopes: HKLM-x32 - {FD50D5E2-E74F-4FD6-803E-49E752A7B2D8} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPDTDF SearchScopes: HKCU - DefaultScope {103C635C-B587-4326-8A93-86E6CC5C6530} URL = hxxp://search.softonic.com/MOY00006/tb_v1?q={searchTerms}&SearchSource=4&cc=&mi=de99e4ae00000000000000163839be03&r=407 SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=AT&userid=d4ad096b-36bc-4586-8d7b-028bc18d901c&searchtype=ds&q={searchTerms} SearchScopes: HKCU - {0D7562AE-8EF6-416d-A838-AB665251703A} URL = hxxp://start.facemoods.com/?a=gppc&s={searchTerms}&f=4 SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www2.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=DE9900163839BE03&affID=121565&tt=160913_c3&tsp=5011 SearchScopes: HKCU - {103C635C-B587-4326-8A93-86E6CC5C6530} URL = hxxp://search.softonic.com/MOY00006/tb_v1?q={searchTerms}&SearchSource=4&cc=&mi=de99e4ae00000000000000163839be03&r=407 SearchScopes: HKCU - {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=HIP&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=&apn_uid=9EBA2359-375D-4CCE-B637-BC3AFB2DD780&apn_sauid=AA1B5180-BF86-4121-870F-651664C6F98D SearchScopes: HKCU - {4A54C729-0E56-486C-81E9-6D7430F5DEB2} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms} SearchScopes: HKCU - {63A205E3-A458-4A4A-BC0F-3AB5FF459F17} URL = hxxp://go.gmx.at/tb/ie_searchplugin/?su={searchTerms} SearchScopes: HKCU - {64B0C37F-540F-4D57-9225-53352999F0F6} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms} SearchScopes: HKCU - {8387C727-F955-4757-A384-750EF28C2E5C} URL = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms} SearchScopes: HKCU - {9E38C6AD-D037-4B46-8856-389099714524} URL = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie SearchScopes: HKCU - {C2A8E89B-922D-45D9-B92B-E80CFDC4621F} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050&SSPV=IENOSGBR SearchScopes: HKCU - {FD50D5E2-E74F-4FD6-803E-49E752A7B2D8} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPDTDF BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC) BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation) BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard) Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File Toolbar: HKCU - No Name - {3BE093E7-4650-438B-AC6F-C944C30F81AD} - No File Toolbar: HKCU - No Name - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - No File Toolbar: HKCU - No Name - {C424171E-592A-415A-9EB1-DFD6D95D3530} - No File Toolbar: HKCU - No Name - {EEE6C35B-6118-11DC-9C72-001320C79847} - No File DPF: HKLM-x32 {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: HKLM-x32 {233C1507-6A77-46A4-9443-F871F945D258} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: HKLM-x32 {4871A87A-BFDD-4106-8153-FFDE2BAC2967} hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.7.cab DPF: HKLM-x32 {5852F5ED-8BF4-11D4-A245-0080C6F74284} hxxp://javadl-esd.oracle.com/update/1.6.0/jinstall-6u20-windows-i586.cab DPF: HKLM-x32 {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} hxxp://h20614.www2.hp.com/ediags/gmd/Install/Cab/hpdetect1259.cab DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWow64\EZUPBH~1.DLL [52920 2010-10-02] (EasyBits Software Corp.) Tcpip\Parameters: [DhcpNameServer] 10.0.0.1 Chrome: ======= Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION CHR Extension: (Softonic Chrome Toolbar) - C:\Users\Rainer\AppData\Local\Google\Chrome\User Data\Default\Extensions\elchiiiejkobdbblfejjkbphbddgmljf\1.0_0 CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx ==================== Services (Whitelisted) ================= R2 a2AntiMalware; C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe [4153784 2013-09-30] (Emsisoft GmbH) S4 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2012-06-11] (Advanced Micro Devices, Inc.) R2 AntiVirFirewallService; C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe [655928 2013-10-17] (Avira Operations GmbH & Co. KG) R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [622648 2013-10-17] (Avira Operations GmbH & Co. KG) R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-10-17] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-10-17] (Avira Operations GmbH & Co. KG) R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-10-17] (Avira Operations GmbH & Co. KG) S4 HP Power Assistant Service; C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe [107576 2010-03-11] () S4 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [635416 2009-10-15] (PDF Complete Inc) ==================== Drivers (Whitelisted) ==================== R3 a2acc; C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\a2accx64.sys [70960 2013-08-24] (Emsisoft GmbH) R3 a2acc; C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\a2accx64.sys [70960 2013-08-24] (Emsisoft GmbH) R1 A2DDA; C:\Program Files (x86)\Emsisoft Anti-Malware\a2ddax64.sys [26176 2013-03-28] (Emsisoft GmbH) R1 A2DDA; C:\Program Files (x86)\Emsisoft Anti-Malware\a2ddax64.sys [26176 2013-03-28] (Emsisoft GmbH) R1 a2injectiondriver; C:\Program Files (x86)\Emsisoft Anti-Malware\a2dix64.sys [45208 2013-09-30] (Emsisoft GmbH) R1 a2injectiondriver; C:\Program Files (x86)\Emsisoft Anti-Malware\a2dix64.sys [45208 2013-09-30] (Emsisoft GmbH) R1 a2util; C:\Program Files (x86)\Emsisoft Anti-Malware\a2util64.sys [17384 2013-03-28] (Emsisoft GmbH) R1 a2util; C:\Program Files (x86)\Emsisoft Anti-Malware\a2util64.sys [17384 2013-03-28] (Emsisoft GmbH) R2 AODDriver4.01; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [53888 2012-03-05] (Advanced Micro Devices) S2 AODDriver4.1; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [53888 2012-03-05] (Advanced Micro Devices) R3 avfwim; C:\Windows\System32\DRIVERS\avfwim.sys [114608 2013-10-17] (Avira GmbH) R1 avfwot; C:\Windows\System32\DRIVERS\avfwot.sys [141376 2013-10-17] (Avira GmbH) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-10-17] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-10-17] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-17] (Avira Operations GmbH & Co. KG) S3 camfilt2; C:\Windows\System32\DRIVERS\camfilt2.sys [137728 2007-08-06] (Guillemot Corporation) R3 cleanhlp; C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [57024 2013-08-19] (Emsisoft GmbH) R3 cleanhlp; C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [57024 2013-08-19] (Emsisoft GmbH) S3 CpqDfw; C:\Windows\System32\drivers\CpqDfw.sys [27456 2012-05-29] (Windows (R) Codename Longhorn DDK provider) S3 cqcpu; C:\Windows\System32\drivers\cqcpu.sys [24376 2010-04-27] () R2 DRHARD64; C:\Windows\system32\drivers\DRHARD64.sys [22216 2008-08-06] (Licensed for Gebhard Software) R3 GemCCID; C:\Windows\System32\Drivers\GemCCID.sys [129792 2013-04-24] (Gemalto) S3 SNPSTD3; C:\Windows\System32\DRIVERS\snpstd3.sys [10684672 2007-07-17] (Sonix Co. Ltd.) S3 DRHARD; \??\C:\Windows\system32\DRIVERS\DRHARD.SYS [x] U5 usbser; C:\Windows\System32\Drivers\usbser.sys [32768 2010-11-20] (Microsoft Corporation) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-10-17 06:15 - 2013-10-17 06:15 - 00001053 _____ C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk 2013-10-17 06:14 - 2013-10-17 06:37 - 00000000 ____D C:\Program Files (x86)\Emsisoft Anti-Malware 2013-10-17 06:14 - 2013-10-17 06:14 - 00000000 ____D C:\Users\Rainer\Documents\Anti-Malware 2013-10-17 05:34 - 2013-10-17 05:34 - 00004046 _____ C:\Users\Rainer\Desktop\Gmer.txt 2013-10-17 05:17 - 2013-10-17 05:17 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys 2013-10-17 05:13 - 2013-10-17 05:13 - 00001956 _____ C:\Users\Public\Desktop\Avira Control Center.lnk 2013-10-17 05:13 - 2013-10-17 05:13 - 00000000 ____D C:\Users\Rainer\AppData\Roaming\Avira 2013-10-17 05:11 - 2013-10-17 05:07 - 00141376 _____ (Avira GmbH) C:\Windows\system32\Drivers\avfwot.sys 2013-10-17 05:11 - 2013-10-17 05:07 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys 2013-10-17 05:11 - 2013-10-17 05:07 - 00114608 _____ (Avira GmbH) C:\Windows\system32\Drivers\avfwim.sys 2013-10-17 05:11 - 2013-10-17 05:07 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys 2013-10-17 05:11 - 2013-10-17 05:07 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys 2013-10-17 04:55 - 2013-10-17 04:56 - 109320144 _____ C:\Users\Rainer\Downloads\avira_internet_security_de.exe 2013-10-16 23:02 - 2013-10-16 23:02 - 02804344 _____ (TeamViewer GmbH) C:\Users\Rainer\Desktop\customermodule_avira_support_de.exe 2013-10-16 23:02 - 2013-10-16 23:02 - 00000000 ____D C:\Users\Rainer\AppData\Roaming\TeamViewer 2013-10-16 22:32 - 2013-10-16 22:32 - 02296760 _____ C:\Users\Rainer\Downloads\avira_internet_security_suite.exe 2013-10-16 21:57 - 2013-10-16 21:57 - 00000000 ____D C:\Users\Rainer\AppData\Local\{D8F3819E-830F-4579-B7F3-A12B1F2AEAF7} 2013-10-16 21:25 - 2013-10-16 21:25 - 00377856 _____ C:\Users\Rainer\Desktop\gmer_2.1.19163.exe 2013-10-16 21:22 - 2013-10-16 21:23 - 01954124 _____ (Farbar) C:\Users\Rainer\Desktop\FRST64.exe 2013-10-16 21:17 - 2013-10-16 21:17 - 00050477 _____ C:\Users\Rainer\Desktop\Defogger.exe 2013-10-16 21:17 - 2013-10-16 21:17 - 00000474 _____ C:\Users\Rainer\Desktop\defogger_disable.log 2013-10-16 18:42 - 2013-10-16 18:42 - 00000000 ____D C:\Users\Rainer\AppData\Local\{54F3558F-AB09-45C1-B3ED-747DBFC8B253} 2013-10-16 18:17 - 2013-10-16 18:17 - 00000000 ____D C:\FRST 2013-10-16 18:14 - 2013-10-16 18:15 - 00000000 _____ C:\Users\Rainer\defogger_reenable 2013-10-16 06:24 - 2013-10-16 06:24 - 00000000 ____D C:\Users\Rainer\AppData\Local\{B535722A-05DD-4E41-BEC1-7F221A1EC2A2} 2013-10-15 13:15 - 2013-10-15 13:15 - 00000000 ____D C:\Users\Rainer\AppData\Local\{9B36C213-A0D7-4F95-BEA6-8EFB51FB69C0} 2013-10-15 00:03 - 2013-10-15 00:03 - 00000000 ____D C:\Users\Rainer\AppData\Local\{BD588AF5-84D1-4978-85AC-F6FED14DC985} 2013-10-14 11:49 - 2013-10-14 11:49 - 00000000 ____D C:\Users\Rainer\AppData\Local\{C16EC071-F248-4A90-B1AC-8C10F7CCDF14} 2013-10-14 08:31 - 2013-10-14 08:31 - 00004621 _____ C:\Users\Rainer\AppData\Local\recently-used.xbel 2013-10-14 07:59 - 2013-10-14 08:32 - 00000000 ____D C:\Users\Rainer\Desktop\n 2013-10-13 23:49 - 2013-10-13 23:49 - 00000000 ____D C:\Users\Rainer\AppData\Local\{FD5325EA-C97F-423E-96A1-5CCB10F6617A} 2013-10-12 22:23 - 2013-09-04 14:12 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys 2013-10-12 22:23 - 2013-09-04 14:11 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys 2013-10-12 22:23 - 2013-09-04 14:11 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys 2013-10-12 22:23 - 2013-09-04 14:11 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys 2013-10-12 22:23 - 2013-09-04 14:11 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys 2013-10-12 22:23 - 2013-09-04 14:11 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys 2013-10-12 22:23 - 2013-09-04 14:11 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys 2013-10-12 18:49 - 2013-10-12 18:49 - 00000000 ____D C:\Users\Rainer\AppData\Local\{783D247C-9494-43CB-88DA-D3229BC55FB8} 2013-10-12 05:14 - 2013-10-12 05:14 - 00000000 ____D C:\Users\Rainer\AppData\Local\{9A28116B-F94D-4752-A711-DDCCC282BA36} 2013-10-11 11:53 - 2013-10-11 11:53 - 00000000 ____D C:\Users\Rainer\AppData\Local\{21487BEE-A3A1-4785-B7D5-FB949FFCCA94} 2013-10-10 20:00 - 2013-10-17 05:16 - 00099598 _____ C:\Windows\PFRO.log 2013-10-10 03:34 - 2013-09-23 01:28 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2013-10-10 03:34 - 2013-09-23 01:28 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2013-10-10 03:34 - 2013-09-23 01:27 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2013-10-10 03:34 - 2013-09-23 01:27 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2013-10-10 03:34 - 2013-09-23 01:27 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2013-10-10 03:34 - 2013-09-23 01:27 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2013-10-10 03:34 - 2013-09-23 01:27 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2013-10-10 03:34 - 2013-09-23 01:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll 2013-10-10 03:34 - 2013-09-23 01:27 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2013-10-10 03:34 - 2013-09-23 01:27 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2013-10-10 03:34 - 2013-09-23 01:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2013-10-10 03:34 - 2013-09-23 00:55 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2013-10-10 03:34 - 2013-09-23 00:55 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2013-10-10 03:34 - 2013-09-23 00:55 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2013-10-10 03:34 - 2013-09-23 00:54 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2013-10-10 03:34 - 2013-09-23 00:54 - 02647552 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2013-10-10 03:34 - 2013-09-23 00:54 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2013-10-10 03:34 - 2013-09-23 00:54 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2013-10-10 03:34 - 2013-09-23 00:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2013-10-10 03:34 - 2013-09-23 00:54 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2013-10-10 03:34 - 2013-09-23 00:54 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2013-10-10 03:34 - 2013-09-23 00:54 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2013-10-10 03:34 - 2013-09-23 00:54 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2013-10-10 03:34 - 2013-09-21 05:38 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2013-10-10 03:34 - 2013-09-21 05:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2013-10-10 03:34 - 2013-09-21 04:48 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe 2013-10-10 03:34 - 2013-09-21 04:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe 2013-10-10 03:33 - 2013-09-23 01:27 - 14335488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2013-10-10 03:33 - 2013-09-23 01:27 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2013-10-10 03:33 - 2013-09-23 00:54 - 19252224 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2013-10-10 03:33 - 2013-09-23 00:54 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2013-10-09 23:25 - 2013-09-14 03:10 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys 2013-10-09 23:25 - 2013-09-08 04:30 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys 2013-10-09 23:25 - 2013-09-08 04:27 - 00327168 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll 2013-10-09 23:25 - 2013-09-08 04:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswsock.dll 2013-10-09 23:25 - 2013-08-29 04:17 - 05549504 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2013-10-09 23:25 - 2013-08-29 04:16 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll 2013-10-09 23:25 - 2013-08-29 04:13 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll 2013-10-09 23:25 - 2013-08-29 03:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2013-10-09 23:25 - 2013-08-29 03:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2013-10-09 23:25 - 2013-08-28 03:21 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2013-10-09 23:25 - 2013-07-12 12:41 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys 2013-10-09 23:25 - 2013-07-12 12:40 - 00109824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBAUDIO.sys 2013-10-09 23:25 - 2013-07-04 14:57 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll 2013-10-09 23:25 - 2013-07-04 14:50 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll 2013-10-09 23:25 - 2013-07-04 14:50 - 00102400 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll 2013-10-09 23:25 - 2013-07-04 13:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll 2013-10-09 23:25 - 2013-07-04 13:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll 2013-10-09 23:25 - 2013-07-04 13:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll 2013-10-09 23:25 - 2013-07-04 12:11 - 00140800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys 2013-10-09 23:25 - 2013-07-03 06:40 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys 2013-10-09 23:25 - 2013-07-03 06:05 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys 2013-10-09 23:25 - 2013-07-03 06:05 - 00032896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys 2013-10-09 23:25 - 2013-06-26 00:55 - 00785624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys 2013-10-09 23:25 - 2013-06-06 07:50 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll 2013-10-09 23:25 - 2013-06-06 07:49 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll 2013-10-09 23:25 - 2013-06-06 07:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll 2013-10-09 23:25 - 2013-06-06 07:47 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll 2013-10-09 23:25 - 2013-06-06 06:57 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll 2013-10-09 23:25 - 2013-06-06 06:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll 2013-10-09 23:25 - 2013-06-06 06:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll 2013-10-09 23:25 - 2013-06-06 05:30 - 00368128 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll 2013-10-09 23:25 - 2013-06-06 05:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll 2013-10-09 23:25 - 2013-06-06 05:01 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll 2013-10-09 23:24 - 2013-08-29 04:16 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll 2013-10-09 23:24 - 2013-08-29 04:16 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll 2013-10-09 23:24 - 2013-08-29 03:50 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll 2013-10-09 23:24 - 2013-08-29 03:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll 2013-10-09 23:24 - 2013-08-29 03:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll 2013-10-09 23:24 - 2013-08-29 03:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll 2013-10-09 23:24 - 2013-08-29 02:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe 2013-10-09 23:24 - 2013-08-29 02:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll 2013-10-09 23:24 - 2013-08-29 02:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe 2013-10-09 23:24 - 2013-08-29 02:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe 2013-10-09 23:24 - 2013-08-28 03:12 - 00461312 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll 2013-10-09 23:24 - 2013-08-01 14:09 - 00983488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys 2013-10-09 23:24 - 2013-07-20 12:33 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll 2013-10-09 23:24 - 2013-07-20 12:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll 2013-10-08 15:47 - 2013-10-08 15:30 - 00000493 _____ C:\Users\Rainer\Documents\aionmemo_facde51e.bak 2013-10-08 09:20 - 2013-10-08 09:20 - 00000000 ____D C:\Users\Rainer\AppData\Local\{F6EC67EB-94D7-437C-A3E3-854DF99C170E} 2013-10-07 14:21 - 2013-10-07 14:21 - 00000000 ____D C:\Users\Rainer\AppData\Local\{C0B34E10-C55C-4DEF-A0CC-5E93A4290668} 2013-10-03 10:24 - 2013-10-17 05:56 - 00001120 _____ C:\Windows\setupact.log 2013-10-03 10:24 - 2013-10-10 20:01 - 04950832 _____ C:\Windows\system32\FNTCACHE.DAT 2013-10-03 10:24 - 2013-10-03 10:24 - 00000000 _____ C:\Windows\setuperr.log 2013-10-03 10:21 - 2013-10-03 10:21 - 00079432 _____ C:\Users\Rainer\AppData\Local\GDIPFONTCACHEV1.DAT 2013-10-03 10:21 - 2013-10-03 10:21 - 00000000 ____D C:\Users\Rainer\AppData\Local\{105914EB-CB72-4206-9FA1-451F4A47F3E0} 2013-10-02 01:27 - 2013-10-02 01:28 - 00000000 ____D C:\Users\Rainer\AppData\Local\{4158FA2E-7953-4072-83DA-8BDD9AC3AEC6} 2013-09-30 11:14 - 2013-09-30 11:14 - 00000000 ____D C:\Users\Rainer\AppData\Local\{A087747B-3A8C-4695-BC8F-D80BB19874CF} 2013-09-27 12:29 - 2013-09-27 12:30 - 00000000 ____D C:\Users\Rainer\AppData\Local\{EFE9D5C3-F7DB-40E8-ACE1-7E58D4B99C67} 2013-09-25 08:54 - 2013-09-25 08:54 - 00000000 ____D C:\Users\Rainer\AppData\Local\{7FC2F21A-A7F8-4C41-B557-505AF57F3EDB} 2013-09-24 13:55 - 2013-09-24 13:55 - 00000000 ____D C:\Users\Rainer\AppData\Local\{D6AE30E2-E34C-4A5E-BE1B-BA3C32AD1124} 2013-09-22 04:52 - 2013-09-22 04:52 - 00000000 ____D C:\Users\Rainer\AppData\Local\{A97A5B90-7CD3-4CCC-B44E-5B12FF7AF311} 2013-09-20 10:37 - 2013-09-20 10:37 - 00003126 _____ C:\Windows\System32\Tasks\{2149C150-DFD4-43EF-8447-829BEFB160EC} 2013-09-20 10:23 - 2013-10-17 06:23 - 00000294 _____ C:\Windows\Tasks\Dealply.job 2013-09-20 10:23 - 2013-09-20 10:34 - 00000000 ____D C:\Program Files (x86)\DealPly 2013-09-20 10:23 - 2013-09-20 10:23 - 00003238 _____ C:\Windows\System32\Tasks\Dealply 2013-09-20 10:22 - 2013-10-02 10:34 - 00000000 ____D C:\ProgramData\DSearchLink 2013-09-20 10:22 - 2013-10-02 10:34 - 00000000 ____D C:\ProgramData\BitGuard 2013-09-20 10:22 - 2013-09-20 14:33 - 00000000 ____D C:\Users\Rainer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BitGuard 2013-09-20 10:22 - 2013-09-20 10:23 - 00003420 _____ C:\Windows\System32\Tasks\BitGuard 2013-09-20 10:22 - 2013-09-20 10:22 - 00000000 ____D C:\Windows\SysWOW64\searchplugins 2013-09-20 10:22 - 2013-09-20 10:22 - 00000000 ____D C:\Windows\SysWOW64\Extensions 2013-09-20 10:22 - 2013-09-20 10:22 - 00000000 ____D C:\ProgramData\Babylon 2013-09-19 21:06 - 2013-09-19 21:07 - 00000000 ____D C:\Users\Rainer\AppData\Local\{CF11E99B-8923-48FC-94FB-789E3EBD2330} 2013-09-18 06:10 - 2013-09-18 06:10 - 00000000 ____D C:\Users\Rainer\AppData\Local\{F5AE5685-5D5E-4BB7-957E-8D70E3E466A3} ==================== One Month Modified Files and Folders ======= 2013-10-17 06:48 - 2012-04-12 05:57 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-10-17 06:37 - 2013-10-17 06:14 - 00000000 ____D C:\Program Files (x86)\Emsisoft Anti-Malware 2013-10-17 06:26 - 2010-12-22 18:24 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2013-10-17 06:23 - 2013-09-20 10:23 - 00000294 _____ C:\Windows\Tasks\Dealply.job 2013-10-17 06:15 - 2013-10-17 06:15 - 00001053 _____ C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk 2013-10-17 06:14 - 2013-10-17 06:14 - 00000000 ____D C:\Users\Rainer\Documents\Anti-Malware 2013-10-17 06:05 - 2009-07-14 06:45 - 00015792 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-10-17 06:05 - 2009-07-14 06:45 - 00015792 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-10-17 06:00 - 2011-05-23 05:38 - 01280878 _____ C:\Windows\WindowsUpdate.log 2013-10-17 05:57 - 2010-12-22 18:24 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2013-10-17 05:57 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2013-10-17 05:56 - 2013-10-03 10:24 - 00001120 _____ C:\Windows\setupact.log 2013-10-17 05:34 - 2013-10-17 05:34 - 00004046 _____ C:\Users\Rainer\Desktop\Gmer.txt 2013-10-17 05:17 - 2013-10-17 05:17 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys 2013-10-17 05:16 - 2013-10-10 20:00 - 00099598 _____ C:\Windows\PFRO.log 2013-10-17 05:13 - 2013-10-17 05:13 - 00001956 _____ C:\Users\Public\Desktop\Avira Control Center.lnk 2013-10-17 05:13 - 2013-10-17 05:13 - 00000000 ____D C:\Users\Rainer\AppData\Roaming\Avira 2013-10-17 05:11 - 2012-10-10 09:13 - 00000000 ____D C:\Program Files (x86)\Avira 2013-10-17 05:11 - 2011-10-15 00:01 - 00000000 ____D C:\ProgramData\Avira 2013-10-17 05:07 - 2013-10-17 05:11 - 00141376 _____ (Avira GmbH) C:\Windows\system32\Drivers\avfwot.sys 2013-10-17 05:07 - 2013-10-17 05:11 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys 2013-10-17 05:07 - 2013-10-17 05:11 - 00114608 _____ (Avira GmbH) C:\Windows\system32\Drivers\avfwim.sys 2013-10-17 05:07 - 2013-10-17 05:11 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys 2013-10-17 05:07 - 2013-10-17 05:11 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys 2013-10-17 04:56 - 2013-10-17 04:55 - 109320144 _____ C:\Users\Rainer\Downloads\avira_internet_security_de.exe 2013-10-16 23:02 - 2013-10-16 23:02 - 02804344 _____ (TeamViewer GmbH) C:\Users\Rainer\Desktop\customermodule_avira_support_de.exe 2013-10-16 23:02 - 2013-10-16 23:02 - 00000000 ____D C:\Users\Rainer\AppData\Roaming\TeamViewer 2013-10-16 22:32 - 2013-10-16 22:32 - 02296760 _____ C:\Users\Rainer\Downloads\avira_internet_security_suite.exe 2013-10-16 22:18 - 2013-02-09 17:02 - 00011776 ___SH C:\Users\Rainer\Thumbs.db 2013-10-16 21:57 - 2013-10-16 21:57 - 00000000 ____D C:\Users\Rainer\AppData\Local\{D8F3819E-830F-4579-B7F3-A12B1F2AEAF7} 2013-10-16 21:25 - 2013-10-16 21:25 - 00377856 _____ C:\Users\Rainer\Desktop\gmer_2.1.19163.exe 2013-10-16 21:23 - 2013-10-16 21:22 - 01954124 _____ (Farbar) C:\Users\Rainer\Desktop\FRST64.exe 2013-10-16 21:17 - 2013-10-16 21:17 - 00050477 _____ C:\Users\Rainer\Desktop\Defogger.exe 2013-10-16 21:17 - 2013-10-16 21:17 - 00000474 _____ C:\Users\Rainer\Desktop\defogger_disable.log 2013-10-16 18:42 - 2013-10-16 18:42 - 00000000 ____D C:\Users\Rainer\AppData\Local\{54F3558F-AB09-45C1-B3ED-747DBFC8B253} 2013-10-16 18:17 - 2013-10-16 18:17 - 00000000 ____D C:\FRST 2013-10-16 18:15 - 2013-10-16 18:14 - 00000000 _____ C:\Users\Rainer\defogger_reenable 2013-10-16 18:15 - 2010-12-15 18:47 - 00000000 ____D C:\Users\Rainer 2013-10-16 06:24 - 2013-10-16 06:24 - 00000000 ____D C:\Users\Rainer\AppData\Local\{B535722A-05DD-4E41-BEC1-7F221A1EC2A2} 2013-10-15 13:15 - 2013-10-15 13:15 - 00000000 ____D C:\Users\Rainer\AppData\Local\{9B36C213-A0D7-4F95-BEA6-8EFB51FB69C0} 2013-10-15 00:03 - 2013-10-15 00:03 - 00000000 ____D C:\Users\Rainer\AppData\Local\{BD588AF5-84D1-4978-85AC-F6FED14DC985} 2013-10-14 11:49 - 2013-10-14 11:49 - 00000000 ____D C:\Users\Rainer\AppData\Local\{C16EC071-F248-4A90-B1AC-8C10F7CCDF14} 2013-10-14 08:54 - 2013-01-13 10:10 - 00000000 ____D C:\Users\Rainer\.gimp-2.8 2013-10-14 08:32 - 2013-10-14 07:59 - 00000000 ____D C:\Users\Rainer\Desktop\n 2013-10-14 08:31 - 2013-10-14 08:31 - 00004621 _____ C:\Users\Rainer\AppData\Local\recently-used.xbel 2013-10-14 08:00 - 2010-10-02 13:49 - 00702138 _____ C:\Windows\system32\perfh007.dat 2013-10-14 08:00 - 2010-10-02 13:49 - 00150874 _____ C:\Windows\system32\perfc007.dat 2013-10-14 08:00 - 2009-07-14 07:13 - 01628640 _____ C:\Windows\system32\PerfStringBackup.INI 2013-10-13 23:49 - 2013-10-13 23:49 - 00000000 ____D C:\Users\Rainer\AppData\Local\{FD5325EA-C97F-423E-96A1-5CCB10F6617A} 2013-10-13 13:11 - 2013-06-08 15:58 - 00003192 _____ C:\Windows\System32\Tasks\HPCeeScheduleForRainer 2013-10-13 13:11 - 2013-02-07 15:57 - 00000336 _____ C:\Windows\Tasks\HPCeeScheduleForRainer.job 2013-10-12 18:49 - 2013-10-12 18:49 - 00000000 ____D C:\Users\Rainer\AppData\Local\{783D247C-9494-43CB-88DA-D3229BC55FB8} 2013-10-12 07:42 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache 2013-10-12 05:28 - 2013-03-01 17:36 - 00000082 _____ C:\Users\Rainer\Documents\aionmemo_facde51e.dat 2013-10-12 05:14 - 2013-10-12 05:14 - 00000000 ____D C:\Users\Rainer\AppData\Local\{9A28116B-F94D-4752-A711-DDCCC282BA36} 2013-10-11 11:53 - 2013-10-11 11:53 - 00000000 ____D C:\Users\Rainer\AppData\Local\{21487BEE-A3A1-4785-B7D5-FB949FFCCA94} 2013-10-10 20:02 - 2009-07-24 21:22 - 00000000 ____D C:\Windows\Panther 2013-10-10 20:01 - 2013-10-03 10:24 - 04950832 _____ C:\Windows\system32\FNTCACHE.DAT 2013-10-10 20:00 - 2013-03-13 04:02 - 00000000 ____D C:\Program Files\Microsoft Silverlight 2013-10-10 20:00 - 2013-03-13 04:02 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight 2013-10-10 11:51 - 2010-12-16 20:29 - 00000000 ____D C:\Users\Rainer\AppData\Roaming\HP Support Assistant 2013-10-10 11:51 - 2010-12-16 19:50 - 00000000 ____D C:\Users\Rainer\AppData\Roaming\HpUpdate 2013-10-10 03:37 - 2010-12-20 18:51 - 00000000 ____D C:\ProgramData\Microsoft Help 2013-10-10 03:28 - 2011-11-11 13:11 - 01605598 _____ C:\Windows\SysWOW64\PerfStringBackup.INI 2013-10-10 03:21 - 2013-08-15 03:02 - 00000000 ____D C:\Windows\system32\MRT 2013-10-10 03:11 - 2010-12-18 18:27 - 80541720 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2013-10-10 00:21 - 2010-12-22 18:24 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2013-10-10 00:21 - 2010-12-22 18:24 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2013-10-08 15:30 - 2013-10-08 15:47 - 00000493 _____ C:\Users\Rainer\Documents\aionmemo_facde51e.bak 2013-10-08 09:20 - 2013-10-08 09:20 - 00000000 ____D C:\Users\Rainer\AppData\Local\{F6EC67EB-94D7-437C-A3E3-854DF99C170E} 2013-10-07 14:21 - 2013-10-07 14:21 - 00000000 ____D C:\Users\Rainer\AppData\Local\{C0B34E10-C55C-4DEF-A0CC-5E93A4290668} 2013-10-07 14:20 - 2013-07-25 19:18 - 00001029 _____ C:\Users\Public\Desktop\Gameforge Live.lnk 2013-10-07 14:20 - 2013-07-25 19:18 - 00000000 ____D C:\Program Files (x86)\GameforgeLive 2013-10-03 10:24 - 2013-10-03 10:24 - 00000000 _____ C:\Windows\setuperr.log 2013-10-03 10:21 - 2013-10-03 10:21 - 00079432 _____ C:\Users\Rainer\AppData\Local\GDIPFONTCACHEV1.DAT 2013-10-03 10:21 - 2013-10-03 10:21 - 00000000 ____D C:\Users\Rainer\AppData\Local\{105914EB-CB72-4206-9FA1-451F4A47F3E0} 2013-10-02 21:47 - 2012-12-25 01:44 - 00000000 ____D C:\Users\Rainer\AppData\Local\CrashDumps 2013-10-02 10:34 - 2013-09-20 10:22 - 00000000 ____D C:\ProgramData\DSearchLink 2013-10-02 10:34 - 2013-09-20 10:22 - 00000000 ____D C:\ProgramData\BitGuard 2013-10-02 01:28 - 2013-10-02 01:27 - 00000000 ____D C:\Users\Rainer\AppData\Local\{4158FA2E-7953-4072-83DA-8BDD9AC3AEC6} 2013-10-02 00:21 - 2011-12-29 23:43 - 00007602 _____ C:\Users\Rainer\AppData\Local\resmon.resmoncfg 2013-09-30 11:14 - 2013-09-30 11:14 - 00000000 ____D C:\Users\Rainer\AppData\Local\{A087747B-3A8C-4695-BC8F-D80BB19874CF} 2013-09-27 12:30 - 2013-09-27 12:29 - 00000000 ____D C:\Users\Rainer\AppData\Local\{EFE9D5C3-F7DB-40E8-ACE1-7E58D4B99C67} 2013-09-25 08:54 - 2013-09-25 08:54 - 00000000 ____D C:\Users\Rainer\AppData\Local\{7FC2F21A-A7F8-4C41-B557-505AF57F3EDB} 2013-09-24 13:55 - 2013-09-24 13:55 - 00000000 ____D C:\Users\Rainer\AppData\Local\{D6AE30E2-E34C-4A5E-BE1B-BA3C32AD1124} 2013-09-23 01:28 - 2013-10-10 03:34 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2013-09-23 01:28 - 2013-10-10 03:34 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2013-09-23 01:27 - 2013-10-10 03:34 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2013-09-23 01:27 - 2013-10-10 03:34 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2013-09-23 01:27 - 2013-10-10 03:34 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2013-09-23 01:27 - 2013-10-10 03:34 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2013-09-23 01:27 - 2013-10-10 03:34 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2013-09-23 01:27 - 2013-10-10 03:34 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll 2013-09-23 01:27 - 2013-10-10 03:34 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2013-09-23 01:27 - 2013-10-10 03:34 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2013-09-23 01:27 - 2013-10-10 03:34 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2013-09-23 01:27 - 2013-10-10 03:33 - 14335488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2013-09-23 01:27 - 2013-10-10 03:33 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2013-09-23 00:55 - 2013-10-10 03:34 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2013-09-23 00:55 - 2013-10-10 03:34 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2013-09-23 00:55 - 2013-10-10 03:34 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2013-09-23 00:54 - 2013-10-10 03:34 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2013-09-23 00:54 - 2013-10-10 03:34 - 02647552 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2013-09-23 00:54 - 2013-10-10 03:34 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2013-09-23 00:54 - 2013-10-10 03:34 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2013-09-23 00:54 - 2013-10-10 03:34 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2013-09-23 00:54 - 2013-10-10 03:34 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2013-09-23 00:54 - 2013-10-10 03:34 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2013-09-23 00:54 - 2013-10-10 03:34 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2013-09-23 00:54 - 2013-10-10 03:34 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2013-09-23 00:54 - 2013-10-10 03:33 - 19252224 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2013-09-23 00:54 - 2013-10-10 03:33 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2013-09-22 04:52 - 2013-09-22 04:52 - 00000000 ____D C:\Users\Rainer\AppData\Local\{A97A5B90-7CD3-4CCC-B44E-5B12FF7AF311} 2013-09-21 05:38 - 2013-10-10 03:34 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2013-09-21 05:30 - 2013-10-10 03:34 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2013-09-21 04:48 - 2013-10-10 03:34 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe 2013-09-21 04:39 - 2013-10-10 03:34 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe 2013-09-20 14:39 - 2012-04-12 05:57 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2013-09-20 14:39 - 2012-04-12 05:57 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater 2013-09-20 14:39 - 2011-05-16 05:18 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2013-09-20 14:33 - 2013-09-20 10:22 - 00000000 ____D C:\Users\Rainer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BitGuard 2013-09-20 10:37 - 2013-09-20 10:37 - 00003126 _____ C:\Windows\System32\Tasks\{2149C150-DFD4-43EF-8447-829BEFB160EC} 2013-09-20 10:36 - 2012-04-29 17:55 - 00000000 ____D C:\Users\Rainer\AppData\Roaming\DVDVideoSoft 2013-09-20 10:34 - 2013-09-20 10:23 - 00000000 ____D C:\Program Files (x86)\DealPly 2013-09-20 10:23 - 2013-09-20 10:23 - 00003238 _____ C:\Windows\System32\Tasks\Dealply 2013-09-20 10:23 - 2013-09-20 10:22 - 00003420 _____ C:\Windows\System32\Tasks\BitGuard 2013-09-20 10:23 - 2012-11-13 13:53 - 00000000 ____D C:\Program Files (x86)\DVDVideoSoft 2013-09-20 10:22 - 2013-09-20 10:22 - 00000000 ____D C:\Windows\SysWOW64\searchplugins 2013-09-20 10:22 - 2013-09-20 10:22 - 00000000 ____D C:\Windows\SysWOW64\Extensions 2013-09-20 10:22 - 2013-09-20 10:22 - 00000000 ____D C:\ProgramData\Babylon 2013-09-19 21:07 - 2013-09-19 21:06 - 00000000 ____D C:\Users\Rainer\AppData\Local\{CF11E99B-8923-48FC-94FB-789E3EBD2330} 2013-09-18 06:10 - 2013-09-18 06:10 - 00000000 ____D C:\Users\Rainer\AppData\Local\{F5AE5685-5D5E-4BB7-957E-8D70E3E466A3} Files to move or delete: ==================== C:\Users\Rainer\AppData\Roaming\settings.ini C:\ProgramData\gtfylcyrkalmndvmsmq.bat C:\ProgramData\gtfylcyrkalmndvmsmq.reg C:\Users\Rainer\AppData\Roaming\i.ini Some content of TEMP: ==================== C:\Users\LisiRaini\AppData\Local\Temp\sfamcc00001.dll C:\Users\LisiRaini\AppData\Local\Temp\sfareca00001.dll C:\Users\Rainer\AppData\Local\Temp\avgnt.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-10-13 03:37 ==================== End Of Log ============================ Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net Rootkit scan 2013-10-17 05:34:26 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\0000005c ST310005 rev.HP35 931,51GB Running: gmer_2.1.19163.exe; Driver: C:\Users\Rainer\AppData\Local\Temp\ufdcqpog.sys ---- User code sections - GMER 2.1 ---- .text C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe[1716] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000074b91465 2 bytes [B9, 74] .text C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe[1716] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000074b914bb 2 bytes [B9, 74] .text ... * 2 ? C:\Windows\system32\mssprxy.dll [2428] entry point in ".rdata" section 0000000073cd71e6 .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3260] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000074b91465 2 bytes [B9, 74] .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3260] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000074b914bb 2 bytes [B9, 74] .text ... * 2 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4024] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000074b91465 2 bytes [B9, 74] .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4024] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000074b914bb 2 bytes [B9, 74] .text ... * 2 ---- Threads - GMER 2.1 ---- Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [4776:3312] 000007fefae92a7c Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [4776:1360] 000007feef6dd618 Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [4776:1364] 000007feef6dd618 ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\00163839be03 Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\00163839be03@ac932f9ab00c 0x89 0xDA 0x22 0x92 ... Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\00163839be03@f06bca908079 0xBF 0xF0 0xB3 0x78 ... Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\00163839be03 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\00163839be03@ac932f9ab00c 0x89 0xDA 0x22 0x92 ... Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\00163839be03@f06bca908079 0xBF 0xF0 0xB3 0x78 ... ---- Disk sectors - GMER 2.1 ---- Disk \Device\Harddisk0\DR0 unknown MBR code ---- EOF - GMER 2.1 ---- Code:
ATTFilter Emsisoft Anti-Malware - Version 8.1 Letztes Update: 10/17/2013 6:28:57 AM Benutzerkonto: Rainer-HP\Rainer Scan Einstellungen: Scan Methode: Schnelltest Objekte: Rootkits, Speicher, Traces PUPs-Erkennung: An Archiv Scan: Aus ADS Scan: An Dateitypen-Filter: Aus Erweitertes Caching: An Direkter Festplattenzugriff: Aus Scan Beginn: 10/17/2013 6:30:55 AM C:\Users\Rainer\AppData\Roaming\Microsoft\Windows\Templates\2433f433 gefunden: Trace.File.Locker (A) Value: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113} -> HELPTEXT gefunden: Trace.Registry.SEO Toolbar (A) Value: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113} -> MENUTEXT gefunden: Trace.Registry.SEO Toolbar (A) Value: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\TOOLBAR -> {AE07101B-46D4-4A98-AF68-0333EA26E113} gefunden: Trace.Registry.SEO Toolbar (A) Gescannt 322246 Gefunden 4 Scan Ende: 10/17/2013 6:32:14 AM Scan Zeit: 0:01:19 Value: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113} -> HELPTEXT Quarantäne Trace.Registry.SEO Toolbar (A) Value: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113} -> MENUTEXT Quarantäne Trace.Registry.SEO Toolbar (A) Value: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\TOOLBAR -> {AE07101B-46D4-4A98-AF68-0333EA26E113} Quarantäne Trace.Registry.SEO Toolbar (A) C:\Users\Rainer\AppData\Roaming\Microsoft\Windows\Templates\2433f433 Quarantäne Trace.File.Locker (A) Quarantäne 4 |
Themen zu Internet Game, Passwort wird immer geändert |
administrator, adobe, antivir, avira, dll, einstellungen, emsisoft, explorer, farbar, farbar recovery scan tool, fehler, festplatte, flash player, google, helper, home, internet, opera, plug-in, registry, rundll, scan, security, services.exe, software, system, temp, trace.registry.seo, trojaner, winlogon.exe, ändern |