| |
| |||||||
Log-Analyse und Auswertung: Internet Game, Passwort wird immer geändertWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
17.10.2013, 06:49
| #1 |
 |  Internet Game, Passwort wird immer geändert Hallo Mir wurde im Game Aion mein Account gestohlen. Ich hab versucht mein Passwort zu ändern, doch kurz darauf hatte ich wieder keinen zugriff da mein Passwort wieder nicht stimmte. Nun befürchte ich das ich einen Trojaner am Pc habe. Da ich mit meiner Konzentration Probleme habe kann es sein das ich Fehler mache, deswegen bitte ich um Nachsicht und mir meine Fehler mitzuteilen. Ich bedanke mich dafür. Schritt 1: Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 21:17 on 16/10/2013 (Rainer)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-10-2013
Ran by Rainer (administrator) on RAINER-HP on 17-10-2013 06:49:44
Running from C:\Users\Rainer\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\system32\Macromed\Flash\FlashUtil64_11_8_800_175_ActiveX.exe
(Emsisoft GmbH) C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe
(Emsisoft GmbH) C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\a2guard.exe
(Avira Operations GmbH & Co. KG) C:\program files (x86)\avira\antivir desktop\avcenter.exe
(Avira Operations GmbH & Co. KG) C:\program files (x86)\avira\antivir desktop\avscan.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Logitech Download Assistant] - C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKCU\...\Run: [AdobeBridge] - [x]
HKCU\...\Run: [] - [x]
HKCU\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2010-12-22] (Google Inc.)
HKCU\...\Run: [HydraVisionDesktopManager] - C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe [385024 2010-05-17] (AMD)
HKCU\...\Policies\system: [DisableLockWorkstation] 0
HKCU\...\Policies\system: [DisableChangePassword] 0
HKLM-x32\...\Run: [AMD AVT] - C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe [10752 2012-02-20] ()
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [248040 2010-02-18] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [NPSStartup] - [x]
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-10-17] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [emsisoft anti-malware] - c:\program files (x86)\emsisoft anti-malware\a2guard.exe [4329408 2013-09-30] (Emsisoft GmbH)
HKU\Default\...\Run: [HPAdvisorDock] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\DOCK\HPAdvisorDock.exe [1715768 2010-09-28] (Hewlett-Packard)
Lsa: [Notification Packages] scecli C:\Program Files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll
Startup: C:\Users\Rainer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gtfylcyrkalmndvmsmq.lnk
ShortcutTarget: gtfylcyrkalmndvmsmq.lnk -> C:\Users\Rainer\AppData\Local\Temp\qmsmvdnmlakryclyftg.bfg (No File)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.at/
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM - {64B0C37F-540F-4D57-9225-53352999F0F6} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM - {FD50D5E2-E74F-4FD6-803E-49E752A7B2D8} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPDTDF
SearchScopes: HKLM-x32 - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=AT&userid=d4ad096b-36bc-4586-8d7b-028bc18d901c&searchtype=ds&q={searchTerms}
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {64B0C37F-540F-4D57-9225-53352999F0F6} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 - {FD50D5E2-E74F-4FD6-803E-49E752A7B2D8} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPDTDF
SearchScopes: HKCU - DefaultScope {103C635C-B587-4326-8A93-86E6CC5C6530} URL = hxxp://search.softonic.com/MOY00006/tb_v1?q={searchTerms}&SearchSource=4&cc=&mi=de99e4ae00000000000000163839be03&r=407
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=AT&userid=d4ad096b-36bc-4586-8d7b-028bc18d901c&searchtype=ds&q={searchTerms}
SearchScopes: HKCU - {0D7562AE-8EF6-416d-A838-AB665251703A} URL = hxxp://start.facemoods.com/?a=gppc&s={searchTerms}&f=4
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www2.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=DE9900163839BE03&affID=121565&tt=160913_c3&tsp=5011
SearchScopes: HKCU - {103C635C-B587-4326-8A93-86E6CC5C6530} URL = hxxp://search.softonic.com/MOY00006/tb_v1?q={searchTerms}&SearchSource=4&cc=&mi=de99e4ae00000000000000163839be03&r=407
SearchScopes: HKCU - {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=HIP&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=&apn_uid=9EBA2359-375D-4CCE-B637-BC3AFB2DD780&apn_sauid=AA1B5180-BF86-4121-870F-651664C6F98D
SearchScopes: HKCU - {4A54C729-0E56-486C-81E9-6D7430F5DEB2} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {63A205E3-A458-4A4A-BC0F-3AB5FF459F17} URL = hxxp://go.gmx.at/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {64B0C37F-540F-4D57-9225-53352999F0F6} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKCU - {8387C727-F955-4757-A384-750EF28C2E5C} URL = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {9E38C6AD-D037-4B46-8856-389099714524} URL = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
SearchScopes: HKCU - {C2A8E89B-922D-45D9-B92B-E80CFDC4621F} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050&SSPV=IENOSGBR
SearchScopes: HKCU - {FD50D5E2-E74F-4FD6-803E-49E752A7B2D8} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPDTDF
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
Toolbar: HKCU - No Name - {3BE093E7-4650-438B-AC6F-C944C30F81AD} - No File
Toolbar: HKCU - No Name - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - No File
Toolbar: HKCU - No Name - {C424171E-592A-415A-9EB1-DFD6D95D3530} - No File
Toolbar: HKCU - No Name - {EEE6C35B-6118-11DC-9C72-001320C79847} - No File
DPF: HKLM-x32 {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: HKLM-x32 {233C1507-6A77-46A4-9443-F871F945D258} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: HKLM-x32 {4871A87A-BFDD-4106-8153-FFDE2BAC2967} hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.7.cab
DPF: HKLM-x32 {5852F5ED-8BF4-11D4-A245-0080C6F74284} hxxp://javadl-esd.oracle.com/update/1.6.0/jinstall-6u20-windows-i586.cab
DPF: HKLM-x32 {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} hxxp://h20614.www2.hp.com/ediags/gmd/Install/Cab/hpdetect1259.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWow64\EZUPBH~1.DLL [52920 2010-10-02] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 10.0.0.1
Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (Softonic Chrome Toolbar) - C:\Users\Rainer\AppData\Local\Google\Chrome\User Data\Default\Extensions\elchiiiejkobdbblfejjkbphbddgmljf\1.0_0
CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx
==================== Services (Whitelisted) =================
R2 a2AntiMalware; C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe [4153784 2013-09-30] (Emsisoft GmbH)
S4 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2012-06-11] (Advanced Micro Devices, Inc.)
R2 AntiVirFirewallService; C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe [655928 2013-10-17] (Avira Operations GmbH & Co. KG)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [622648 2013-10-17] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-10-17] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-10-17] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-10-17] (Avira Operations GmbH & Co. KG)
S4 HP Power Assistant Service; C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe [107576 2010-03-11] ()
S4 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [635416 2009-10-15] (PDF Complete Inc)
==================== Drivers (Whitelisted) ====================
R3 a2acc; C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\a2accx64.sys [70960 2013-08-24] (Emsisoft GmbH)
R3 a2acc; C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\a2accx64.sys [70960 2013-08-24] (Emsisoft GmbH)
R1 A2DDA; C:\Program Files (x86)\Emsisoft Anti-Malware\a2ddax64.sys [26176 2013-03-28] (Emsisoft GmbH)
R1 A2DDA; C:\Program Files (x86)\Emsisoft Anti-Malware\a2ddax64.sys [26176 2013-03-28] (Emsisoft GmbH)
R1 a2injectiondriver; C:\Program Files (x86)\Emsisoft Anti-Malware\a2dix64.sys [45208 2013-09-30] (Emsisoft GmbH)
R1 a2injectiondriver; C:\Program Files (x86)\Emsisoft Anti-Malware\a2dix64.sys [45208 2013-09-30] (Emsisoft GmbH)
R1 a2util; C:\Program Files (x86)\Emsisoft Anti-Malware\a2util64.sys [17384 2013-03-28] (Emsisoft GmbH)
R1 a2util; C:\Program Files (x86)\Emsisoft Anti-Malware\a2util64.sys [17384 2013-03-28] (Emsisoft GmbH)
R2 AODDriver4.01; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [53888 2012-03-05] (Advanced Micro Devices)
S2 AODDriver4.1; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [53888 2012-03-05] (Advanced Micro Devices)
R3 avfwim; C:\Windows\System32\DRIVERS\avfwim.sys [114608 2013-10-17] (Avira GmbH)
R1 avfwot; C:\Windows\System32\DRIVERS\avfwot.sys [141376 2013-10-17] (Avira GmbH)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-10-17] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-10-17] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-17] (Avira Operations GmbH & Co. KG)
S3 camfilt2; C:\Windows\System32\DRIVERS\camfilt2.sys [137728 2007-08-06] (Guillemot Corporation)
R3 cleanhlp; C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [57024 2013-08-19] (Emsisoft GmbH)
R3 cleanhlp; C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [57024 2013-08-19] (Emsisoft GmbH)
S3 CpqDfw; C:\Windows\System32\drivers\CpqDfw.sys [27456 2012-05-29] (Windows (R) Codename Longhorn DDK provider)
S3 cqcpu; C:\Windows\System32\drivers\cqcpu.sys [24376 2010-04-27] ()
R2 DRHARD64; C:\Windows\system32\drivers\DRHARD64.sys [22216 2008-08-06] (Licensed for Gebhard Software)
R3 GemCCID; C:\Windows\System32\Drivers\GemCCID.sys [129792 2013-04-24] (Gemalto)
S3 SNPSTD3; C:\Windows\System32\DRIVERS\snpstd3.sys [10684672 2007-07-17] (Sonix Co. Ltd.)
S3 DRHARD; \??\C:\Windows\system32\DRIVERS\DRHARD.SYS [x]
U5 usbser; C:\Windows\System32\Drivers\usbser.sys [32768 2010-11-20] (Microsoft Corporation)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-10-17 06:15 - 2013-10-17 06:15 - 00001053 _____ C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk
2013-10-17 06:14 - 2013-10-17 06:37 - 00000000 ____D C:\Program Files (x86)\Emsisoft Anti-Malware
2013-10-17 06:14 - 2013-10-17 06:14 - 00000000 ____D C:\Users\Rainer\Documents\Anti-Malware
2013-10-17 05:34 - 2013-10-17 05:34 - 00004046 _____ C:\Users\Rainer\Desktop\Gmer.txt
2013-10-17 05:17 - 2013-10-17 05:17 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-10-17 05:13 - 2013-10-17 05:13 - 00001956 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-10-17 05:13 - 2013-10-17 05:13 - 00000000 ____D C:\Users\Rainer\AppData\Roaming\Avira
2013-10-17 05:11 - 2013-10-17 05:07 - 00141376 _____ (Avira GmbH) C:\Windows\system32\Drivers\avfwot.sys
2013-10-17 05:11 - 2013-10-17 05:07 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-10-17 05:11 - 2013-10-17 05:07 - 00114608 _____ (Avira GmbH) C:\Windows\system32\Drivers\avfwim.sys
2013-10-17 05:11 - 2013-10-17 05:07 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-10-17 05:11 - 2013-10-17 05:07 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-10-17 04:55 - 2013-10-17 04:56 - 109320144 _____ C:\Users\Rainer\Downloads\avira_internet_security_de.exe
2013-10-16 23:02 - 2013-10-16 23:02 - 02804344 _____ (TeamViewer GmbH) C:\Users\Rainer\Desktop\customermodule_avira_support_de.exe
2013-10-16 23:02 - 2013-10-16 23:02 - 00000000 ____D C:\Users\Rainer\AppData\Roaming\TeamViewer
2013-10-16 22:32 - 2013-10-16 22:32 - 02296760 _____ C:\Users\Rainer\Downloads\avira_internet_security_suite.exe
2013-10-16 21:57 - 2013-10-16 21:57 - 00000000 ____D C:\Users\Rainer\AppData\Local\{D8F3819E-830F-4579-B7F3-A12B1F2AEAF7}
2013-10-16 21:25 - 2013-10-16 21:25 - 00377856 _____ C:\Users\Rainer\Desktop\gmer_2.1.19163.exe
2013-10-16 21:22 - 2013-10-16 21:23 - 01954124 _____ (Farbar) C:\Users\Rainer\Desktop\FRST64.exe
2013-10-16 21:17 - 2013-10-16 21:17 - 00050477 _____ C:\Users\Rainer\Desktop\Defogger.exe
2013-10-16 21:17 - 2013-10-16 21:17 - 00000474 _____ C:\Users\Rainer\Desktop\defogger_disable.log
2013-10-16 18:42 - 2013-10-16 18:42 - 00000000 ____D C:\Users\Rainer\AppData\Local\{54F3558F-AB09-45C1-B3ED-747DBFC8B253}
2013-10-16 18:17 - 2013-10-16 18:17 - 00000000 ____D C:\FRST
2013-10-16 18:14 - 2013-10-16 18:15 - 00000000 _____ C:\Users\Rainer\defogger_reenable
2013-10-16 06:24 - 2013-10-16 06:24 - 00000000 ____D C:\Users\Rainer\AppData\Local\{B535722A-05DD-4E41-BEC1-7F221A1EC2A2}
2013-10-15 13:15 - 2013-10-15 13:15 - 00000000 ____D C:\Users\Rainer\AppData\Local\{9B36C213-A0D7-4F95-BEA6-8EFB51FB69C0}
2013-10-15 00:03 - 2013-10-15 00:03 - 00000000 ____D C:\Users\Rainer\AppData\Local\{BD588AF5-84D1-4978-85AC-F6FED14DC985}
2013-10-14 11:49 - 2013-10-14 11:49 - 00000000 ____D C:\Users\Rainer\AppData\Local\{C16EC071-F248-4A90-B1AC-8C10F7CCDF14}
2013-10-14 08:31 - 2013-10-14 08:31 - 00004621 _____ C:\Users\Rainer\AppData\Local\recently-used.xbel
2013-10-14 07:59 - 2013-10-14 08:32 - 00000000 ____D C:\Users\Rainer\Desktop\n
2013-10-13 23:49 - 2013-10-13 23:49 - 00000000 ____D C:\Users\Rainer\AppData\Local\{FD5325EA-C97F-423E-96A1-5CCB10F6617A}
2013-10-12 22:23 - 2013-09-04 14:12 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2013-10-12 22:23 - 2013-09-04 14:11 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2013-10-12 22:23 - 2013-09-04 14:11 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2013-10-12 22:23 - 2013-09-04 14:11 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2013-10-12 22:23 - 2013-09-04 14:11 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2013-10-12 22:23 - 2013-09-04 14:11 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2013-10-12 22:23 - 2013-09-04 14:11 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2013-10-12 18:49 - 2013-10-12 18:49 - 00000000 ____D C:\Users\Rainer\AppData\Local\{783D247C-9494-43CB-88DA-D3229BC55FB8}
2013-10-12 05:14 - 2013-10-12 05:14 - 00000000 ____D C:\Users\Rainer\AppData\Local\{9A28116B-F94D-4752-A711-DDCCC282BA36}
2013-10-11 11:53 - 2013-10-11 11:53 - 00000000 ____D C:\Users\Rainer\AppData\Local\{21487BEE-A3A1-4785-B7D5-FB949FFCCA94}
2013-10-10 20:00 - 2013-10-17 05:16 - 00099598 _____ C:\Windows\PFRO.log
2013-10-10 03:34 - 2013-09-23 01:28 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-10-10 03:34 - 2013-09-23 01:28 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-10-10 03:34 - 2013-09-23 01:27 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-10-10 03:34 - 2013-09-23 01:27 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-10-10 03:34 - 2013-09-23 01:27 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-10-10 03:34 - 2013-09-23 01:27 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-10-10 03:34 - 2013-09-23 01:27 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-10-10 03:34 - 2013-09-23 01:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-10-10 03:34 - 2013-09-23 01:27 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-10-10 03:34 - 2013-09-23 01:27 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-10-10 03:34 - 2013-09-23 01:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-10-10 03:34 - 2013-09-23 00:55 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-10-10 03:34 - 2013-09-23 00:55 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-10-10 03:34 - 2013-09-23 00:55 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-10-10 03:34 - 2013-09-23 00:54 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-10-10 03:34 - 2013-09-23 00:54 - 02647552 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-10-10 03:34 - 2013-09-23 00:54 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-10-10 03:34 - 2013-09-23 00:54 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-10-10 03:34 - 2013-09-23 00:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-10-10 03:34 - 2013-09-23 00:54 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-10-10 03:34 - 2013-09-23 00:54 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-10-10 03:34 - 2013-09-23 00:54 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-10-10 03:34 - 2013-09-23 00:54 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-10-10 03:34 - 2013-09-21 05:38 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-10-10 03:34 - 2013-09-21 05:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-10-10 03:34 - 2013-09-21 04:48 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-10-10 03:34 - 2013-09-21 04:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-10-10 03:33 - 2013-09-23 01:27 - 14335488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-10-10 03:33 - 2013-09-23 01:27 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-10-10 03:33 - 2013-09-23 00:54 - 19252224 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-10-10 03:33 - 2013-09-23 00:54 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-10-09 23:25 - 2013-09-14 03:10 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-10-09 23:25 - 2013-09-08 04:30 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-10-09 23:25 - 2013-09-08 04:27 - 00327168 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2013-10-09 23:25 - 2013-09-08 04:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswsock.dll
2013-10-09 23:25 - 2013-08-29 04:17 - 05549504 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-10-09 23:25 - 2013-08-29 04:16 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2013-10-09 23:25 - 2013-08-29 04:13 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2013-10-09 23:25 - 2013-08-29 03:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-10-09 23:25 - 2013-08-29 03:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-10-09 23:25 - 2013-08-28 03:21 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-10-09 23:25 - 2013-07-12 12:41 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
2013-10-09 23:25 - 2013-07-12 12:40 - 00109824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBAUDIO.sys
2013-10-09 23:25 - 2013-07-04 14:57 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2013-10-09 23:25 - 2013-07-04 14:50 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2013-10-09 23:25 - 2013-07-04 14:50 - 00102400 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2013-10-09 23:25 - 2013-07-04 13:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll
2013-10-09 23:25 - 2013-07-04 13:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll
2013-10-09 23:25 - 2013-07-04 13:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2013-10-09 23:25 - 2013-07-04 12:11 - 00140800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2013-10-09 23:25 - 2013-07-03 06:40 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys
2013-10-09 23:25 - 2013-07-03 06:05 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2013-10-09 23:25 - 2013-07-03 06:05 - 00032896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2013-10-09 23:25 - 2013-06-26 00:55 - 00785624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2013-10-09 23:25 - 2013-06-06 07:50 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2013-10-09 23:25 - 2013-06-06 07:49 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2013-10-09 23:25 - 2013-06-06 07:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2013-10-09 23:25 - 2013-06-06 07:47 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2013-10-09 23:25 - 2013-06-06 06:57 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2013-10-09 23:25 - 2013-06-06 06:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2013-10-09 23:25 - 2013-06-06 06:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2013-10-09 23:25 - 2013-06-06 05:30 - 00368128 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-10-09 23:25 - 2013-06-06 05:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2013-10-09 23:25 - 2013-06-06 05:01 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2013-10-09 23:24 - 2013-08-29 04:16 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-10-09 23:24 - 2013-08-29 04:16 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-10-09 23:24 - 2013-08-29 03:50 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-10-09 23:24 - 2013-08-29 03:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2013-10-09 23:24 - 2013-08-29 03:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-10-09 23:24 - 2013-08-29 03:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2013-10-09 23:24 - 2013-08-29 02:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-10-09 23:24 - 2013-08-29 02:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-10-09 23:24 - 2013-08-29 02:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-10-09 23:24 - 2013-08-29 02:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-10-09 23:24 - 2013-08-28 03:12 - 00461312 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll
2013-10-09 23:24 - 2013-08-01 14:09 - 00983488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-10-09 23:24 - 2013-07-20 12:33 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-09 23:24 - 2013-07-20 12:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2013-10-08 15:47 - 2013-10-08 15:30 - 00000493 _____ C:\Users\Rainer\Documents\aionmemo_facde51e.bak
2013-10-08 09:20 - 2013-10-08 09:20 - 00000000 ____D C:\Users\Rainer\AppData\Local\{F6EC67EB-94D7-437C-A3E3-854DF99C170E}
2013-10-07 14:21 - 2013-10-07 14:21 - 00000000 ____D C:\Users\Rainer\AppData\Local\{C0B34E10-C55C-4DEF-A0CC-5E93A4290668}
2013-10-03 10:24 - 2013-10-17 05:56 - 00001120 _____ C:\Windows\setupact.log
2013-10-03 10:24 - 2013-10-10 20:01 - 04950832 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-03 10:24 - 2013-10-03 10:24 - 00000000 _____ C:\Windows\setuperr.log
2013-10-03 10:21 - 2013-10-03 10:21 - 00079432 _____ C:\Users\Rainer\AppData\Local\GDIPFONTCACHEV1.DAT
2013-10-03 10:21 - 2013-10-03 10:21 - 00000000 ____D C:\Users\Rainer\AppData\Local\{105914EB-CB72-4206-9FA1-451F4A47F3E0}
2013-10-02 01:27 - 2013-10-02 01:28 - 00000000 ____D C:\Users\Rainer\AppData\Local\{4158FA2E-7953-4072-83DA-8BDD9AC3AEC6}
2013-09-30 11:14 - 2013-09-30 11:14 - 00000000 ____D C:\Users\Rainer\AppData\Local\{A087747B-3A8C-4695-BC8F-D80BB19874CF}
2013-09-27 12:29 - 2013-09-27 12:30 - 00000000 ____D C:\Users\Rainer\AppData\Local\{EFE9D5C3-F7DB-40E8-ACE1-7E58D4B99C67}
2013-09-25 08:54 - 2013-09-25 08:54 - 00000000 ____D C:\Users\Rainer\AppData\Local\{7FC2F21A-A7F8-4C41-B557-505AF57F3EDB}
2013-09-24 13:55 - 2013-09-24 13:55 - 00000000 ____D C:\Users\Rainer\AppData\Local\{D6AE30E2-E34C-4A5E-BE1B-BA3C32AD1124}
2013-09-22 04:52 - 2013-09-22 04:52 - 00000000 ____D C:\Users\Rainer\AppData\Local\{A97A5B90-7CD3-4CCC-B44E-5B12FF7AF311}
2013-09-20 10:37 - 2013-09-20 10:37 - 00003126 _____ C:\Windows\System32\Tasks\{2149C150-DFD4-43EF-8447-829BEFB160EC}
2013-09-20 10:23 - 2013-10-17 06:23 - 00000294 _____ C:\Windows\Tasks\Dealply.job
2013-09-20 10:23 - 2013-09-20 10:34 - 00000000 ____D C:\Program Files (x86)\DealPly
2013-09-20 10:23 - 2013-09-20 10:23 - 00003238 _____ C:\Windows\System32\Tasks\Dealply
2013-09-20 10:22 - 2013-10-02 10:34 - 00000000 ____D C:\ProgramData\DSearchLink
2013-09-20 10:22 - 2013-10-02 10:34 - 00000000 ____D C:\ProgramData\BitGuard
2013-09-20 10:22 - 2013-09-20 14:33 - 00000000 ____D C:\Users\Rainer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BitGuard
2013-09-20 10:22 - 2013-09-20 10:23 - 00003420 _____ C:\Windows\System32\Tasks\BitGuard
2013-09-20 10:22 - 2013-09-20 10:22 - 00000000 ____D C:\Windows\SysWOW64\searchplugins
2013-09-20 10:22 - 2013-09-20 10:22 - 00000000 ____D C:\Windows\SysWOW64\Extensions
2013-09-20 10:22 - 2013-09-20 10:22 - 00000000 ____D C:\ProgramData\Babylon
2013-09-19 21:06 - 2013-09-19 21:07 - 00000000 ____D C:\Users\Rainer\AppData\Local\{CF11E99B-8923-48FC-94FB-789E3EBD2330}
2013-09-18 06:10 - 2013-09-18 06:10 - 00000000 ____D C:\Users\Rainer\AppData\Local\{F5AE5685-5D5E-4BB7-957E-8D70E3E466A3}
==================== One Month Modified Files and Folders =======
2013-10-17 06:48 - 2012-04-12 05:57 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-10-17 06:37 - 2013-10-17 06:14 - 00000000 ____D C:\Program Files (x86)\Emsisoft Anti-Malware
2013-10-17 06:26 - 2010-12-22 18:24 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-10-17 06:23 - 2013-09-20 10:23 - 00000294 _____ C:\Windows\Tasks\Dealply.job
2013-10-17 06:15 - 2013-10-17 06:15 - 00001053 _____ C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk
2013-10-17 06:14 - 2013-10-17 06:14 - 00000000 ____D C:\Users\Rainer\Documents\Anti-Malware
2013-10-17 06:05 - 2009-07-14 06:45 - 00015792 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-17 06:05 - 2009-07-14 06:45 - 00015792 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-17 06:00 - 2011-05-23 05:38 - 01280878 _____ C:\Windows\WindowsUpdate.log
2013-10-17 05:57 - 2010-12-22 18:24 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-10-17 05:57 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-17 05:56 - 2013-10-03 10:24 - 00001120 _____ C:\Windows\setupact.log
2013-10-17 05:34 - 2013-10-17 05:34 - 00004046 _____ C:\Users\Rainer\Desktop\Gmer.txt
2013-10-17 05:17 - 2013-10-17 05:17 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-10-17 05:16 - 2013-10-10 20:00 - 00099598 _____ C:\Windows\PFRO.log
2013-10-17 05:13 - 2013-10-17 05:13 - 00001956 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-10-17 05:13 - 2013-10-17 05:13 - 00000000 ____D C:\Users\Rainer\AppData\Roaming\Avira
2013-10-17 05:11 - 2012-10-10 09:13 - 00000000 ____D C:\Program Files (x86)\Avira
2013-10-17 05:11 - 2011-10-15 00:01 - 00000000 ____D C:\ProgramData\Avira
2013-10-17 05:07 - 2013-10-17 05:11 - 00141376 _____ (Avira GmbH) C:\Windows\system32\Drivers\avfwot.sys
2013-10-17 05:07 - 2013-10-17 05:11 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-10-17 05:07 - 2013-10-17 05:11 - 00114608 _____ (Avira GmbH) C:\Windows\system32\Drivers\avfwim.sys
2013-10-17 05:07 - 2013-10-17 05:11 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-10-17 05:07 - 2013-10-17 05:11 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-10-17 04:56 - 2013-10-17 04:55 - 109320144 _____ C:\Users\Rainer\Downloads\avira_internet_security_de.exe
2013-10-16 23:02 - 2013-10-16 23:02 - 02804344 _____ (TeamViewer GmbH) C:\Users\Rainer\Desktop\customermodule_avira_support_de.exe
2013-10-16 23:02 - 2013-10-16 23:02 - 00000000 ____D C:\Users\Rainer\AppData\Roaming\TeamViewer
2013-10-16 22:32 - 2013-10-16 22:32 - 02296760 _____ C:\Users\Rainer\Downloads\avira_internet_security_suite.exe
2013-10-16 22:18 - 2013-02-09 17:02 - 00011776 ___SH C:\Users\Rainer\Thumbs.db
2013-10-16 21:57 - 2013-10-16 21:57 - 00000000 ____D C:\Users\Rainer\AppData\Local\{D8F3819E-830F-4579-B7F3-A12B1F2AEAF7}
2013-10-16 21:25 - 2013-10-16 21:25 - 00377856 _____ C:\Users\Rainer\Desktop\gmer_2.1.19163.exe
2013-10-16 21:23 - 2013-10-16 21:22 - 01954124 _____ (Farbar) C:\Users\Rainer\Desktop\FRST64.exe
2013-10-16 21:17 - 2013-10-16 21:17 - 00050477 _____ C:\Users\Rainer\Desktop\Defogger.exe
2013-10-16 21:17 - 2013-10-16 21:17 - 00000474 _____ C:\Users\Rainer\Desktop\defogger_disable.log
2013-10-16 18:42 - 2013-10-16 18:42 - 00000000 ____D C:\Users\Rainer\AppData\Local\{54F3558F-AB09-45C1-B3ED-747DBFC8B253}
2013-10-16 18:17 - 2013-10-16 18:17 - 00000000 ____D C:\FRST
2013-10-16 18:15 - 2013-10-16 18:14 - 00000000 _____ C:\Users\Rainer\defogger_reenable
2013-10-16 18:15 - 2010-12-15 18:47 - 00000000 ____D C:\Users\Rainer
2013-10-16 06:24 - 2013-10-16 06:24 - 00000000 ____D C:\Users\Rainer\AppData\Local\{B535722A-05DD-4E41-BEC1-7F221A1EC2A2}
2013-10-15 13:15 - 2013-10-15 13:15 - 00000000 ____D C:\Users\Rainer\AppData\Local\{9B36C213-A0D7-4F95-BEA6-8EFB51FB69C0}
2013-10-15 00:03 - 2013-10-15 00:03 - 00000000 ____D C:\Users\Rainer\AppData\Local\{BD588AF5-84D1-4978-85AC-F6FED14DC985}
2013-10-14 11:49 - 2013-10-14 11:49 - 00000000 ____D C:\Users\Rainer\AppData\Local\{C16EC071-F248-4A90-B1AC-8C10F7CCDF14}
2013-10-14 08:54 - 2013-01-13 10:10 - 00000000 ____D C:\Users\Rainer\.gimp-2.8
2013-10-14 08:32 - 2013-10-14 07:59 - 00000000 ____D C:\Users\Rainer\Desktop\n
2013-10-14 08:31 - 2013-10-14 08:31 - 00004621 _____ C:\Users\Rainer\AppData\Local\recently-used.xbel
2013-10-14 08:00 - 2010-10-02 13:49 - 00702138 _____ C:\Windows\system32\perfh007.dat
2013-10-14 08:00 - 2010-10-02 13:49 - 00150874 _____ C:\Windows\system32\perfc007.dat
2013-10-14 08:00 - 2009-07-14 07:13 - 01628640 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-13 23:49 - 2013-10-13 23:49 - 00000000 ____D C:\Users\Rainer\AppData\Local\{FD5325EA-C97F-423E-96A1-5CCB10F6617A}
2013-10-13 13:11 - 2013-06-08 15:58 - 00003192 _____ C:\Windows\System32\Tasks\HPCeeScheduleForRainer
2013-10-13 13:11 - 2013-02-07 15:57 - 00000336 _____ C:\Windows\Tasks\HPCeeScheduleForRainer.job
2013-10-12 18:49 - 2013-10-12 18:49 - 00000000 ____D C:\Users\Rainer\AppData\Local\{783D247C-9494-43CB-88DA-D3229BC55FB8}
2013-10-12 07:42 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-10-12 05:28 - 2013-03-01 17:36 - 00000082 _____ C:\Users\Rainer\Documents\aionmemo_facde51e.dat
2013-10-12 05:14 - 2013-10-12 05:14 - 00000000 ____D C:\Users\Rainer\AppData\Local\{9A28116B-F94D-4752-A711-DDCCC282BA36}
2013-10-11 11:53 - 2013-10-11 11:53 - 00000000 ____D C:\Users\Rainer\AppData\Local\{21487BEE-A3A1-4785-B7D5-FB949FFCCA94}
2013-10-10 20:02 - 2009-07-24 21:22 - 00000000 ____D C:\Windows\Panther
2013-10-10 20:01 - 2013-10-03 10:24 - 04950832 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-10 20:00 - 2013-03-13 04:02 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-10-10 20:00 - 2013-03-13 04:02 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-10-10 11:51 - 2010-12-16 20:29 - 00000000 ____D C:\Users\Rainer\AppData\Roaming\HP Support Assistant
2013-10-10 11:51 - 2010-12-16 19:50 - 00000000 ____D C:\Users\Rainer\AppData\Roaming\HpUpdate
2013-10-10 03:37 - 2010-12-20 18:51 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-10-10 03:28 - 2011-11-11 13:11 - 01605598 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2013-10-10 03:21 - 2013-08-15 03:02 - 00000000 ____D C:\Windows\system32\MRT
2013-10-10 03:11 - 2010-12-18 18:27 - 80541720 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-10-10 00:21 - 2010-12-22 18:24 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-10-10 00:21 - 2010-12-22 18:24 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-10-08 15:30 - 2013-10-08 15:47 - 00000493 _____ C:\Users\Rainer\Documents\aionmemo_facde51e.bak
2013-10-08 09:20 - 2013-10-08 09:20 - 00000000 ____D C:\Users\Rainer\AppData\Local\{F6EC67EB-94D7-437C-A3E3-854DF99C170E}
2013-10-07 14:21 - 2013-10-07 14:21 - 00000000 ____D C:\Users\Rainer\AppData\Local\{C0B34E10-C55C-4DEF-A0CC-5E93A4290668}
2013-10-07 14:20 - 2013-07-25 19:18 - 00001029 _____ C:\Users\Public\Desktop\Gameforge Live.lnk
2013-10-07 14:20 - 2013-07-25 19:18 - 00000000 ____D C:\Program Files (x86)\GameforgeLive
2013-10-03 10:24 - 2013-10-03 10:24 - 00000000 _____ C:\Windows\setuperr.log
2013-10-03 10:21 - 2013-10-03 10:21 - 00079432 _____ C:\Users\Rainer\AppData\Local\GDIPFONTCACHEV1.DAT
2013-10-03 10:21 - 2013-10-03 10:21 - 00000000 ____D C:\Users\Rainer\AppData\Local\{105914EB-CB72-4206-9FA1-451F4A47F3E0}
2013-10-02 21:47 - 2012-12-25 01:44 - 00000000 ____D C:\Users\Rainer\AppData\Local\CrashDumps
2013-10-02 10:34 - 2013-09-20 10:22 - 00000000 ____D C:\ProgramData\DSearchLink
2013-10-02 10:34 - 2013-09-20 10:22 - 00000000 ____D C:\ProgramData\BitGuard
2013-10-02 01:28 - 2013-10-02 01:27 - 00000000 ____D C:\Users\Rainer\AppData\Local\{4158FA2E-7953-4072-83DA-8BDD9AC3AEC6}
2013-10-02 00:21 - 2011-12-29 23:43 - 00007602 _____ C:\Users\Rainer\AppData\Local\resmon.resmoncfg
2013-09-30 11:14 - 2013-09-30 11:14 - 00000000 ____D C:\Users\Rainer\AppData\Local\{A087747B-3A8C-4695-BC8F-D80BB19874CF}
2013-09-27 12:30 - 2013-09-27 12:29 - 00000000 ____D C:\Users\Rainer\AppData\Local\{EFE9D5C3-F7DB-40E8-ACE1-7E58D4B99C67}
2013-09-25 08:54 - 2013-09-25 08:54 - 00000000 ____D C:\Users\Rainer\AppData\Local\{7FC2F21A-A7F8-4C41-B557-505AF57F3EDB}
2013-09-24 13:55 - 2013-09-24 13:55 - 00000000 ____D C:\Users\Rainer\AppData\Local\{D6AE30E2-E34C-4A5E-BE1B-BA3C32AD1124}
2013-09-23 01:28 - 2013-10-10 03:34 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-09-23 01:28 - 2013-10-10 03:34 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-09-23 01:27 - 2013-10-10 03:34 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-09-23 01:27 - 2013-10-10 03:34 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-09-23 01:27 - 2013-10-10 03:34 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-09-23 01:27 - 2013-10-10 03:34 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-09-23 01:27 - 2013-10-10 03:34 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-09-23 01:27 - 2013-10-10 03:34 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-09-23 01:27 - 2013-10-10 03:34 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-09-23 01:27 - 2013-10-10 03:34 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-09-23 01:27 - 2013-10-10 03:34 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-09-23 01:27 - 2013-10-10 03:33 - 14335488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-09-23 01:27 - 2013-10-10 03:33 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-09-23 00:55 - 2013-10-10 03:34 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-23 00:55 - 2013-10-10 03:34 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-23 00:55 - 2013-10-10 03:34 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-23 00:54 - 2013-10-10 03:34 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-23 00:54 - 2013-10-10 03:34 - 02647552 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-23 00:54 - 2013-10-10 03:34 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-23 00:54 - 2013-10-10 03:34 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-23 00:54 - 2013-10-10 03:34 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-23 00:54 - 2013-10-10 03:34 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-23 00:54 - 2013-10-10 03:34 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-23 00:54 - 2013-10-10 03:34 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-23 00:54 - 2013-10-10 03:34 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-23 00:54 - 2013-10-10 03:33 - 19252224 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-23 00:54 - 2013-10-10 03:33 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-22 04:52 - 2013-09-22 04:52 - 00000000 ____D C:\Users\Rainer\AppData\Local\{A97A5B90-7CD3-4CCC-B44E-5B12FF7AF311}
2013-09-21 05:38 - 2013-10-10 03:34 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-21 05:30 - 2013-10-10 03:34 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-09-21 04:48 - 2013-10-10 03:34 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-09-21 04:39 - 2013-10-10 03:34 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-09-20 14:39 - 2012-04-12 05:57 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-09-20 14:39 - 2012-04-12 05:57 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-09-20 14:39 - 2011-05-16 05:18 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-20 14:33 - 2013-09-20 10:22 - 00000000 ____D C:\Users\Rainer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BitGuard
2013-09-20 10:37 - 2013-09-20 10:37 - 00003126 _____ C:\Windows\System32\Tasks\{2149C150-DFD4-43EF-8447-829BEFB160EC}
2013-09-20 10:36 - 2012-04-29 17:55 - 00000000 ____D C:\Users\Rainer\AppData\Roaming\DVDVideoSoft
2013-09-20 10:34 - 2013-09-20 10:23 - 00000000 ____D C:\Program Files (x86)\DealPly
2013-09-20 10:23 - 2013-09-20 10:23 - 00003238 _____ C:\Windows\System32\Tasks\Dealply
2013-09-20 10:23 - 2013-09-20 10:22 - 00003420 _____ C:\Windows\System32\Tasks\BitGuard
2013-09-20 10:23 - 2012-11-13 13:53 - 00000000 ____D C:\Program Files (x86)\DVDVideoSoft
2013-09-20 10:22 - 2013-09-20 10:22 - 00000000 ____D C:\Windows\SysWOW64\searchplugins
2013-09-20 10:22 - 2013-09-20 10:22 - 00000000 ____D C:\Windows\SysWOW64\Extensions
2013-09-20 10:22 - 2013-09-20 10:22 - 00000000 ____D C:\ProgramData\Babylon
2013-09-19 21:07 - 2013-09-19 21:06 - 00000000 ____D C:\Users\Rainer\AppData\Local\{CF11E99B-8923-48FC-94FB-789E3EBD2330}
2013-09-18 06:10 - 2013-09-18 06:10 - 00000000 ____D C:\Users\Rainer\AppData\Local\{F5AE5685-5D5E-4BB7-957E-8D70E3E466A3}
Files to move or delete:
====================
C:\Users\Rainer\AppData\Roaming\settings.ini
C:\ProgramData\gtfylcyrkalmndvmsmq.bat
C:\ProgramData\gtfylcyrkalmndvmsmq.reg
C:\Users\Rainer\AppData\Roaming\i.ini
Some content of TEMP:
====================
C:\Users\LisiRaini\AppData\Local\Temp\sfamcc00001.dll
C:\Users\LisiRaini\AppData\Local\Temp\sfareca00001.dll
C:\Users\Rainer\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-10-13 03:37
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-10-17 05:34:26
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\0000005c ST310005 rev.HP35 931,51GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Rainer\AppData\Local\Temp\ufdcqpog.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe[1716] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000074b91465 2 bytes [B9, 74]
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe[1716] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000074b914bb 2 bytes [B9, 74]
.text ... * 2
? C:\Windows\system32\mssprxy.dll [2428] entry point in ".rdata" section 0000000073cd71e6
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3260] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000074b91465 2 bytes [B9, 74]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3260] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000074b914bb 2 bytes [B9, 74]
.text ... * 2
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4024] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000074b91465 2 bytes [B9, 74]
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4024] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000074b914bb 2 bytes [B9, 74]
.text ... * 2
---- Threads - GMER 2.1 ----
Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [4776:3312] 000007fefae92a7c
Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [4776:1360] 000007feef6dd618
Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [4776:1364] 000007feef6dd618
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\00163839be03
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\00163839be03@ac932f9ab00c 0x89 0xDA 0x22 0x92 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\00163839be03@f06bca908079 0xBF 0xF0 0xB3 0x78 ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\00163839be03 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\00163839be03@ac932f9ab00c 0x89 0xDA 0x22 0x92 ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\00163839be03@f06bca908079 0xBF 0xF0 0xB3 0x78 ...
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
Code:
ATTFilter Emsisoft Anti-Malware - Version 8.1
Letztes Update: 10/17/2013 6:28:57 AM
Benutzerkonto: Rainer-HP\Rainer
Scan Einstellungen:
Scan Methode: Schnelltest
Objekte: Rootkits, Speicher, Traces
PUPs-Erkennung: An
Archiv Scan: Aus
ADS Scan: An
Dateitypen-Filter: Aus
Erweitertes Caching: An
Direkter Festplattenzugriff: Aus
Scan Beginn: 10/17/2013 6:30:55 AM
C:\Users\Rainer\AppData\Roaming\Microsoft\Windows\Templates\2433f433 gefunden: Trace.File.Locker (A)
Value: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113} -> HELPTEXT gefunden: Trace.Registry.SEO Toolbar (A)
Value: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113} -> MENUTEXT gefunden: Trace.Registry.SEO Toolbar (A)
Value: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\TOOLBAR -> {AE07101B-46D4-4A98-AF68-0333EA26E113} gefunden: Trace.Registry.SEO Toolbar (A)
Gescannt 322246
Gefunden 4
Scan Ende: 10/17/2013 6:32:14 AM
Scan Zeit: 0:01:19
Value: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113} -> HELPTEXT Quarantäne Trace.Registry.SEO Toolbar (A)
Value: HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113} -> MENUTEXT Quarantäne Trace.Registry.SEO Toolbar (A)
Value: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\TOOLBAR -> {AE07101B-46D4-4A98-AF68-0333EA26E113} Quarantäne Trace.Registry.SEO Toolbar (A)
C:\Users\Rainer\AppData\Roaming\Microsoft\Windows\Templates\2433f433 Quarantäne Trace.File.Locker (A)
Quarantäne 4
|
| Themen zu Internet Game, Passwort wird immer geändert |
| administrator, adobe, antivir, avira, dll, einstellungen, emsisoft, explorer, farbar, farbar recovery scan tool, fehler, festplatte, flash player, google, helper, home, internet, opera, plug-in, registry, rundll, scan, security, services.exe, software, system, temp, trace.registry.seo, trojaner, winlogon.exe, ändern |
Baum-Darstellung