|
Log-Analyse und Auswertung: Windows, Trojaner, Antivirenprogramm gelöscht von externWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
21.10.2013, 12:18 | #1 |
| Windows, Trojaner, Antivirenprogramm gelöscht von extern Hallo, letzte Woche bekam ich mehrere Fehlermeldungen "Blend", "COPP", "WinHex" funktionieren nicht. Außerdem konnte ich den Adobe Reader nicht mehr öffnen, das Öffnen von Firefox und xing dauert extrem lange und MS Secure Essentials war vom Laptop verschwunden. Nach Neuinstallation und Suchlauf fand es einen Trojaner, den ich anschließend gelöscht habe. Kurzzeitig lief alles wieder normal, nun gibt es dieselben Fehlermeldungen und das Antivirenprogramm ist schon wieder verschwunden. Die gmer-datei ist zu groß, daher habe ich sie verpackt; ich hoffe Ihr könnt sie öffnen. Additional scan result of Farbar Recovery Scan Tool (x64) Version: 21-10-2013 Ran by Gabriele at 2013-10-21 10:29:27 Running from C:\Users\Gabriele\Pictures\Desktop Boot Mode: Normal ========================================================== ==================== Security Center ======================== AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installed Programs ====================== Acer ePower Management (x32 Version: 4.05.3007) Acer eRecovery Management (x32 Version: 4.05.3013) Acer Registration (x32 Version: 1.03.3003) Adobe AIR (x32 Version: 3.9.0.1030) Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.117) Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.117) Adobe Reader XI (11.0.05) - Deutsch (x32 Version: 11.0.05) Adobe Shockwave Player 11.6 (x32 Version: 11.6.7.637) AFPL Ghostscript 8.54 (x32) AFPL Ghostscript Fonts (x32) Apple Application Support (x32 Version: 2.3.4) Apple Mobile Device Support (Version: 3.4.0.25) Apple Software Update (x32 Version: 2.1.3.127) Ashampoo WinOptimizer Free v.1.0.0 (x32 Version: 1.0.0) Ask Toolbar (x32 Version: 1.14.1.0) Ask Toolbar Updater (HKCU Version: 1.2.0.20007) Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (x32 Version: 1.0.0.33) Audiograbber 1.83 SE (x32 Version: 1.83 SE ) AxCrypt 1.7.2976.0 (Version: 1.7.2976.0) BitGuard (x32) BrowserCompanion (x32) CCleaner (Version: 4.05) Conexant HD Audio (Version: 4.98.9.0) Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32) Defraggler (Version: 2.12) Delta Chrome Toolbar (x32) Delta toolbar (x32 Version: 1.8.21.5) ElsterFormular (x32 Version: 14.1.11318) ElsterFormular für Privatanwender (x32 Version: 12.1.0.6164p) ElsterFormular für Unternehmer (x32 Version: 12.1.0.6164u) ElsterFormular-Upgrade (x32 Version: 14.1.11318) Free YouTube to MP3 Converter version 3.12.10.812 (x32 Version: 3.12.10.812) FreeMind (x32 Version: 0.9.0) FreePDF (Remove only) (x32) Google Chrome (x32 Version: 30.0.1599.101) Google Update Helper (x32 Version: 1.3.21.165) GPL Ghostscript 9.00 (x32) Identity Card (x32 Version: 1.00.3003) Intel(R) Control Center (x32 Version: 1.2.1.1007) Intel(R) Rapid Storage Technology (x32 Version: 9.6.0.1014) InterVideo WinDVD 8 (x32 Version: 8.5.10.76) Java 7 Update 13 (64-bit) (Version: 7.0.130) Java Auto Updater (x32 Version: 2.0.7.2) Java(TM) 6 Update 13 (64-bit) (Version: 6.0.130) Java(TM) 6 Update 39 (x32 Version: 6.0.390) Junk Mail filter update (x32 Version: 14.0.8117.416) Launch Manager (x32 Version: 3.0.04) Lexware Abschreibungsrechner (x32 Version: 10.50.04.0001) Lexware Elster (x32 Version: 9.10.00.0041) Lexware Info Service (x32 Version: 2.61.00.0033) Lexware online banking (x32 Version: 10.00.00.0102) Lexware QuickBooks 2011 (x32 Version: 23.50.04.0059) Lexware Zeiterfassung (x32 Version: 23.00.04.0005) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319) Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319) Microsoft Application Error Reporting (Version: 12.0.6015.5000) Microsoft Choice Guard (x32 Version: 2.0.48.0) Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Home and Business 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000) Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000) Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Single Image 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000) Microsoft Silverlight (Version: 5.1.20913.0) Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000) Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (x32 Version: 8.0.50727.4053) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001) Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (x32 Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161) Mobile Broadband HL Service (x32 Version: 22.001.14.00.03) Mozilla Firefox 24.0 (x86 de) (x32 Version: 24.0) Mozilla Maintenance Service (x32 Version: 24.0) MSVCRT (x32 Version: 14.0.1468.721) MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0) MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0) NTI Backup Now 5 (x32 Version: 5.1.2.630) NTI Backup Now Standard (x32 Version: 5.1.2.630) NTI Media Maker 8 (x32 Version: 8.0.12.6636) NVIDIA Drivers (Version: 1.10) Opera 12.16 (x32 Version: 12.16.1860) PDF Blender (x32) QuickTime (x32 Version: 7.74.80.86) Realtek USB 2.0 Card Reader (x32 Version: 6.1.7100.30094) RedMon - Redirection Port Monitor Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32) Servicepack Datumsaktualisierung (x32 Version: 1.00.00.0005) swMSM (x32 Version: 12.0.0.1) Synaptics Pointing Device Driver (Version: 14.0.6.0) UBitMenuDE (x32 Version: 01.04) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3) Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (x32) Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2494150) (x32) Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition (x32) Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition (x32) Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (x32) Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (x32) Update for Microsoft Word 2010 (KB2827323) 32-Bit Edition (x32) ViKi Desktop Plug-in (x32 Version: 0.6) Windows Live Anmelde-Assistent (x32 Version: 5.000.818.5) Windows Live Call (x32 Version: 14.0.8117.0416) Windows Live Communications Platform (x32 Version: 14.0.8117.416) Windows Live Essentials (x32 Version: 14.0.8117.0416) Windows Live Essentials (x32 Version: 14.0.8117.416) Windows Live Fotogalerie (x32 Version: 14.0.8117.416) Windows Live Mail (x32 Version: 14.0.8117.0416) Windows Live Messenger (x32 Version: 14.0.8117.0416) Windows Live Movie Maker (x32 Version: 14.0.8117.0416) Windows Live Sync (x32 Version: 14.0.8117.416) Windows Live Writer (x32 Version: 14.0.8117.0416) Windows Live-Uploadtool (x32 Version: 14.0.8014.1029) Windows Media Player Firefox Plugin (x32 Version: 1.0.0.8) Winload Toolbar (x32 Version: 6.8.5.1) WinRAR 4.10 (64-Bit) (Version: 4.10.0) WinSCP 4.2.9 (x32 Version: 4.2.9) Yahoo! Detect (x32) ==================== Restore Points ========================= 17-10-2013 13:06:05 Removed Adobe Reader XI (11.0.05) - Deutsch. 18-10-2013 08:16:45 Windows Update 19-10-2013 11:14:10 Windows-Sicherung 19-10-2013 11:21:57 Windows-Sicherung 19-10-2013 17:06:02 Removed Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 19-10-2013 17:06:59 Windows Update 19-10-2013 17:13:02 Windows Modules Installer 19-10-2013 17:19:29 Windows Update 19-10-2013 18:28:13 Windows Modules Installer 20-10-2013 12:11:23 Windows-Sicherung 20-10-2013 13:15:25 Windows Update 20-10-2013 17:00:11 Windows-Sicherung ==================== Hosts content: ========================== 2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: {08B3A1C8-E392-4D31-9B31-EEAF727BFC43} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-08-21] (Piriform Ltd) Task: {1AF99804-DB7B-4BBC-9181-E341DBF1340A} - System32\Tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan => c:\Program Files\Microsoft Security Client\MpCmdRun.exe Task: {2F1BE1DC-B08D-46EF-A2ED-B933B213F4C1} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-10-08] (Google Inc.) Task: {45B19051-5EB5-4A6A-9B5C-00D70E2FEF2A} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files (x86)\Ask.com\UpdateTask.exe [2012-01-03] () Task: {5AFDD7C5-40E8-4741-A46F-B30E67F85805} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-23] (Microsoft Corporation) Task: {6188F815-8FD6-4A1A-9018-603920809AF3} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks Task: {A952390E-B147-4ED5-A0CB-F61AB2FC8C8E} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc Task: {D9837860-EDB3-4836-98C8-B7FC90141AF5} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-10-08] (Google Inc.) Task: {DFC79B9A-B57C-46AD-9B08-7B2AF60910FD} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-09] (Adobe Systems Incorporated) Task: {EB3C036C-6D9C-4790-9A13-51B07CAB161F} - System32\Tasks\EPUpdater => C:\Users\Gabriele\AppData\Roaming\BabSolution\Shared\BabMaint.exe [2013-06-06] () Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe ==================== Loaded Modules (whitelisted) ============= 2012-01-28 19:26 - 2012-01-09 20:44 - 00193536 _____ () C:\Program Files\WinRAR\rarext.dll 2013-10-08 22:24 - 2013-10-08 14:16 - 02704352 _____ () C:\ProgramData\BitGuard\2.6.1694.246\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BitGuard.dll 2013-08-15 10:31 - 2013-08-15 10:31 - 00170496 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\44bfa824a3b8a6f789fda79a2e01a8db\IsdiInterop.ni.dll 2010-09-23 04:51 - 2010-03-04 05:08 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll ==================== Alternate Data Streams (whitelisted) ========= ==================== Safe Mode (whitelisted) =================== ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (10/21/2013 09:59:29 AM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: zuru.exe, Version: 2.2.1.2, Zeitstempel: 0x51a37fc7 Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea8e7 Ausnahmecode: 0xc0000374 Fehleroffset: 0x000ce753 ID des fehlerhaften Prozesses: 0x9ec Startzeit der fehlerhaften Anwendung: 0xzuru.exe0 Pfad der fehlerhaften Anwendung: zuru.exe1 Pfad des fehlerhaften Moduls: zuru.exe2 Berichtskennung: zuru.exe3 Error: (10/20/2013 11:11:57 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: zuru.exe, Version: 2.2.1.2, Zeitstempel: 0x51a37fc7 Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea8e7 Ausnahmecode: 0xc0000374 Fehleroffset: 0x000ce753 ID des fehlerhaften Prozesses: 0xb1c Startzeit der fehlerhaften Anwendung: 0xzuru.exe0 Pfad der fehlerhaften Anwendung: zuru.exe1 Pfad des fehlerhaften Moduls: zuru.exe2 Berichtskennung: zuru.exe3 Error: (10/20/2013 11:09:32 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: zuru.exe, Version: 2.2.1.2, Zeitstempel: 0x51a37fc7 Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea8e7 Ausnahmecode: 0xc0000374 Fehleroffset: 0x000ce753 ID des fehlerhaften Prozesses: 0xc08 Startzeit der fehlerhaften Anwendung: 0xzuru.exe0 Pfad der fehlerhaften Anwendung: zuru.exe1 Pfad des fehlerhaften Moduls: zuru.exe2 Berichtskennung: zuru.exe3 Error: (10/20/2013 11:05:41 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: emuhd.exe, Version: 2.4.1.2, Zeitstempel: 0x51a37fc7 Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea8e7 Ausnahmecode: 0xc0000374 Fehleroffset: 0x000ce753 ID des fehlerhaften Prozesses: 0xc64 Startzeit der fehlerhaften Anwendung: 0xemuhd.exe0 Pfad der fehlerhaften Anwendung: emuhd.exe1 Pfad des fehlerhaften Moduls: emuhd.exe2 Berichtskennung: emuhd.exe3 Error: (10/20/2013 10:59:13 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: teapo.exe, Version: 1.0.0.0, Zeitstempel: 0x51a37fc7 Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000 Ausnahmecode: 0xc0000005 Fehleroffset: 0x73d0e384 ID des fehlerhaften Prozesses: 0xc50 Startzeit der fehlerhaften Anwendung: 0xteapo.exe0 Pfad der fehlerhaften Anwendung: teapo.exe1 Pfad des fehlerhaften Moduls: teapo.exe2 Berichtskennung: teapo.exe3 Error: (10/20/2013 07:52:55 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: fpRedMon.exe, Version: 4.0.0.26, Zeitstempel: 0x4cbc9a7e Name des fehlerhaften Moduls: bitguard.dll, Version: 2.6.1694.246, Zeitstempel: 0x5253f78e Ausnahmecode: 0xc0000005 Fehleroffset: 0x0017966f ID des fehlerhaften Prozesses: 0xc7c Startzeit der fehlerhaften Anwendung: 0xfpRedMon.exe0 Pfad der fehlerhaften Anwendung: fpRedMon.exe1 Pfad des fehlerhaften Moduls: fpRedMon.exe2 Berichtskennung: fpRedMon.exe3 Error: (10/20/2013 05:16:17 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: zuru.exe, Version: 2.2.1.2, Zeitstempel: 0x51a37fc7 Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea8e7 Ausnahmecode: 0xc0000374 Fehleroffset: 0x000ce753 ID des fehlerhaften Prozesses: 0x6bc Startzeit der fehlerhaften Anwendung: 0xzuru.exe0 Pfad der fehlerhaften Anwendung: zuru.exe1 Pfad des fehlerhaften Moduls: zuru.exe2 Berichtskennung: zuru.exe3 Error: (10/20/2013 05:01:28 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: zuru.exe, Version: 2.2.1.2, Zeitstempel: 0x51a37fc7 Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea8e7 Ausnahmecode: 0xc0000374 Fehleroffset: 0x000ce753 ID des fehlerhaften Prozesses: 0x74c Startzeit der fehlerhaften Anwendung: 0xzuru.exe0 Pfad der fehlerhaften Anwendung: zuru.exe1 Pfad des fehlerhaften Moduls: zuru.exe2 Berichtskennung: zuru.exe3 Error: (10/20/2013 02:36:53 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: zuru.exe, Version: 2.2.1.2, Zeitstempel: 0x51a37fc7 Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea8e7 Ausnahmecode: 0xc0000374 Fehleroffset: 0x000ce753 ID des fehlerhaften Prozesses: 0x870 Startzeit der fehlerhaften Anwendung: 0xzuru.exe0 Pfad der fehlerhaften Anwendung: zuru.exe1 Pfad des fehlerhaften Moduls: zuru.exe2 Berichtskennung: zuru.exe3 Error: (10/20/2013 01:56:15 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: svchost.exe_Dnscache, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bc3c1 Name des fehlerhaften Moduls: msvcrt.dll, Version: 7.0.7601.17744, Zeitstempel: 0x4eeb033f Ausnahmecode: 0xc0000005 Fehleroffset: 0x00000000000015c1 ID des fehlerhaften Prozesses: 0x428 Startzeit der fehlerhaften Anwendung: 0xsvchost.exe_Dnscache0 Pfad der fehlerhaften Anwendung: svchost.exe_Dnscache1 Pfad des fehlerhaften Moduls: svchost.exe_Dnscache2 Berichtskennung: svchost.exe_Dnscache3 System errors: ============= Error: (10/20/2013 02:55:47 PM) (Source: DCOM) (User: ) Description: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39} Error: (10/20/2013 02:35:53 PM) (Source: EventLog) (User: ) Description: Das System wurde zuvor am 20.10.2013 um 14:33:23 unerwartet heruntergefahren. Error: (10/20/2013 01:58:15 PM) (Source: Service Control Manager) (User: ) Description: Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden des Dienstes "DNS-Client" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen, ist fehlgeschlagen. Fehler: %%1056 Error: (10/20/2013 01:56:15 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Telefonie" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts. Error: (10/20/2013 01:56:15 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "NLA (Network Location Awareness)" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 100 Millisekunden durchgeführt: Neustart des Diensts. Error: (10/20/2013 01:56:15 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Arbeitsstationsdienst" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts. Error: (10/20/2013 01:56:15 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "DNS-Client" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts. Error: (10/20/2013 01:56:15 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Kryptografiedienste" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts. Error: (10/20/2013 08:25:56 AM) (Source: Service Control Manager) (User: ) Description: Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden des Dienstes "DNS-Client" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen, ist fehlgeschlagen. Fehler: %%1056 Error: (10/20/2013 08:25:57 AM) (Source: DCOM) (User: ) Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF} Microsoft Office Sessions: ========================= Error: (10/21/2013 09:59:29 AM) (Source: Application Error)(User: ) Description: zuru.exe2.2.1.251a37fc7ntdll.dll6.1.7601.18247521ea8e7c0000374000ce7539ec01cece33727a8330C:\Users\Gabriele\AppData\Roaming\Okysz\zuru.exeC:\Windows\Sy sWOW64\ntdll.dllb5f812ae-3a26-11e3-8d9f-60eb695fffc7 Error: (10/20/2013 11:11:57 PM) (Source: Application Error)(User: ) Description: zuru.exe2.2.1.251a37fc7ntdll.dll6.1.7601.18247521ea8e7c0000374000ce753b1c01cecdd8fd227b81C:\Users\Gabriele\AppData\Roaming\Okysz\zuru.exeC:\Windows\Sy sWOW64\ntdll.dll402dc8b8-39cc-11e3-89cd-60eb695fffc7 Error: (10/20/2013 11:09:32 PM) (Source: Application Error)(User: ) Description: zuru.exe2.2.1.251a37fc7ntdll.dll6.1.7601.18247521ea8e7c0000374000ce753c0801cecdd8a5700b45C:\Users\Gabriele\AppData\Roaming\Okysz\zuru.exeC:\Windows\Sy sWOW64\ntdll.dlle9a34e65-39cb-11e3-99ce-60eb695fffc7 Error: (10/20/2013 11:05:41 PM) (Source: Application Error)(User: ) Description: emuhd.exe2.4.1.251a37fc7ntdll.dll6.1.7601.18247521ea8e7c0000374000ce753c6401cecdd8140e0edeC:\Users\Gabriele\AppData\Roaming\Xyege\emuhd.exeC:\Windows\ SysWOW64\ntdll.dll602ec59c-39cb-11e3-8923-60eb695fffc7 Error: (10/20/2013 10:59:13 PM) (Source: Application Error)(User: ) Description: teapo.exe1.0.0.051a37fc7unknown0.0.0.000000000c000000573d0e384c5001cecdd726df0105C:\Users\Gabriele\AppData\Roaming\Asma\teapo.exeunknown78a7b7fe-39ca-11e3-8833-60eb695fffc7 Error: (10/20/2013 07:52:55 PM) (Source: Application Error)(User: ) Description: fpRedMon.exe4.0.0.264cbc9a7ebitguard.dll2.6.1694.2465253f78ec00000050017966fc7c01cecdbd33bbb442C:\Program Files (x86)\FreePDF_XP\fpRedMon.exec:\progra~3\bitguard\2.6.1694.246\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\bitguard.dll725d6cde-39b0-11e3-8ac5-60eb695fffc7 Error: (10/20/2013 05:16:17 PM) (Source: Application Error)(User: ) Description: zuru.exe2.2.1.251a37fc7ntdll.dll6.1.7601.18247521ea8e7c0000374000ce7536bc01cecda74ccf4916C:\Users\Gabriele\AppData\Roaming\Okysz\zuru.exeC:\Windows\Sy sWOW64\ntdll.dll90629b75-399a-11e3-8ac5-60eb695fffc7 Error: (10/20/2013 05:01:28 PM) (Source: Application Error)(User: ) Description: zuru.exe2.2.1.251a37fc7ntdll.dll6.1.7601.18247521ea8e7c0000374000ce75374c01cecda534f660daC:\Users\Gabriele\AppData\Roaming\Okysz\zuru.exeC:\Windows\Sy sWOW64\ntdll.dll7ed3e5e2-3998-11e3-8299-60eb695fffc7 Error: (10/20/2013 02:36:53 PM) (Source: Application Error)(User: ) Description: zuru.exe2.2.1.251a37fc7ntdll.dll6.1.7601.18247521ea8e7c0000374000ce75387001cecd910709baa5C:\Users\Gabriele\AppData\Roaming\Okysz\zuru.exeC:\Windows\Sy sWOW64\ntdll.dll4c2bca53-3984-11e3-adb1-60eb695fffc7 Error: (10/20/2013 01:56:15 PM) (Source: Application Error)(User: ) Description: svchost.exe_Dnscache6.1.7600.163854a5bc3c1msvcrt.dll7.0.7601.177444eeb033fc000000500000000000015c142801cecd8a78a58169C:\Windows\system32\svchost.exeC: \Windows\system32\msvcrt.dll9ee85431-397e-11e3-82df-60eb695fffc7 ==================== Memory info =========================== Percentage of memory in use: 34% Total physical RAM: 4060.93 MB Available physical RAM: 2646.08 MB Total Pagefile: 8120.04 MB Available Pagefile: 6625.57 MB Total Virtual: 8192 MB Available Virtual: 8191.83 MB ==================== Drives ================================ Drive c: (Acer) (Fixed) (Total:452.66 GB) (Free:391.8 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 18C901F6) Partition 1: (Not Active) - (Size=13 GB) - (Type=27) Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=453 GB) - (Type=07 NTFS) ==================== End Of Log ============================ defogger_disable by jpshortstuff (23.02.10.1) Log created at 10:20 on 21/10/2013 (Gabriele) Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers... -=E.O.F=- Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 21-10-2013 Ran by Gabriele (administrator) on NB-GABRIELE on 21-10-2013 10:28:42 Running from C:\Users\Gabriele\Pictures\Desktop Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 10 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe (Microsoft Corporation) C:\Windows\system32\WLANExt.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe () C:\ProgramData\BitGuard\2.6.1694.246\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BitGuard.exe (Microsoft Corporation) C:\Windows\SysWOW64\schtasks.exe (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe (Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe (InterVideo) C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe () C:\ProgramData\MobileBrServ\mbbservice.exe (NTI, Inc.) C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe (Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe () C:\ProgramData\BitGuard\2.6.1694.246\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BitGuard.exe (Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe (Sun Microsystems, Inc.) C:\Program Files\Java\jre6\bin\jusched.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (CastFree Software) C:\Users\Gabriele\AppData\Roaming\fnmod_32.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE () C:\Users\Gabriele\AppData\Roaming\BrowserCompanion\tbhcn.exe () C:\Program Files (x86)\ViiKiiDesktopPlugin\ViiKiiDesktopPlugin.exe (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.EXE (shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe (Lexware GmbH & Co. KG) C:\Program Files (x86)\Common Files\Lexware\Update Manager\LxUpdateManager.exe (Ask) C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Opera Software) C:\Program Files (x86)\Opera\opera.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [cAudioFilterAgent] - C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [503864 2009-07-20] (Conexant Systems, Inc.) HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1842472 2009-09-17] (Synaptics Incorporated) HKLM\...\Run: [Acer ePower Management] - C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [818720 2010-02-26] (Acer Incorporated) HKLM\...\Run: [NvCplDaemon] - RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Java\jre6\bin\jusched.exe [170496 2010-11-30] (Sun Microsystems, Inc.) HKCU\...\Run: [Affoohrays] - C:\Users\Gabriele\AppData\Roaming\Guyd\yxuzl.exe HKCU\...\Run: [Ybwoquesag] - C:\Users\Gabriele\AppData\Roaming\Okysz\zuru.exe [329728 2011-05-26] (InstaSmart Soft) HKCU\...\Run: [Elzobory] - C:\Users\Gabriele\AppData\Roaming\Asma\teapo.exe [311296 2012-04-07] (Mandiant) HKCU\...\Run: [Qeenro] - C:\Users\Gabriele\AppData\Roaming\Xyege\emuhd.exe [310784 2011-06-14] (CastFree Software) HKCU\...\Run: [FNModuleUpdater] - C:\Users\Gabriele\AppData\Roaming\fnmod_32.exe [132608 2013-10-20] (CastFree Software) HKCU\...\Run: [Opvigay] - C:\Users\Gabriele\AppData\Roaming\Izcy\guwem.exe [310784 2013-07-02] (CastFree Software) MountPoints2: {84638f90-bd65-11e2-82dd-60eb695fffc7} - E:\AutoRun.exe HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-03-04] (Intel Corporation) HKLM-x32\...\Run: [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe [825864 2009-09-24] (Dritek System Inc.) HKLM-x32\...\Run: [FreePDF Assistant] - C:\Program Files (x86)\FreePDF_XP\fpassist.exe [370176 2010-06-17] (shbox.de) HKLM-x32\...\Run: [LexwareInfoService] - C:\Program Files (x86)\Common Files\Lexware\Update Manager\LxUpdateManager.exe [339240 2008-11-03] (Lexware GmbH & Co. KG) HKLM-x32\...\Run: [] - [x] HKLM-x32\...\Run: [ApnUpdater] - C:\Program Files (x86)\Ask.com\Updater\Updater.exe [1391272 2012-01-03] (Ask) HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.) HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.) HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-09-05] (Adobe Systems Incorporated) HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default HKU\Default User\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default AppInit_DLLs-x32: c:\progra~3\bitguard\2.6.1694.246\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\bitguard.dll [2704352 2013-10-08] () Startup: C:\Users\Gabriele\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation) Startup: C:\Users\Gabriele\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tbhcn.lnk ShortcutTarget: tbhcn.lnk -> C:\Users\Gabriele\AppData\Roaming\BrowserCompanion\tbhcn.exe () Startup: C:\Users\Gabriele\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ViiKiiDesktopPlugin.lnk ShortcutTarget: ViiKiiDesktopPlugin.lnk -> C:\Program Files (x86)\ViiKiiDesktopPlugin\ViiKiiDesktopPlugin.exe () ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www1.delta-search.com/?babsrc=HP_ss&mntrId=48554C0F6E2B3E6B&affID=121563&tt=110713_91114&tsp=4941 HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com HKCU\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = hxxp://www.golsearch.com/?babsrc=HP_ss_Btisdt6&mntrId=48554C0F6E2B3E6B&affID=121563&tt=110713_91114&tsp=4941 URLSearchHook: (No Name) - {00000000-6E41-4FD3-8538-502F5495E5FC} - No File URLSearchHook: (No Name) - {40c3cc16-7269-4b32-9531-17f2950fb06f} - No File SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox SearchScopes: HKLM-x32 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKCU - bProtectorDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www1.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=48554C0F6E2B3E6B&affID=121563&tt=110713_91114&tsp=4941 SearchScopes: HKCU - {4327FABE-3C22-4689-8DBF-D226CF777FE9} URL = hxxp://www.searchplusnetwork.com/?sp=vit4&q={searchTerms} SearchScopes: HKCU - {A1637760-D76D-48AF-8BFC-0F2F043E73A4} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=OSJ000&apn_uid=6F35FE75-9B30-4F27-B28B-30BB5353C49B&apn_sauid=54620E73-BCE9-4504-84B2-2AC7E85EE0B0 BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.) BHO-x32: Browser Companion Helper - {00cbb66b-1d3b-46d3-9577-323a336acb50} - C:\Program Files (x86)\BrowserCompanion\jsloader.dll ( ) BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) BHO-x32: Browser Companion Helper Verifier - {963B125B-8B21-49A2-A3A8-E37092276531} - C:\Program Files (x86)\BrowserCompanion\updatebhoWin32.dll ( ) BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: delta Helper Object - {C1AF5FA5-852C-4C90-812E-A7F75E011D87} - C:\Program Files (x86)\Delta\delta\1.8.21.5\bh\delta.dll (Delta-search.com) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) BHO-x32: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.) Toolbar: HKLM-x32 - Delta Toolbar - {82E1477C-B154-48D3-9891-33D83C26BCD3} - C:\Program Files (x86)\Delta\delta\1.8.21.5\deltaTlbr.dll (Delta-search.com) Toolbar: HKCU - No Name - {40C3CC16-7269-4B32-9531-17F2950FB06F} - No File DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab Handler: base64 - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - No File Handler: chrome - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - No File Handler: prox - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - No File Handler-x32: base64 - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - C:\Program Files (x86)\BrowserCompanion\tdataprotocol.dll (Blabbers Communications Ltd) Handler-x32: chrome - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - C:\Program Files (x86)\BrowserCompanion\tdataprotocol.dll (Blabbers Communications Ltd) Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation) Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation) Handler-x32: prox - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - C:\Program Files (x86)\BrowserCompanion\tdataprotocol.dll (Blabbers Communications Ltd) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\Gabriele\AppData\Roaming\Mozilla\Firefox\Profiles\8pdx3bji.default FF user.js: detected! => C:\Users\Gabriele\AppData\Roaming\Mozilla\Firefox\Profiles\8pdx3bji.default\user.js FF NewTab: hxxp://www.golsearch.com/?babsrc=NT_ss_Btisdt6&mntrId=48554C0F6E2B3E6B&affID=121563&tt=110713_91114&tsp=4941 FF SearchEngineOrder.1: Delta Search FF SelectedSearchEngine: user_pref("browser.search.selectedEngine", ""); FF Homepage: hxxp://isearch.babylon.com/?babsrc=HP_ss_Btisdt3&mntrId=48554C0F6E2B3E6B&affID=121563&tt=110713_91114&tsp=4941 FF NetworkProxy: "backup.ftp", "" FF NetworkProxy: "backup.ftp_port", 0 FF NetworkProxy: "backup.socks", "" FF NetworkProxy: "backup.socks_port", 0 FF NetworkProxy: "backup.ssl", "" FF NetworkProxy: "backup.ssl_port", 0 FF NetworkProxy: "share_proxy_settings", true FF NetworkProxy: "type", 1 FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll () FF Plugin: @java.com/DTPlugin,version=10.13.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.13.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @microsoft.com/GENUINE - disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1167637.dll (Adobe Systems, Inc.) FF Plugin-x32: @java.com/DTPlugin,version=1.6.0_39 - C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.) FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) FF Plugin-x32: @microsoft.com/GENUINE - disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Users\Gabriele\AppData\Roaming\Mozilla\Firefox\Profiles\8pdx3bji.default\searchplugins\babylon.xml FF SearchPlugin: C:\Users\Gabriele\AppData\Roaming\Mozilla\Firefox\Profiles\8pdx3bji.default\searchplugins\BrowserDefender.xml FF SearchPlugin: C:\Users\Gabriele\AppData\Roaming\Mozilla\Firefox\Profiles\8pdx3bji.default\searchplugins\delta.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: dp Launcher Plugin - C:\Users\Gabriele\AppData\Roaming\Mozilla\Firefox\Profiles\8pdx3bji.default\Extensions\dplauncher@digitalpublishing.de FF Extension: Delta Toolbar - C:\Users\Gabriele\AppData\Roaming\Mozilla\Firefox\Profiles\8pdx3bji.default\Extensions\ffxtlbr@delta.com FF Extension: Adblock Plus - C:\Users\Gabriele\AppData\Roaming\Mozilla\Firefox\Profiles\8pdx3bji.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} FF Extension: No Name - C:\Users\Gabriele\AppData\Roaming\Mozilla\Firefox\Profiles\8pdx3bji.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0034-ABCDEFFEDCBA} FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0039-ABCDEFFEDCBA} FF HKLM-x32\...\Firefox\Extensions: [{ACAA314B-EEBA-48e4-AD47-84E31C44796C}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\ FF Extension: No Name - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\ Chrome: ======= CHR Extension: (YouTube) - C:\Users\Gabriele\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_1 CHR Extension: (Browser Companion Helper) - C:\Users\Gabriele\AppData\Local\Google\Chrome\User Data\Default\Extensions\bodddioamolcibagionmmobehnbhiakf\1.0.5_0 CHR Extension: (Google Search) - C:\Users\Gabriele\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_1 CHR Extension: (Gmail) - C:\Users\Gabriele\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1 CHR HKLM-x32\...\Chrome\Extension: [bodddioamolcibagionmmobehnbhiakf] - C:\Program Files (x86)\BrowserCompanion\blabbers-ch.crx CHR HKLM-x32\...\Chrome\Extension: [eooncjejnppfjjklapaamhcdmjbilmde] - C:\Users\Gabriele\AppData\Roaming\BabSolution\CR\Delta.crx ==================== Services (Whitelisted) ================= R2 BitGuard; C:\ProgramData\BitGuard\2.6.1694.246\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BitGuard.exe [3032032 2013-10-08] () S3 DfSdkS; C:\Program Files (x86)\Ashampoo\Ashampoo WinOptimizer Free\Dfsdks.exe [544768 2009-08-24] (mst software GmbH, Germany) R2 Mobile Broadband HL Service; C:\ProgramData\MobileBrServ\mbbservice.exe [232288 2012-03-12] () R2 NTISchedulerSvc; C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [144640 2010-04-17] (NTI, Inc.) ==================== Drivers (Whitelisted) ==================== S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [x] S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [x] U3 kwdiauod; \??\C:\Users\Gabriele\AppData\Local\Temp\kwdiauod.sys [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-10-21 10:28 - 2013-10-21 10:28 - 00000000 ____D C:\FRST 2013-10-21 10:20 - 2013-10-21 10:20 - 00000000 _____ C:\Users\Gabriele\defogger_reenable 2013-10-21 10:04 - 2013-10-21 10:05 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Wezuza 2013-10-21 10:04 - 2013-10-21 10:04 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Neagyg 2013-10-21 10:04 - 2013-10-21 10:04 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Izcy 2013-10-20 17:16 - 2013-10-20 17:16 - 00132608 _____ (CastFree Software) C:\Users\Gabriele\AppData\Roaming\fnmod_32.exe 2013-10-20 17:07 - 2013-10-20 17:07 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Xyege 2013-10-20 17:07 - 2013-10-20 17:07 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Nyof 2013-10-20 17:07 - 2013-10-20 17:07 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Myiliv 2013-10-20 14:24 - 2013-10-20 15:17 - 00000923 _____ C:\Windows\DtcInstall.log 2013-10-20 14:24 - 2013-10-20 14:52 - 00003144 _____ C:\Windows\comsetup.log 2013-10-20 08:17 - 2013-10-20 08:17 - 00354960 _____ C:\Windows\system32\FNTCACHE.DAT 2013-10-20 08:17 - 2013-10-20 08:17 - 00090384 _____ C:\Users\Gabriele\AppData\Local\GDIPFONTCACHEV1.DAT 2013-10-19 22:47 - 2013-10-21 09:59 - 00000840 _____ C:\Windows\setupact.log 2013-10-19 22:47 - 2013-10-19 22:47 - 00000000 _____ C:\Windows\setuperr.log 2013-10-19 18:09 - 2013-10-20 17:01 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Wulyq 2013-10-19 18:09 - 2013-10-19 18:09 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Laxew 2013-10-19 18:09 - 2013-10-19 18:09 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Asma 2013-10-17 15:12 - 2013-10-17 15:12 - 00002023 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk 2013-10-16 20:26 - 2013-10-19 20:30 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Uxubex 2013-10-16 20:26 - 2013-10-19 13:32 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Nunew 2013-10-16 20:26 - 2013-10-16 20:26 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Avyv 2013-10-16 15:04 - 2013-10-19 13:27 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Axaxt 2013-10-16 15:04 - 2013-10-17 22:10 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Niyfxe 2013-10-16 15:04 - 2013-10-16 15:04 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Utaxd 2013-10-16 09:56 - 2013-10-19 20:30 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Piidim 2013-10-16 09:56 - 2013-10-19 13:27 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Apog 2013-10-16 09:56 - 2013-10-16 09:56 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Xywue 2013-10-15 18:18 - 2013-10-20 17:01 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Myeh 2013-10-15 18:18 - 2013-10-15 18:18 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Yxacdy 2013-10-15 18:18 - 2013-10-15 18:18 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Okysz 2013-10-15 12:49 - 2013-10-19 20:30 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Racup 2013-10-15 12:49 - 2013-10-19 13:32 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Gahu 2013-10-15 12:49 - 2013-10-15 12:49 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Ufnafo 2013-10-15 10:29 - 2013-10-19 13:32 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Imynd 2013-10-15 10:29 - 2013-10-16 12:29 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Liel 2013-10-15 10:29 - 2013-10-15 10:29 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Huuk 2013-10-09 13:42 - 2013-09-23 01:28 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2013-10-09 13:42 - 2013-09-23 01:28 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2013-10-09 13:42 - 2013-09-23 01:27 - 14335488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2013-10-09 13:42 - 2013-09-23 01:27 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2013-10-09 13:42 - 2013-09-23 01:27 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2013-10-09 13:42 - 2013-09-23 01:27 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2013-10-09 13:42 - 2013-09-23 01:27 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2013-10-09 13:42 - 2013-09-23 01:27 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2013-10-09 13:42 - 2013-09-23 01:27 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2013-10-09 13:42 - 2013-09-23 01:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll 2013-10-09 13:42 - 2013-09-23 01:27 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2013-10-09 13:42 - 2013-09-23 01:27 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2013-10-09 13:42 - 2013-09-23 01:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2013-10-09 13:42 - 2013-09-23 00:55 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2013-10-09 13:42 - 2013-09-23 00:55 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2013-10-09 13:42 - 2013-09-23 00:55 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2013-10-09 13:42 - 2013-09-23 00:54 - 19252224 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2013-10-09 13:42 - 2013-09-23 00:54 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2013-10-09 13:42 - 2013-09-23 00:54 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2013-10-09 13:42 - 2013-09-23 00:54 - 02647552 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2013-10-09 13:42 - 2013-09-23 00:54 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2013-10-09 13:42 - 2013-09-23 00:54 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2013-10-09 13:42 - 2013-09-23 00:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2013-10-09 13:42 - 2013-09-23 00:54 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2013-10-09 13:42 - 2013-09-23 00:54 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2013-10-09 13:42 - 2013-09-23 00:54 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2013-10-09 13:42 - 2013-09-23 00:54 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2013-10-09 13:42 - 2013-09-21 05:38 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2013-10-09 13:42 - 2013-09-21 05:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2013-10-09 13:42 - 2013-09-21 04:48 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe 2013-10-09 13:42 - 2013-09-21 04:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe 2013-10-09 13:25 - 2013-09-14 03:10 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys 2013-10-09 13:25 - 2013-09-08 04:30 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys 2013-10-09 13:25 - 2013-09-08 04:27 - 00327168 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll 2013-10-09 13:25 - 2013-09-08 04:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswsock.dll 2013-10-09 13:25 - 2013-08-29 04:17 - 05549504 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2013-10-09 13:25 - 2013-08-29 04:16 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll 2013-10-09 13:25 - 2013-08-29 04:16 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll 2013-10-09 13:25 - 2013-08-29 04:16 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll 2013-10-09 13:25 - 2013-08-29 04:13 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll 2013-10-09 13:25 - 2013-08-29 03:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2013-10-09 13:25 - 2013-08-29 03:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2013-10-09 13:25 - 2013-08-29 03:50 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll 2013-10-09 13:25 - 2013-08-29 03:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll 2013-10-09 13:25 - 2013-08-29 03:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll 2013-10-09 13:25 - 2013-08-29 03:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll 2013-10-09 13:25 - 2013-08-29 02:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe 2013-10-09 13:25 - 2013-08-29 02:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll 2013-10-09 13:25 - 2013-08-29 02:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe 2013-10-09 13:25 - 2013-08-29 02:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe 2013-10-09 13:25 - 2013-08-28 03:21 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2013-10-09 13:25 - 2013-07-12 12:41 - 00185344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys 2013-10-09 13:25 - 2013-07-12 12:41 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys 2013-10-09 13:25 - 2013-07-04 14:57 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll 2013-10-09 13:25 - 2013-07-04 14:50 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll 2013-10-09 13:25 - 2013-07-04 14:50 - 00102400 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll 2013-10-09 13:25 - 2013-07-04 13:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll 2013-10-09 13:25 - 2013-07-04 13:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll 2013-10-09 13:25 - 2013-07-04 13:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll 2013-10-09 13:25 - 2013-07-04 12:11 - 00140800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys 2013-10-09 13:25 - 2013-07-03 06:40 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys 2013-10-09 13:25 - 2013-07-03 06:05 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys 2013-10-09 13:25 - 2013-07-03 06:05 - 00032896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys 2013-10-09 13:25 - 2013-06-26 00:55 - 00785624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys 2013-10-09 13:25 - 2013-06-06 07:50 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll 2013-10-09 13:25 - 2013-06-06 07:49 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll 2013-10-09 13:25 - 2013-06-06 07:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll 2013-10-09 13:25 - 2013-06-06 07:47 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll 2013-10-09 13:25 - 2013-06-06 06:57 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll 2013-10-09 13:25 - 2013-06-06 06:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll 2013-10-09 13:25 - 2013-06-06 06:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll 2013-10-09 13:25 - 2013-06-06 05:30 - 00368128 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll 2013-10-09 13:25 - 2013-06-06 05:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll 2013-10-09 13:25 - 2013-06-06 05:01 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll 2013-10-09 13:24 - 2013-09-04 14:12 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys 2013-10-09 13:24 - 2013-09-04 14:11 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys 2013-10-09 13:24 - 2013-09-04 14:11 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys 2013-10-09 13:24 - 2013-09-04 14:11 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys 2013-10-09 13:24 - 2013-09-04 14:11 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys 2013-10-09 13:24 - 2013-09-04 14:11 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys 2013-10-09 13:24 - 2013-09-04 14:11 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys 2013-10-09 13:24 - 2013-08-28 03:12 - 00461312 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll 2013-10-09 13:24 - 2013-08-01 14:09 - 00983488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys 2013-10-09 13:24 - 2013-07-20 12:33 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll 2013-10-09 13:24 - 2013-07-20 12:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll 2013-10-08 22:24 - 2013-10-08 22:24 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BitGuard 2013-09-30 17:33 - 2013-10-17 15:03 - 00000000 ____D C:\Users\Gabriele\Pictures\Documents\Kita_Gründung 2013-09-21 17:43 - 2013-09-21 17:43 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\File Scout ==================== One Month Modified Files and Folders ======= 2013-10-21 10:28 - 2013-10-21 10:28 - 00000000 ____D C:\FRST 2013-10-21 10:26 - 2010-11-02 01:40 - 01634987 _____ C:\Windows\WindowsUpdate.log 2013-10-21 10:20 - 2013-10-21 10:20 - 00000000 _____ C:\Users\Gabriele\defogger_reenable 2013-10-21 10:20 - 2010-11-26 18:38 - 00000000 ____D C:\Users\Gabriele 2013-10-21 10:19 - 2012-07-25 13:32 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\BrowserCompanion 2013-10-21 10:06 - 2011-12-06 22:08 - 00001912 _____ C:\Windows\epplauncher.mif 2013-10-21 10:06 - 2009-07-14 06:45 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-10-21 10:06 - 2009-07-14 06:45 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-10-21 10:05 - 2013-10-21 10:04 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Wezuza 2013-10-21 10:04 - 2013-10-21 10:04 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Neagyg 2013-10-21 10:04 - 2013-10-21 10:04 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Izcy 2013-10-21 09:59 - 2013-10-19 22:47 - 00000840 _____ C:\Windows\setupact.log 2013-10-21 09:59 - 2012-10-08 19:03 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2013-10-21 09:59 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2013-10-20 22:38 - 2012-10-08 19:03 - 00001114 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2013-10-20 21:58 - 2012-04-06 19:36 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-10-20 19:53 - 2010-12-08 17:00 - 00000043 _____ C:\Windows\gswin32.ini 2013-10-20 19:52 - 2010-11-27 16:30 - 00000000 ____D C:\Users\Gabriele\AppData\Local\FreePDF_XP 2013-10-20 17:16 - 2013-10-20 17:16 - 00132608 _____ (CastFree Software) C:\Users\Gabriele\AppData\Roaming\fnmod_32.exe 2013-10-20 17:07 - 2013-10-20 17:07 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Xyege 2013-10-20 17:07 - 2013-10-20 17:07 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Nyof 2013-10-20 17:07 - 2013-10-20 17:07 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Myiliv 2013-10-20 17:01 - 2013-10-19 18:09 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Wulyq 2013-10-20 17:01 - 2013-10-15 18:18 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Myeh 2013-10-20 15:17 - 2013-10-20 14:24 - 00000923 _____ C:\Windows\DtcInstall.log 2013-10-20 15:02 - 2012-09-07 20:58 - 00000000 ___DC C:\Users\Gabriele\AppData\Local\MigWiz 2013-10-20 14:52 - 2013-10-20 14:24 - 00003144 _____ C:\Windows\comsetup.log 2013-10-20 14:44 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration 2013-10-20 08:17 - 2013-10-20 08:17 - 00354960 _____ C:\Windows\system32\FNTCACHE.DAT 2013-10-20 08:17 - 2013-10-20 08:17 - 00090384 _____ C:\Users\Gabriele\AppData\Local\GDIPFONTCACHEV1.DAT 2013-10-19 22:47 - 2013-10-19 22:47 - 00000000 _____ C:\Windows\setuperr.log 2013-10-19 20:30 - 2013-10-16 20:26 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Uxubex 2013-10-19 20:30 - 2013-10-16 09:56 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Piidim 2013-10-19 20:30 - 2013-10-15 12:49 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Racup 2013-10-19 19:25 - 2010-11-26 18:58 - 00000000 ____D C:\ProgramData\Microsoft Help 2013-10-19 19:25 - 2009-07-14 04:34 - 00000478 _____ C:\Windows\win.ini 2013-10-19 18:09 - 2013-10-19 18:09 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Laxew 2013-10-19 18:09 - 2013-10-19 18:09 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Asma 2013-10-19 13:32 - 2013-10-16 20:26 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Nunew 2013-10-19 13:32 - 2013-10-15 12:49 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Gahu 2013-10-19 13:32 - 2013-10-15 10:29 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Imynd 2013-10-19 13:27 - 2013-10-16 15:04 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Axaxt 2013-10-19 13:27 - 2013-10-16 09:56 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Apog 2013-10-19 13:17 - 2010-11-02 10:31 - 00654400 _____ C:\Windows\system32\perfh007.dat 2013-10-19 13:17 - 2010-11-02 10:31 - 00130240 _____ C:\Windows\system32\perfc007.dat 2013-10-19 13:17 - 2009-07-14 07:13 - 01498742 _____ C:\Windows\system32\PerfStringBackup.INI 2013-10-17 22:10 - 2013-10-16 15:04 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Niyfxe 2013-10-17 15:13 - 2010-11-26 19:08 - 00000000 ____D C:\Users\Gabriele\AppData\Local\Adobe 2013-10-17 15:12 - 2013-10-17 15:12 - 00002023 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk 2013-10-17 15:12 - 2012-10-20 20:31 - 00000000 ____D C:\Program Files (x86)\Adobe 2013-10-17 15:12 - 2010-09-23 05:33 - 00000000 ____D C:\ProgramData\Adobe 2013-10-17 15:03 - 2013-09-30 17:33 - 00000000 ____D C:\Users\Gabriele\Pictures\Documents\Kita_Gründung 2013-10-16 20:26 - 2013-10-16 20:26 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Avyv 2013-10-16 15:04 - 2013-10-16 15:04 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Utaxd 2013-10-16 12:29 - 2013-10-15 10:29 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Liel 2013-10-16 09:56 - 2013-10-16 09:56 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Xywue 2013-10-15 19:29 - 2007-07-12 03:49 - 00000000 ____D C:\Windows\Panther 2013-10-15 18:18 - 2013-10-15 18:18 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Yxacdy 2013-10-15 18:18 - 2013-10-15 18:18 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Okysz 2013-10-15 12:49 - 2013-10-15 12:49 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Ufnafo 2013-10-15 10:29 - 2013-10-15 10:29 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Huuk 2013-10-10 10:39 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache 2013-10-09 18:50 - 2011-12-31 19:15 - 00000000 ____D C:\Program Files\Microsoft Silverlight 2013-10-09 18:50 - 2011-12-31 19:15 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight 2013-10-09 13:34 - 2013-07-19 18:04 - 00000000 ____D C:\Windows\system32\MRT 2013-10-09 13:31 - 2010-11-23 13:44 - 80541720 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2013-10-09 10:58 - 2012-04-06 19:36 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2013-10-09 10:58 - 2012-04-06 19:36 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater 2013-10-09 10:58 - 2011-05-15 16:20 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2013-10-09 08:06 - 2013-09-16 21:17 - 00000000 ____D C:\ProgramData\BitGuard 2013-10-08 22:24 - 2013-10-08 22:24 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BitGuard 2013-10-08 11:33 - 2012-10-08 19:03 - 00004110 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2013-10-08 11:33 - 2012-10-08 19:03 - 00003858 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2013-10-04 11:05 - 2013-09-03 12:02 - 00000000 ____D C:\Users\Gabriele\Pictures\Documents\OE 2013-10-01 12:23 - 2012-10-10 15:08 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2013-10-01 10:22 - 2010-11-27 13:13 - 00000000 ____D C:\Users\Gabriele\AppData\Local\Mozilla 2013-10-01 10:21 - 2013-04-16 19:04 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-09-30 17:48 - 2010-11-27 13:43 - 00000000 ____D C:\Users\Gabriele\Pictures\Documents\Fundraising 2013-09-25 13:35 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT 2013-09-23 01:28 - 2013-10-09 13:42 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2013-09-23 01:28 - 2013-10-09 13:42 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2013-09-23 01:27 - 2013-10-09 13:42 - 14335488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2013-09-23 01:27 - 2013-10-09 13:42 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2013-09-23 01:27 - 2013-10-09 13:42 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2013-09-23 01:27 - 2013-10-09 13:42 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2013-09-23 01:27 - 2013-10-09 13:42 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2013-09-23 01:27 - 2013-10-09 13:42 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2013-09-23 01:27 - 2013-10-09 13:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2013-09-23 01:27 - 2013-10-09 13:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll 2013-09-23 01:27 - 2013-10-09 13:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2013-09-23 01:27 - 2013-10-09 13:42 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2013-09-23 01:27 - 2013-10-09 13:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2013-09-23 00:55 - 2013-10-09 13:42 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2013-09-23 00:55 - 2013-10-09 13:42 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2013-09-23 00:55 - 2013-10-09 13:42 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2013-09-23 00:54 - 2013-10-09 13:42 - 19252224 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2013-09-23 00:54 - 2013-10-09 13:42 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2013-09-23 00:54 - 2013-10-09 13:42 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2013-09-23 00:54 - 2013-10-09 13:42 - 02647552 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2013-09-23 00:54 - 2013-10-09 13:42 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2013-09-23 00:54 - 2013-10-09 13:42 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2013-09-23 00:54 - 2013-10-09 13:42 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2013-09-23 00:54 - 2013-10-09 13:42 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2013-09-23 00:54 - 2013-10-09 13:42 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2013-09-23 00:54 - 2013-10-09 13:42 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2013-09-23 00:54 - 2013-10-09 13:42 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2013-09-21 17:43 - 2013-09-21 17:43 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\File Scout 2013-09-21 05:38 - 2013-10-09 13:42 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2013-09-21 05:30 - 2013-10-09 13:42 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2013-09-21 04:48 - 2013-10-09 13:42 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe 2013-09-21 04:39 - 2013-10-09 13:42 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe Some content of TEMP: ==================== C:\Users\Gast\AppData\Local\Temp\AskSLib.dll ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-10-13 22:19 ==================== End Of Log ============================ Könnt ihr mir helfen? Vieleln Dank im Voraus! Viele Grüße Gabi |
21.10.2013, 12:52 | #2 |
/// the machine /// TB-Ausbilder | Windows, Trojaner, Antivirenprogramm gelöscht von extern hi,
__________________So funktioniert es: Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
Scan mit Combofix
__________________ |
25.10.2013, 19:53 | #3 |
| Windows, Trojaner, Antivirenprogramm gelöscht von extern Hallo,
__________________ich war zu doof, Deine prompte Antwort zu finden, daher antworte ich jetzt erst. Hoffentlcih noch nicht zu spät. Ich hatte zwischenzeitlisch alle möglichen Antivirenprogramme durchlaufen lassen: eset, avast, kaspersky, malware. Seit zwei Tagen ist nichts mehr gefunden worde. Die Combofix.txt von eben ist hier. Code:
ATTFilter ComboFix 13-10-24.01 - Gabriele 25.10.2013 20:38:04.1.2 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.4061.2291 [GMT 2:00] ausgeführt von:: c:\users\Gabriele\Pictures\Desktop\ComboFix.exe SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Neuer Wiederherstellungspunkt wurde erstellt . . (((((((((((((((((((((((((((((((((((( Weitere Löschungen )))))))))))))))))))))))))))))))))))))))))))))))) . . c:\program files (x86)\ViiKiiDesktopPlugin\ViiKiiDesktopPlugin.exe c:\programdata\ntuser.dat c:\users\Gabriele\AppData\Roaming\24U c:\users\Gabriele\AppData\Roaming\Neagyg c:\users\Gabriele\AppData\Roaming\Neagyg\ebuzi.axg c:\users\Gabriele\AppData\Roaming\Uvul c:\users\Gabriele\AppData\Roaming\Uvul\imoxo.wix . . ((((((((((((((((((((((( Dateien erstellt von 2013-09-25 bis 2013-10-25 )))))))))))))))))))))))))))))) . . 2013-10-25 18:44 . 2013-10-25 18:44 -------- d-----w- c:\users\Gast\AppData\Local\temp 2013-10-25 18:44 . 2013-10-25 18:44 -------- d-----w- c:\users\Default\AppData\Local\temp 2013-10-24 11:19 . 2013-10-14 07:12 10280728 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{456C539D-1E23-4B4E-ADBF-5D2E8E0C827D}\mpengine.dll 2013-10-23 19:12 . 2013-10-23 19:12 -------- d-----w- c:\program files (x86)\ESET 2013-10-23 19:03 . 2013-10-25 18:32 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware 2013-10-23 12:57 . 2013-10-23 12:57 -------- d-s---w- c:\windows\SysWow64\Microsoft 2013-10-23 11:47 . 2013-10-23 11:47 -------- d-----w- c:\programdata\Oracle 2013-10-23 11:47 . 2013-10-23 11:47 -------- d-----w- c:\program files (x86)\Common Files\Java 2013-10-23 11:47 . 2013-10-23 11:47 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll 2013-10-23 11:42 . 2013-10-23 11:42 108968 ----a-w- c:\windows\system32\WindowsAccessBridge-64.dll 2013-10-23 11:31 . 2013-10-23 14:50 -------- d-----w- c:\users\Gabriele\AppData\Roaming\Ywxou 2013-10-23 11:31 . 2013-10-23 11:32 -------- d-----w- c:\users\Gabriele\AppData\Roaming\Kuoqig 2013-10-23 10:20 . 2013-10-23 10:20 -------- d-----w- c:\users\Gabriele\AppData\Roaming\AVAST Software 2013-10-23 10:19 . 2013-10-23 16:27 334648 ----a-w- c:\windows\system32\aswBoot.exe 2013-10-23 10:18 . 2013-10-23 18:52 -------- d-----w- c:\programdata\AVAST Software 2013-10-23 10:12 . 2013-10-23 14:50 -------- d-----w- c:\users\Gabriele\AppData\Roaming\Ysex 2013-10-23 10:12 . 2013-10-23 10:12 -------- d-----w- c:\users\Gabriele\AppData\Roaming\Sauxw 2013-10-23 10:12 . 2013-10-23 10:12 -------- d-----w- c:\users\Gabriele\AppData\Roaming\Omoz 2013-10-21 15:31 . 2013-10-24 08:54 -------- d-----w- C:\AdwCleaner 2013-10-21 15:31 . 2013-10-21 15:31 -------- d-----w- c:\users\Gabriele\AppData\Roaming\WinPatrol 2013-10-21 15:31 . 2013-10-21 15:31 -------- d-----w- c:\program files (x86)\BillP Studios 2013-10-21 15:31 . 2013-10-21 15:31 -------- d-----w- c:\programdata\InstallMate 2013-10-21 12:55 . 2013-10-23 13:01 -------- d-----w- c:\users\Gabriele\Texte 2013-10-21 08:49 . 2013-10-21 14:00 -------- d-----w- c:\users\Gabriele\AppData\Roaming\Wyac 2013-10-21 08:49 . 2013-10-21 10:32 -------- d-----w- c:\users\Gabriele\AppData\Roaming\Geok 2013-10-21 08:49 . 2013-10-21 08:49 -------- d-----w- c:\users\Gabriele\AppData\Roaming\Ydote 2013-10-21 08:28 . 2013-10-21 08:28 -------- d-----w- C:\FRST 2013-10-21 08:04 . 2013-10-21 14:00 -------- d-----w- c:\users\Gabriele\AppData\Roaming\Izcy 2013-10-21 08:04 . 2013-10-21 08:05 -------- d-----w- c:\users\Gabriele\AppData\Roaming\Wezuza 2013-10-20 15:07 . 2013-10-21 12:56 -------- d-----w- c:\users\Gabriele\AppData\Roaming\Xyege 2013-10-20 15:07 . 2013-10-20 15:07 -------- d-----w- c:\users\Gabriele\AppData\Roaming\Nyof 2013-10-20 15:07 . 2013-10-20 15:07 -------- d-----w- c:\users\Gabriele\AppData\Roaming\Myiliv 2013-10-19 16:09 . 2013-10-22 21:41 -------- d-----w- c:\users\Gabriele\AppData\Roaming\Asma 2013-10-19 16:09 . 2013-10-22 14:14 -------- d-----w- c:\users\Gabriele\AppData\Roaming\Wulyq 2013-10-19 16:09 . 2013-10-19 16:09 -------- d-----w- c:\users\Gabriele\AppData\Roaming\Laxew 2013-10-17 13:12 . 2013-10-17 13:12 -------- d-----w- c:\program files (x86)\Common Files\Adobe 2013-10-16 18:26 . 2013-10-19 18:30 -------- d-----w- c:\users\Gabriele\AppData\Roaming\Uxubex 2013-10-16 18:26 . 2013-10-19 11:32 -------- d-----w- c:\users\Gabriele\AppData\Roaming\Nunew 2013-10-16 18:26 . 2013-10-16 18:26 -------- d-----w- c:\users\Gabriele\AppData\Roaming\Avyv 2013-10-16 13:04 . 2013-10-19 11:27 -------- d-----w- c:\users\Gabriele\AppData\Roaming\Axaxt 2013-10-16 13:04 . 2013-10-17 20:10 -------- d-----w- c:\users\Gabriele\AppData\Roaming\Niyfxe 2013-10-16 13:04 . 2013-10-16 13:04 -------- d-----w- c:\users\Gabriele\AppData\Roaming\Utaxd 2013-10-16 07:56 . 2013-10-19 18:30 -------- d-----w- c:\users\Gabriele\AppData\Roaming\Piidim 2013-10-16 07:56 . 2013-10-19 11:27 -------- d-----w- c:\users\Gabriele\AppData\Roaming\Apog 2013-10-16 07:56 . 2013-10-16 07:56 -------- d-----w- c:\users\Gabriele\AppData\Roaming\Xywue 2013-10-15 16:18 . 2013-10-21 14:00 -------- d-----w- c:\users\Gabriele\AppData\Roaming\Okysz 2013-10-15 16:18 . 2013-10-20 15:01 -------- d-----w- c:\users\Gabriele\AppData\Roaming\Myeh 2013-10-15 16:18 . 2013-10-15 16:18 -------- d-----w- c:\users\Gabriele\AppData\Roaming\Yxacdy 2013-10-15 10:49 . 2013-10-19 18:30 -------- d-----w- c:\users\Gabriele\AppData\Roaming\Racup 2013-10-15 10:49 . 2013-10-19 11:32 -------- d-----w- c:\users\Gabriele\AppData\Roaming\Gahu 2013-10-15 10:49 . 2013-10-15 10:49 -------- d-----w- c:\users\Gabriele\AppData\Roaming\Ufnafo 2013-10-15 08:29 . 2013-10-19 11:32 -------- d-----w- c:\users\Gabriele\AppData\Roaming\Imynd 2013-10-15 08:29 . 2013-10-16 10:29 -------- d-----w- c:\users\Gabriele\AppData\Roaming\Liel 2013-10-15 08:29 . 2013-10-15 08:29 -------- d-----w- c:\users\Gabriele\AppData\Roaming\Huuk 2013-10-09 11:25 . 2013-08-28 01:21 3155968 ----a-w- c:\windows\system32\win32k.sys 2013-10-09 11:24 . 2013-08-28 01:12 461312 ----a-w- c:\windows\system32\scavengeui.dll 2013-10-09 11:24 . 2013-09-04 12:11 99840 ----a-w- c:\windows\system32\drivers\usbccgp.sys 2013-10-09 11:24 . 2013-08-01 12:09 983488 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys 2013-10-09 11:24 . 2013-07-20 10:33 102608 ----a-w- c:\windows\SysWow64\PresentationCFFRasterizerNative_v0300.dll 2013-10-09 11:24 . 2013-07-20 10:33 124112 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll 2013-10-09 11:24 . 2013-09-04 12:12 343040 ----a-w- c:\windows\system32\drivers\usbhub.sys 2013-10-09 11:24 . 2013-09-04 12:11 325120 ----a-w- c:\windows\system32\drivers\usbport.sys 2013-10-09 11:24 . 2013-09-04 12:11 52736 ----a-w- c:\windows\system32\drivers\usbehci.sys 2013-10-09 11:24 . 2013-09-04 12:11 30720 ----a-w- c:\windows\system32\drivers\usbuhci.sys 2013-10-09 11:24 . 2013-09-04 12:11 25600 ----a-w- c:\windows\system32\drivers\usbohci.sys 2013-10-09 11:24 . 2013-09-04 12:11 7808 ----a-w- c:\windows\system32\drivers\usbd.sys 2013-09-26 18:00 . 2013-09-26 18:00 208760 ----a-w- c:\program files (x86)\Mozilla Firefox\plugins\nppdf32.dll 2013-09-26 18:00 . 2013-09-26 18:00 208760 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\nppdf32.dll . . . (((((((((((((((((((((((((((((((((((( Find3M Bericht )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-10-23 11:42 . 2013-02-05 10:33 312744 ----a-w- c:\windows\system32\javaws.exe 2013-10-23 11:42 . 2010-11-30 18:09 189352 ----a-w- c:\windows\system32\javaw.exe 2013-10-23 11:42 . 2010-11-30 18:09 189352 ----a-w- c:\windows\system32\java.exe 2013-10-09 11:31 . 2010-11-23 11:44 80541720 ----a-w- c:\windows\system32\MRT.exe 2013-10-09 08:58 . 2012-04-06 17:36 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2013-10-09 08:58 . 2011-05-15 14:20 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2013-09-03 12:35 . 2010-11-26 16:52 278800 ------w- c:\windows\system32\MpSigStub.exe 2013-08-29 01:48 . 2013-10-09 11:25 44032 ----a-w- c:\windows\apppatch\acwow64.dll 2013-08-05 02:25 . 2013-09-11 16:46 155584 ----a-w- c:\windows\system32\drivers\ataport.sys 2013-08-02 02:14 . 2013-09-11 16:46 215040 ----a-w- c:\windows\system32\winsrv.dll 2013-08-02 02:13 . 2013-09-11 16:46 424448 ----a-w- c:\windows\system32\KernelBase.dll 2013-08-02 02:13 . 2013-09-11 16:46 1161216 ----a-w- c:\windows\system32\kernel32.dll 2013-08-02 02:12 . 2013-09-11 16:46 43520 ----a-w- c:\windows\system32\csrsrv.dll 2013-08-02 02:12 . 2013-09-11 16:46 6144 ---ha-w- c:\windows\system32\api-ms-win-security-base-l1-1-0.dll 2013-08-02 02:12 . 2013-09-11 16:46 4608 ---ha-w- c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll 2013-08-02 02:12 . 2013-09-11 16:46 4096 ---ha-w- c:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll 2013-08-02 02:12 . 2013-09-11 16:46 4096 ---ha-w- c:\windows\system32\api-ms-win-core-synch-l1-1-0.dll 2013-08-02 02:12 . 2013-09-11 16:46 3072 ---ha-w- c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll 2013-08-02 02:12 . 2013-09-11 16:46 3072 ---ha-w- c:\windows\system32\api-ms-win-core-util-l1-1-0.dll 2013-08-02 02:12 . 2013-09-11 16:46 3072 ---ha-w- c:\windows\system32\api-ms-win-core-string-l1-1-0.dll 2013-08-02 02:12 . 2013-09-11 16:46 6656 ----a-w- c:\windows\system32\apisetschema.dll 2013-08-02 02:12 . 2013-09-11 16:46 3584 ---ha-w- c:\windows\system32\api-ms-win-core-misc-l1-1-0.dll 2013-08-02 02:12 . 2013-09-11 16:46 3584 ---ha-w- c:\windows\system32\api-ms-win-core-memory-l1-1-0.dll 2013-08-02 02:12 . 2013-09-11 16:46 4608 ---ha-w- c:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll 2013-08-02 02:12 . 2013-09-11 16:46 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll 2013-08-02 02:12 . 2013-09-11 16:46 3584 ---ha-w- c:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll 2013-08-02 02:12 . 2013-09-11 16:46 3584 ---ha-w- c:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll 2013-08-02 02:12 . 2013-09-11 16:46 3584 ---ha-w- c:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll 2013-08-02 02:12 . 2013-09-11 16:46 3584 ---ha-w- c:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll 2013-08-02 02:12 . 2013-09-11 16:46 3584 ---ha-w- c:\windows\system32\api-ms-win-core-heap-l1-1-0.dll 2013-08-02 02:12 . 2013-09-11 16:46 3072 ---ha-w- c:\windows\system32\api-ms-win-core-profile-l1-1-0.dll 2013-08-02 02:12 . 2013-09-11 16:46 3072 ---ha-w- c:\windows\system32\api-ms-win-core-io-l1-1-0.dll 2013-08-02 02:12 . 2013-09-11 16:46 3072 ---ha-w- c:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll 2013-08-02 02:12 . 2013-09-11 16:46 3072 ---ha-w- c:\windows\system32\api-ms-win-core-handle-l1-1-0.dll 2013-08-02 02:12 . 2013-09-11 16:46 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localization-l1-1-0.dll 2013-08-02 02:12 . 2013-09-11 16:46 5120 ---ha-w- c:\windows\system32\api-ms-win-core-file-l1-1-0.dll 2013-08-02 02:12 . 2013-09-11 16:46 3072 ---ha-w- c:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll 2013-08-02 02:12 . 2013-09-11 16:46 3072 ---ha-w- c:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll 2013-08-02 02:12 . 2013-09-11 16:46 3072 ---ha-w- c:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll 2013-08-02 02:12 . 2013-09-11 16:46 3072 ---ha-w- c:\windows\system32\api-ms-win-core-debug-l1-1-0.dll 2013-08-02 02:12 . 2013-09-11 16:46 3072 ---ha-w- c:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll 2013-08-02 02:12 . 2013-09-11 16:46 3072 ---ha-w- c:\windows\system32\api-ms-win-core-console-l1-1-0.dll 2013-08-02 01:50 . 2013-09-11 16:46 274944 ----a-w- c:\windows\SysWow64\KernelBase.dll 2013-08-02 01:48 . 2013-09-11 16:46 5120 ---ha-w- c:\windows\SysWow64\api-ms-win-core-file-l1-1-0.dll 2013-08-02 01:48 . 2013-09-11 16:46 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll 2013-08-02 01:48 . 2013-09-11 16:46 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll 2013-08-02 01:48 . 2013-09-11 16:46 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll 2013-08-02 01:48 . 2013-09-11 16:46 4608 ---ha-w- c:\windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll 2013-08-02 01:48 . 2013-09-11 16:46 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll 2013-08-02 01:48 . 2013-09-11 16:46 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll 2013-08-02 01:48 . 2013-09-11 16:46 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll 2013-08-02 01:48 . 2013-09-11 16:46 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll 2013-08-02 01:48 . 2013-09-11 16:46 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll 2013-08-02 01:48 . 2013-09-11 16:46 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll 2013-08-02 01:48 . 2013-09-11 16:46 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll 2013-08-02 01:48 . 2013-09-11 16:46 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-string-l1-1-0.dll 2013-08-02 01:48 . 2013-09-11 16:46 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll 2013-08-02 01:48 . 2013-09-11 16:46 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll 2013-08-02 01:48 . 2013-09-11 16:46 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-io-l1-1-0.dll 2013-08-02 01:48 . 2013-09-11 16:46 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll 2013-08-02 01:48 . 2013-09-11 16:46 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll 2013-08-02 01:48 . 2013-09-11 16:46 6656 ----a-w- c:\windows\SysWow64\apisetschema.dll 2013-08-02 01:48 . 2013-09-11 16:46 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll 2013-08-02 01:48 . 2013-09-11 16:46 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll 2013-08-02 01:48 . 2013-09-11 16:46 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll 2013-08-02 01:48 . 2013-09-11 16:46 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll 2013-08-02 01:48 . 2013-09-11 16:46 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll 2013-08-02 01:48 . 2013-09-11 16:46 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-console-l1-1-0.dll 2013-08-02 01:09 . 2013-09-11 16:46 338432 ----a-w- c:\windows\system32\conhost.exe 2013-08-02 00:59 . 2013-09-11 16:46 112640 ----a-w- c:\windows\system32\smss.exe 2013-08-02 00:43 . 2013-09-11 16:46 6144 ---ha-w- c:\windows\SysWow64\api-ms-win-security-base-l1-1-0.dll 2013-08-02 00:43 . 2013-09-11 16:46 4608 ---ha-w- c:\windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll 2013-08-02 00:43 . 2013-09-11 16:46 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll 2013-08-02 00:43 . 2013-09-11 16:46 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-util-l1-1-0.dll . . (((((((((((((((((((((((((((( Autostartpunkte der Registrierung )))))))))))))))))))))))))))))))))))))))) . . *Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "WinPatrol"="c:\program files (x86)\BillP Studios\WinPatrol\winpatrol.exe" [2013-09-24 441408] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-03-04 284696] "LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2009-09-24 825864] "FreePDF Assistant"="c:\program files (x86)\FreePDF_XP\fpassist.exe" [2010-06-17 370176] "LexwareInfoService"="c:\program files (x86)\Common Files\Lexware\Update Manager\LxUpdateManager.exe" [2008-11-03 339240] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-09-05 958576] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336] . c:\users\Gabriele\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files (x86)\Microsoft Office\Office14\ONENOTEM.EXE /tsr [2013-6-25 228552] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoResolveTrack"= 1 (0x1) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows] "LoadAppInit_DLLs"=1 (0x1) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x] R2 Mobile Broadband HL Service;Mobile Broadband HL Service;c:\programdata\MobileBrServ\mbbservice.exe;c:\programdata\MobileBrServ\mbbservice.exe [x] R3 BrSerIb;Brother MFC Serial Interface Driver(WDM);c:\windows\system32\DRIVERS\BrSerIb.sys;c:\windows\SYSNATIVE\DRIVERS\BrSerIb.sys [x] R3 BrUsbSIb;Brother MFC Serial USB Driver(WDM);c:\windows\system32\DRIVERS\BrUsbSIb.sys;c:\windows\SYSNATIVE\DRIVERS\BrUsbSIb.sys [x] R3 DfSdkS;Defragmentation-Service;c:\program files (x86)\Ashampoo\Ashampoo WinOptimizer Free\Dfsdks.exe;c:\program files (x86)\Ashampoo\Ashampoo WinOptimizer Free\Dfsdks.exe [x] R3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [x] R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x] R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys;c:\windows\SYSNATIVE\DRIVERS\Rts516xIR.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x] R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x] S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [x] S2 GREGService;GREGService;c:\program files (x86)\Acer\Registration\GREGsvc.exe;c:\program files (x86)\Acer\Registration\GREGsvc.exe [x] S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x] S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [x] S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C62x64.sys [x] . . --- Andere Dienste/Treiber im Speicher --- . *Deregistered* - NisDrv . Inhalt des "geplante Tasks" Ordners . 2013-10-25 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-06 08:58] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "cAudioFilterAgent"="c:\program files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe" [2009-07-20 503864] "Acer ePower Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2010-02-26 818720] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-11-30 170496] . ------- Zusätzlicher Suchlauf ------- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://www.google.com mLocal Page = c:\windows\SysWOW64\blank.htm IE: An OneNote s&enden - c:\progra~2\MICROS~3\Office14\ONBttnIE.dll/105 IE: Free YouTube Download - c:\users\Gabriele\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm IE: Free YouTube to MP3 Converter - c:\program files (x86)\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~3\Office14\EXCEL.EXE/3000 TCP: DhcpNameServer = 192.168.2.1 FF - ProfilePath - c:\users\Gabriele\AppData\Roaming\Mozilla\Firefox\Profiles\8pdx3bji.default\ . - - - - Entfernte verwaiste Registrierungseinträge - - - - . Toolbar-Locked - (no file) Wow6432Node-HKLM-Run-<NO NAME> - (no file) Wow6432Node-HKLM-Run-NvCplDaemon - c:\windows\system32\NvCpl.dll c:\users\Gabriele\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ViiKiiDesktopPlugin.lnk - c:\program files (x86)\ViiKiiDesktopPlugin\ViiKiiDesktopPlugin.exe HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start Toolbar-Locked - (no file) ShellIconOverlayIdentifiers-{472083B0-C522-11CF-8763-00608CC02F24} - (no file) HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe . . . --------------------- Gesperrte Registrierungsschluessel --------------------- . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_117_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_117_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_117_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_117_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_117.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_117.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_117.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_117.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}] @Denied: (A) (Everyone) "Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}" . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3] @Denied: (A) (Everyone) . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0] "Key"="ActionsPane3" "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Zeit der Fertigstellung: 2013-10-25 20:47:31 ComboFix-quarantined-files.txt 2013-10-25 18:47 . Vor Suchlauf: 9 Verzeichnis(se), 419.809.959.936 Bytes frei Nach Suchlauf: 16 Verzeichnis(se), 419.881.947.136 Bytes frei . - - End Of File - - 8A71BB86DCB2FF318377A64A254D5E26 Beste Grüße Gabi |
26.10.2013, 12:50 | #4 |
/// the machine /// TB-Ausbilder | Windows, Trojaner, Antivirenprogramm gelöscht von extern Downloade Dir bitte Malwarebytes Anti-Malware
Downloade Dir bitte AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
26.10.2013, 16:14 | #5 |
| Windows, Trojaner, Antivirenprogramm gelöscht von extern Hallo, hier Malware Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.10.26.05 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16721 Gabriele :: NB-GABRIELE [Administrator] Schutz: Deaktiviert 26.10.2013 16:48:48 mbam-log-2013-10-26 (16-48-48).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 239029 Laufzeit: 3 Minute(n), 17 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Code:
ATTFilter # AdwCleaner v3.010 - Bericht erstellt am 26/10/2013 um 16:55:14 # Updated 20/10/2013 von Xplode # Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits) # Benutzername : Gabriele - NB-GABRIELE # Gestartet von : C:\Users\Gabriele\Pictures\Desktop\adwcleaner.exe # Option : Löschen ***** [ Dienste ] ***** ***** [ Dateien / Ordner ] ***** ***** [ Verknüpfungen ] ***** ***** [ Registrierungsdatenbank ] ***** Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} ***** [ Browser ] ***** -\\ Internet Explorer v10.0.9200.16720 -\\ Mozilla Firefox v24.0 (de) [ Datei : C:\Users\Gabriele\AppData\Roaming\Mozilla\Firefox\Profiles\8pdx3bji.default\prefs.js ] ************************* AdwCleaner[R0].txt - [18886 octets] - [21/10/2013 17:31:54] AdwCleaner[R1].txt - [1169 octets] - [23/10/2013 14:12:12] AdwCleaner[R2].txt - [1290 octets] - [23/10/2013 14:17:41] AdwCleaner[R3].txt - [1307 octets] - [23/10/2013 14:41:07] AdwCleaner[R4].txt - [1302 octets] - [23/10/2013 23:32:12] AdwCleaner[R5].txt - [1413 octets] - [24/10/2013 10:51:53] AdwCleaner[R6].txt - [1661 octets] - [26/10/2013 16:54:39] AdwCleaner[S0].txt - [17591 octets] - [21/10/2013 17:33:54] AdwCleaner[S1].txt - [1231 octets] - [23/10/2013 14:13:32] AdwCleaner[S2].txt - [1351 octets] - [23/10/2013 14:18:54] AdwCleaner[S3].txt - [1369 octets] - [23/10/2013 14:41:57] AdwCleaner[S4].txt - [1364 octets] - [23/10/2013 23:34:51] AdwCleaner[S5].txt - [1373 octets] - [24/10/2013 10:54:30] AdwCleaner[S6].txt - [1582 octets] - [26/10/2013 16:55:14] ########## EOF - C:\AdwCleaner\AdwCleaner[S6].txt - [1642 octets] ########## Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 6.0.7 (10.15.2013:3) OS: Windows 7 Home Premium x64 Ran by Gabriele on 26.10.2013 at 17:00:15,28 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-158788197-4202353459-92027626-1001\Software\SweetIM Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\installer\upgradecodes\f928123a039649549966d4c29d35b1c9 Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{A1637760-D76D-48AF-8BFC-0F2F043E73A4} Successfully deleted: [Registry Key] "hkey_current_user\software\microsoft\internet explorer\low rights\elevationpolicy\{a5aa24ea-11b8-4113-95ae-9ed71deaf12a}" ~~~ Files ~~~ Folders Successfully deleted: [Folder] "C:\Program Files (x86)\dll-files.com fixer" ~~~ FireFox Emptied folder: C:\Users\Gabriele\AppData\Roaming\mozilla\firefox\profiles\8pdx3bji.default\minidumps [66 files] ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 26.10.2013 at 17:07:08,68 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-10-2013 01 Ran by Gabriele (administrator) on NB-GABRIELE on 26-10-2013 17:07:55 Running from C:\Users\Gabriele\Pictures\Desktop Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 10 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe (Microsoft Corporation) C:\Windows\system32\WLANExt.exe (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe (Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe (InterVideo) C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe () C:\ProgramData\MobileBrServ\mbbservice.exe (NTI, Inc.) C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe (Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe (Sun Microsystems, Inc.) C:\Program Files\Java\jre6\bin\jusched.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe (BillP Studios) C:\Program Files (x86)\BillP Studios\WinPatrol\WinPatrol.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.EXE (shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe (Lexware GmbH & Co. KG) C:\Program Files (x86)\Common Files\Lexware\Update Manager\LxUpdateManager.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe (Opera Software) C:\Program Files (x86)\Opera\opera.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Microsoft Corporation) c:\Program Files\Microsoft Security Client\MpCmdRun.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [cAudioFilterAgent] - C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [503864 2009-07-20] (Conexant Systems, Inc.) HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1842472 2009-09-17] (Synaptics Incorporated) HKLM\...\Run: [Acer ePower Management] - C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [818720 2010-02-26] (Acer Incorporated) HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Java\jre6\bin\jusched.exe [170496 2010-11-30] (Sun Microsystems, Inc.) HKLM\...\Run: [MSC] - c:\Program Files\Microsoft Security Client\msseces.exe [1356240 2013-08-12] (Microsoft Corporation) HKCU\...\Run: [WinPatrol] - C:\Program Files (x86)\BillP Studios\WinPatrol\winpatrol.exe [441408 2013-09-24] (BillP Studios) HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-03-04] (Intel Corporation) HKLM-x32\...\Run: [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe [825864 2009-09-24] (Dritek System Inc.) HKLM-x32\...\Run: [FreePDF Assistant] - C:\Program Files (x86)\FreePDF_XP\fpassist.exe [370176 2010-06-17] (shbox.de) HKLM-x32\...\Run: [LexwareInfoService] - C:\Program Files (x86)\Common Files\Lexware\Update Manager\LxUpdateManager.exe [339240 2008-11-03] (Lexware GmbH & Co. KG) HKLM-x32\...\Run: [] - [x] HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.) HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.) HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-09-05] (Adobe Systems Incorporated) HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default HKU\Default User\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default Startup: C:\Users\Gabriele\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation) Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\Gabriele\AppData\Roaming\Mozilla\Firefox\Profiles\8pdx3bji.default FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll () FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @microsoft.com/GENUINE - disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1167637.dll (Adobe Systems, Inc.) FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE - disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: dp Launcher Plugin - C:\Users\Gabriele\AppData\Roaming\Mozilla\Firefox\Profiles\8pdx3bji.default\Extensions\dplauncher@digitalpublishing.de FF Extension: Adblock Plus - C:\Users\Gabriele\AppData\Roaming\Mozilla\Firefox\Profiles\8pdx3bji.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} FF Extension: Adblock Plus - C:\Users\Gabriele\AppData\Roaming\Mozilla\Firefox\Profiles\8pdx3bji.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0034-ABCDEFFEDCBA} FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0039-ABCDEFFEDCBA} ==================== Services (Whitelisted) ================= S3 DfSdkS; C:\Program Files (x86)\Ashampoo\Ashampoo WinOptimizer Free\Dfsdks.exe [544768 2009-08-24] (mst software GmbH, Germany) R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation) R2 Mobile Broadband HL Service; C:\ProgramData\MobileBrServ\mbbservice.exe [232288 2012-03-12] () R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2013-08-12] (Microsoft Corporation) S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366600 2013-08-12] (Microsoft Corporation) R2 NTISchedulerSvc; C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [144640 2010-04-17] (NTI, Inc.) ==================== Drivers (Whitelisted) ==================== R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [247216 2013-06-18] (Microsoft Corporation) S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [139616 2013-06-18] (Microsoft Corporation) U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) S3 catchme; \??\C:\ComboFix\catchme.sys [x] S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [x] S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-10-26 17:07 - 2013-10-26 17:07 - 00001465 _____ C:\Users\Gabriele\Desktop\JRT.txt 2013-10-26 17:00 - 2013-10-26 17:00 - 00000000 ____D C:\Windows\ERUNT 2013-10-26 16:46 - 2013-10-26 16:46 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2013-10-26 16:46 - 2013-10-26 16:46 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-10-26 16:46 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2013-10-26 13:22 - 2013-10-26 13:22 - 00000000 ____D C:\Program Files\Microsoft Security Client 2013-10-26 13:22 - 2013-10-26 13:22 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client 2013-10-25 20:47 - 2013-10-25 20:47 - 00027590 _____ C:\ComboFix.txt 2013-10-25 20:34 - 2013-10-25 20:47 - 00000000 ____D C:\Qoobox 2013-10-25 20:34 - 2013-10-25 20:45 - 00000000 ____D C:\Windows\erdnt 2013-10-25 20:34 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe 2013-10-25 20:34 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe 2013-10-25 20:34 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2013-10-25 20:34 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2013-10-25 20:34 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2013-10-25 20:34 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe 2013-10-25 20:34 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe 2013-10-25 20:34 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe 2013-10-24 18:06 - 2013-10-24 18:06 - 00000000 ___SD C:\Users\Gabriele\Pictures\Documents\Passwords Database 2013-10-24 13:47 - 2013-10-24 18:06 - 00004544 _____ C:\Users\Gabriele\Pictures\Documents\spLog.log 2013-10-24 11:00 - 2013-10-24 11:00 - 00001147 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk 2013-10-24 10:59 - 2013-10-24 10:59 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2013-10-23 18:19 - 2013-10-26 13:15 - 00616358 _____ C:\Windows\PFRO.log 2013-10-23 14:44 - 2013-10-23 14:44 - 00090384 _____ C:\Users\Gabriele\AppData\Local\GDIPFONTCACHEV1.DAT 2013-10-23 14:43 - 2013-10-26 16:56 - 00001176 _____ C:\Windows\setupact.log 2013-10-23 14:43 - 2013-10-23 14:43 - 00000000 _____ C:\Windows\setuperr.log 2013-10-23 14:42 - 2013-10-23 14:43 - 00354960 _____ C:\Windows\system32\FNTCACHE.DAT 2013-10-23 13:47 - 2013-10-23 13:47 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2013-10-23 13:47 - 2013-10-23 13:47 - 00000000 ____D C:\ProgramData\Oracle 2013-10-23 13:47 - 2013-10-23 13:46 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2013-10-23 13:47 - 2013-10-23 13:46 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2013-10-23 13:47 - 2013-10-23 13:46 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2013-10-23 13:42 - 2013-10-23 13:42 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll 2013-10-23 13:31 - 2013-10-23 16:50 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Ywxou 2013-10-23 13:31 - 2013-10-23 13:32 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Kuoqig 2013-10-23 12:20 - 2013-10-23 12:20 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\AVAST Software 2013-10-23 12:19 - 2013-10-23 18:27 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe 2013-10-23 12:18 - 2013-10-23 20:52 - 00000000 ____D C:\ProgramData\AVAST Software 2013-10-23 12:12 - 2013-10-23 16:50 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Ysex 2013-10-23 12:12 - 2013-10-23 12:12 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Sauxw 2013-10-23 12:12 - 2013-10-23 12:12 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Omoz 2013-10-21 17:31 - 2013-10-26 16:55 - 00000000 ____D C:\AdwCleaner 2013-10-21 17:31 - 2013-10-21 17:31 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\WinPatrol 2013-10-21 17:31 - 2013-10-21 17:31 - 00000000 ____D C:\ProgramData\InstallMate 2013-10-21 17:31 - 2013-10-21 17:31 - 00000000 ____D C:\Program Files (x86)\BillP Studios 2013-10-21 14:55 - 2013-10-23 15:01 - 00000000 ____D C:\Users\Gabriele\Texte 2013-10-21 10:49 - 2013-10-21 16:00 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Wyac 2013-10-21 10:49 - 2013-10-21 12:32 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Geok 2013-10-21 10:49 - 2013-10-21 10:49 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Ydote 2013-10-21 10:44 - 2013-10-23 10:23 - 00000000 ____D C:\Windows\Minidump 2013-10-21 10:28 - 2013-10-21 10:28 - 00000000 ____D C:\FRST 2013-10-21 10:04 - 2013-10-21 16:00 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Izcy 2013-10-21 10:04 - 2013-10-21 10:05 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Wezuza 2013-10-20 17:07 - 2013-10-21 14:56 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Xyege 2013-10-20 17:07 - 2013-10-20 17:07 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Nyof 2013-10-20 17:07 - 2013-10-20 17:07 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Myiliv 2013-10-19 18:09 - 2013-10-22 23:41 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Asma 2013-10-19 18:09 - 2013-10-22 16:14 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Wulyq 2013-10-19 18:09 - 2013-10-19 18:09 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Laxew 2013-10-17 15:12 - 2013-10-17 15:12 - 00002023 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk 2013-10-16 20:26 - 2013-10-19 20:30 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Uxubex 2013-10-16 20:26 - 2013-10-19 13:32 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Nunew 2013-10-16 20:26 - 2013-10-16 20:26 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Avyv 2013-10-16 15:04 - 2013-10-19 13:27 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Axaxt 2013-10-16 15:04 - 2013-10-17 22:10 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Niyfxe 2013-10-16 15:04 - 2013-10-16 15:04 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Utaxd 2013-10-16 09:56 - 2013-10-19 20:30 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Piidim 2013-10-16 09:56 - 2013-10-19 13:27 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Apog 2013-10-16 09:56 - 2013-10-16 09:56 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Xywue 2013-10-15 18:18 - 2013-10-21 16:00 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Okysz 2013-10-15 18:18 - 2013-10-20 17:01 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Myeh 2013-10-15 18:18 - 2013-10-15 18:18 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Yxacdy 2013-10-15 12:49 - 2013-10-19 20:30 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Racup 2013-10-15 12:49 - 2013-10-19 13:32 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Gahu 2013-10-15 12:49 - 2013-10-15 12:49 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Ufnafo 2013-10-15 10:29 - 2013-10-19 13:32 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Imynd 2013-10-15 10:29 - 2013-10-16 12:29 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Liel 2013-10-15 10:29 - 2013-10-15 10:29 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Huuk 2013-10-09 13:42 - 2013-09-23 01:28 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2013-10-09 13:42 - 2013-09-23 01:28 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2013-10-09 13:42 - 2013-09-23 01:27 - 14335488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2013-10-09 13:42 - 2013-09-23 01:27 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2013-10-09 13:42 - 2013-09-23 01:27 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2013-10-09 13:42 - 2013-09-23 01:27 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2013-10-09 13:42 - 2013-09-23 01:27 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2013-10-09 13:42 - 2013-09-23 01:27 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2013-10-09 13:42 - 2013-09-23 01:27 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2013-10-09 13:42 - 2013-09-23 01:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll 2013-10-09 13:42 - 2013-09-23 01:27 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2013-10-09 13:42 - 2013-09-23 01:27 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2013-10-09 13:42 - 2013-09-23 01:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2013-10-09 13:42 - 2013-09-23 00:55 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2013-10-09 13:42 - 2013-09-23 00:55 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2013-10-09 13:42 - 2013-09-23 00:55 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2013-10-09 13:42 - 2013-09-23 00:54 - 19252224 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2013-10-09 13:42 - 2013-09-23 00:54 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2013-10-09 13:42 - 2013-09-23 00:54 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2013-10-09 13:42 - 2013-09-23 00:54 - 02647552 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2013-10-09 13:42 - 2013-09-23 00:54 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2013-10-09 13:42 - 2013-09-23 00:54 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2013-10-09 13:42 - 2013-09-23 00:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2013-10-09 13:42 - 2013-09-23 00:54 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2013-10-09 13:42 - 2013-09-23 00:54 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2013-10-09 13:42 - 2013-09-23 00:54 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2013-10-09 13:42 - 2013-09-23 00:54 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2013-10-09 13:42 - 2013-09-21 05:38 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2013-10-09 13:42 - 2013-09-21 05:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2013-10-09 13:42 - 2013-09-21 04:48 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe 2013-10-09 13:42 - 2013-09-21 04:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe 2013-10-09 13:25 - 2013-09-14 03:10 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys 2013-10-09 13:25 - 2013-09-08 04:30 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys 2013-10-09 13:25 - 2013-09-08 04:27 - 00327168 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll 2013-10-09 13:25 - 2013-09-08 04:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswsock.dll 2013-10-09 13:25 - 2013-08-29 04:17 - 05549504 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2013-10-09 13:25 - 2013-08-29 04:16 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll 2013-10-09 13:25 - 2013-08-29 04:16 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll 2013-10-09 13:25 - 2013-08-29 04:16 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll 2013-10-09 13:25 - 2013-08-29 04:13 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll 2013-10-09 13:25 - 2013-08-29 03:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2013-10-09 13:25 - 2013-08-29 03:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2013-10-09 13:25 - 2013-08-29 03:50 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll 2013-10-09 13:25 - 2013-08-29 03:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll 2013-10-09 13:25 - 2013-08-29 03:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll 2013-10-09 13:25 - 2013-08-29 03:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll 2013-10-09 13:25 - 2013-08-29 02:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe 2013-10-09 13:25 - 2013-08-29 02:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll 2013-10-09 13:25 - 2013-08-29 02:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe 2013-10-09 13:25 - 2013-08-29 02:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe 2013-10-09 13:25 - 2013-08-28 03:21 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2013-10-09 13:25 - 2013-07-12 12:41 - 00185344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys 2013-10-09 13:25 - 2013-07-12 12:41 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys 2013-10-09 13:25 - 2013-07-04 14:57 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll 2013-10-09 13:25 - 2013-07-04 14:50 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll 2013-10-09 13:25 - 2013-07-04 14:50 - 00102400 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll 2013-10-09 13:25 - 2013-07-04 13:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll 2013-10-09 13:25 - 2013-07-04 13:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll 2013-10-09 13:25 - 2013-07-04 13:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll 2013-10-09 13:25 - 2013-07-04 12:11 - 00140800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys 2013-10-09 13:25 - 2013-07-03 06:40 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys 2013-10-09 13:25 - 2013-07-03 06:05 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys 2013-10-09 13:25 - 2013-07-03 06:05 - 00032896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys 2013-10-09 13:25 - 2013-06-26 00:55 - 00785624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys 2013-10-09 13:25 - 2013-06-06 07:50 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll 2013-10-09 13:25 - 2013-06-06 07:49 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll 2013-10-09 13:25 - 2013-06-06 07:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll 2013-10-09 13:25 - 2013-06-06 07:47 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll 2013-10-09 13:25 - 2013-06-06 06:57 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll 2013-10-09 13:25 - 2013-06-06 06:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll 2013-10-09 13:25 - 2013-06-06 06:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll 2013-10-09 13:25 - 2013-06-06 05:30 - 00368128 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll 2013-10-09 13:25 - 2013-06-06 05:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll 2013-10-09 13:25 - 2013-06-06 05:01 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll 2013-10-09 13:24 - 2013-09-04 14:12 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys 2013-10-09 13:24 - 2013-09-04 14:11 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys 2013-10-09 13:24 - 2013-09-04 14:11 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys 2013-10-09 13:24 - 2013-09-04 14:11 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys 2013-10-09 13:24 - 2013-09-04 14:11 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys 2013-10-09 13:24 - 2013-09-04 14:11 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys 2013-10-09 13:24 - 2013-09-04 14:11 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys 2013-10-09 13:24 - 2013-08-28 03:12 - 00461312 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll 2013-10-09 13:24 - 2013-08-01 14:09 - 00983488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys 2013-10-09 13:24 - 2013-07-20 12:33 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll 2013-10-09 13:24 - 2013-07-20 12:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll 2013-09-30 17:33 - 2013-10-23 22:06 - 00000000 ____D C:\Users\Gabriele\Pictures\Documents\Kita_Gründung ==================== One Month Modified Files and Folders ======= 2013-10-26 17:07 - 2013-10-26 17:07 - 00001465 _____ C:\Users\Gabriele\Desktop\JRT.txt 2013-10-26 17:03 - 2009-07-14 06:45 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-10-26 17:03 - 2009-07-14 06:45 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-10-26 17:00 - 2013-10-26 17:00 - 00000000 ____D C:\Windows\ERUNT 2013-10-26 16:59 - 2010-11-02 01:40 - 01120802 _____ C:\Windows\WindowsUpdate.log 2013-10-26 16:58 - 2012-04-06 19:36 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-10-26 16:56 - 2013-10-23 14:43 - 00001176 _____ C:\Windows\setupact.log 2013-10-26 16:56 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2013-10-26 16:55 - 2013-10-21 17:31 - 00000000 ____D C:\AdwCleaner 2013-10-26 16:46 - 2013-10-26 16:46 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2013-10-26 16:46 - 2013-10-26 16:46 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-10-26 13:22 - 2013-10-26 13:22 - 00000000 ____D C:\Program Files\Microsoft Security Client 2013-10-26 13:22 - 2013-10-26 13:22 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client 2013-10-26 13:22 - 2011-12-06 22:08 - 00001912 _____ C:\Windows\epplauncher.mif 2013-10-26 13:15 - 2013-10-23 18:19 - 00616358 _____ C:\Windows\PFRO.log 2013-10-25 20:54 - 2011-12-06 22:08 - 01527912 _____ C:\Windows\SysWOW64\PerfStringBackup.INI 2013-10-25 20:54 - 2010-11-02 10:31 - 00657948 _____ C:\Windows\system32\perfh007.dat 2013-10-25 20:54 - 2010-11-02 10:31 - 00131288 _____ C:\Windows\system32\perfc007.dat 2013-10-25 20:47 - 2013-10-25 20:47 - 00027590 _____ C:\ComboFix.txt 2013-10-25 20:47 - 2013-10-25 20:34 - 00000000 ____D C:\Qoobox 2013-10-25 20:47 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default 2013-10-25 20:45 - 2013-10-25 20:34 - 00000000 ____D C:\Windows\erdnt 2013-10-25 20:45 - 2010-11-26 18:38 - 00000000 ___RD C:\Users\Gabriele\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2013-10-25 20:44 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini 2013-10-25 20:43 - 2013-02-27 22:45 - 00000000 ____D C:\Program Files (x86)\ViiKiiDesktopPlugin 2013-10-25 09:33 - 2009-07-14 07:13 - 01498742 _____ C:\Windows\system32\PerfStringBackup.INI 2013-10-24 18:06 - 2013-10-24 18:06 - 00000000 ___SD C:\Users\Gabriele\Pictures\Documents\Passwords Database 2013-10-24 18:06 - 2013-10-24 13:47 - 00004544 _____ C:\Users\Gabriele\Pictures\Documents\spLog.log 2013-10-24 13:26 - 2010-11-27 16:30 - 00000000 ____D C:\Users\Gabriele\AppData\Local\FreePDF_XP 2013-10-24 11:00 - 2013-10-24 11:00 - 00001147 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk 2013-10-24 11:00 - 2013-04-16 19:04 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-10-24 10:59 - 2013-10-24 10:59 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2013-10-23 22:07 - 2010-11-26 18:38 - 00000000 ____D C:\Users\Gabriele 2013-10-23 22:06 - 2013-09-30 17:33 - 00000000 ____D C:\Users\Gabriele\Pictures\Documents\Kita_Gründung 2013-10-23 20:52 - 2013-10-23 12:18 - 00000000 ____D C:\ProgramData\AVAST Software 2013-10-23 19:56 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache 2013-10-23 18:28 - 2012-10-08 19:03 - 00000000 ____D C:\Program Files (x86)\Google 2013-10-23 18:27 - 2013-10-23 12:19 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe 2013-10-23 16:50 - 2013-10-23 13:31 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Ywxou 2013-10-23 16:50 - 2013-10-23 12:12 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Ysex 2013-10-23 15:01 - 2013-10-21 14:55 - 00000000 ____D C:\Users\Gabriele\Texte 2013-10-23 14:47 - 2012-10-08 19:03 - 00000000 ____D C:\Users\Gabriele\AppData\Local\Google 2013-10-23 14:44 - 2013-10-23 14:44 - 00090384 _____ C:\Users\Gabriele\AppData\Local\GDIPFONTCACHEV1.DAT 2013-10-23 14:43 - 2013-10-23 14:43 - 00000000 _____ C:\Windows\setuperr.log 2013-10-23 14:43 - 2013-10-23 14:42 - 00354960 _____ C:\Windows\system32\FNTCACHE.DAT 2013-10-23 13:47 - 2013-10-23 13:47 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2013-10-23 13:47 - 2013-10-23 13:47 - 00000000 ____D C:\ProgramData\Oracle 2013-10-23 13:46 - 2013-10-23 13:47 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2013-10-23 13:46 - 2013-10-23 13:47 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2013-10-23 13:46 - 2013-10-23 13:47 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2013-10-23 13:46 - 2010-11-26 19:22 - 00000000 ____D C:\Program Files (x86)\Java 2013-10-23 13:42 - 2013-10-23 13:42 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll 2013-10-23 13:42 - 2013-02-05 12:33 - 00312744 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe 2013-10-23 13:42 - 2010-11-30 20:09 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe 2013-10-23 13:42 - 2010-11-30 20:09 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe 2013-10-23 13:42 - 2010-11-30 20:09 - 00000000 ____D C:\Program Files\Java 2013-10-23 13:32 - 2013-10-23 13:31 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Kuoqig 2013-10-23 12:20 - 2013-10-23 12:20 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\AVAST Software 2013-10-23 12:12 - 2013-10-23 12:12 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Sauxw 2013-10-23 12:12 - 2013-10-23 12:12 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Omoz 2013-10-23 10:23 - 2013-10-21 10:44 - 00000000 ____D C:\Windows\Minidump 2013-10-23 10:23 - 2012-09-07 20:58 - 00000000 ___DC C:\Users\Gabriele\AppData\Local\MigWiz 2013-10-22 23:41 - 2013-10-19 18:09 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Asma 2013-10-22 16:14 - 2013-10-19 18:09 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Wulyq 2013-10-21 17:31 - 2013-10-21 17:31 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\WinPatrol 2013-10-21 17:31 - 2013-10-21 17:31 - 00000000 ____D C:\ProgramData\InstallMate 2013-10-21 17:31 - 2013-10-21 17:31 - 00000000 ____D C:\Program Files (x86)\BillP Studios 2013-10-21 16:00 - 2013-10-21 10:49 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Wyac 2013-10-21 16:00 - 2013-10-21 10:04 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Izcy 2013-10-21 16:00 - 2013-10-15 18:18 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Okysz 2013-10-21 14:56 - 2013-10-20 17:07 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Xyege 2013-10-21 12:49 - 2012-01-28 19:26 - 00000000 ____D C:\Program Files\WinRAR 2013-10-21 12:32 - 2013-10-21 10:49 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Geok 2013-10-21 10:49 - 2013-10-21 10:49 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Ydote 2013-10-21 10:28 - 2013-10-21 10:28 - 00000000 ____D C:\FRST 2013-10-21 10:05 - 2013-10-21 10:04 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Wezuza 2013-10-20 19:53 - 2010-12-08 17:00 - 00000043 _____ C:\Windows\gswin32.ini 2013-10-20 17:07 - 2013-10-20 17:07 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Nyof 2013-10-20 17:07 - 2013-10-20 17:07 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Myiliv 2013-10-20 17:01 - 2013-10-15 18:18 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Myeh 2013-10-20 14:44 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration 2013-10-19 20:30 - 2013-10-16 20:26 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Uxubex 2013-10-19 20:30 - 2013-10-16 09:56 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Piidim 2013-10-19 20:30 - 2013-10-15 12:49 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Racup 2013-10-19 19:25 - 2010-11-26 18:58 - 00000000 ____D C:\ProgramData\Microsoft Help 2013-10-19 19:25 - 2009-07-14 04:34 - 00000478 _____ C:\Windows\win.ini 2013-10-19 18:09 - 2013-10-19 18:09 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Laxew 2013-10-19 13:32 - 2013-10-16 20:26 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Nunew 2013-10-19 13:32 - 2013-10-15 12:49 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Gahu 2013-10-19 13:32 - 2013-10-15 10:29 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Imynd 2013-10-19 13:27 - 2013-10-16 15:04 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Axaxt 2013-10-19 13:27 - 2013-10-16 09:56 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Apog 2013-10-17 22:10 - 2013-10-16 15:04 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Niyfxe 2013-10-17 15:13 - 2010-11-26 19:08 - 00000000 ____D C:\Users\Gabriele\AppData\Local\Adobe 2013-10-17 15:12 - 2013-10-17 15:12 - 00002023 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk 2013-10-17 15:12 - 2012-10-20 20:31 - 00000000 ____D C:\Program Files (x86)\Adobe 2013-10-17 15:12 - 2010-09-23 05:33 - 00000000 ____D C:\ProgramData\Adobe 2013-10-16 20:26 - 2013-10-16 20:26 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Avyv 2013-10-16 15:04 - 2013-10-16 15:04 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Utaxd 2013-10-16 12:29 - 2013-10-15 10:29 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Liel 2013-10-16 09:56 - 2013-10-16 09:56 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Xywue 2013-10-15 19:29 - 2007-07-12 03:49 - 00000000 ____D C:\Windows\Panther 2013-10-15 18:18 - 2013-10-15 18:18 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Yxacdy 2013-10-15 12:49 - 2013-10-15 12:49 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Ufnafo 2013-10-15 10:29 - 2013-10-15 10:29 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Huuk 2013-10-09 18:50 - 2011-12-31 19:15 - 00000000 ____D C:\Program Files\Microsoft Silverlight 2013-10-09 18:50 - 2011-12-31 19:15 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight 2013-10-09 13:34 - 2013-07-19 18:04 - 00000000 ____D C:\Windows\system32\MRT 2013-10-09 13:31 - 2010-11-23 13:44 - 80541720 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2013-10-09 10:58 - 2012-04-06 19:36 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2013-10-09 10:58 - 2012-04-06 19:36 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater 2013-10-09 10:58 - 2011-05-15 16:20 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2013-10-04 11:05 - 2013-09-03 12:02 - 00000000 ____D C:\Users\Gabriele\Pictures\Documents\OE 2013-10-01 10:22 - 2010-11-27 13:13 - 00000000 ____D C:\Users\Gabriele\AppData\Local\Mozilla 2013-09-30 17:48 - 2010-11-27 13:43 - 00000000 ____D C:\Users\Gabriele\Pictures\Documents\Fundraising Some content of TEMP: ==================== C:\Users\Gabriele\AppData\Local\Temp\Quarantine.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-10-21 11:14 ==================== End Of Log ============================ Danke für Kümmern!!! Beste Grüße Gabi |
27.10.2013, 07:17 | #6 |
/// the machine /// TB-Ausbilder | Windows, Trojaner, Antivirenprogramm gelöscht von externESET Online Scanner
Downloade Dir bitte SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ --> Windows, Trojaner, Antivirenprogramm gelöscht von extern |
27.10.2013, 13:47 | #7 |
| Windows, Trojaner, Antivirenprogramm gelöscht von extern Hallo, hier die Ergebnisse. Eset Code:
ATTFilter ESETSmartInstaller@High as downloader log: Can not open internetESETSmartInstaller@High as downloader log: Can not open internetesets_scanner_update returned -1 esets_gle=12 # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6920 # api_version=3.0.2 # EOSSerial=d624ac2402d927449e5d6563227b800e # engine=15649 # end=stopped # remove_checked=false # archives_checked=true # unwanted_checked=false # unsafe_checked=false # antistealth_checked=true # utc_time=2013-10-27 08:26:59 # local_time=2013-10-27 09:26:59 (+0100, Mitteleuropäische Zeit) # country="Germany" # lang=1031 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=5893 16776574 100 94 75981 134492269 0 0 # scanned=81 # found=0 # cleaned=0 # scan_time=4 # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6920 # api_version=3.0.2 # EOSSerial=d624ac2402d927449e5d6563227b800e # engine=15649 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=false # unsafe_checked=false # antistealth_checked=true # utc_time=2013-10-27 12:31:22 # local_time=2013-10-27 01:31:22 (+0100, Mitteleuropäische Zeit) # country="Germany" # lang=1031 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=5893 16776574 100 94 90644 134506932 0 0 # scanned=187965 # found=0 # cleaned=0 # scan_time=14304 Code:
ATTFilter Results of screen317's Security Check version 0.99.74 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 10 ``````````````Antivirus/Firewall Check:`````````````` Microsoft Security Essentials (On Access scanning disabled!) Error obtaining update status for antivirus! `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware Version 1.75.0.1300 Java(TM) 6 Update 39 Java 7 Update 45 Java version out of Date! Adobe Flash Player 11.9.900.117 Adobe Reader XI Mozilla Firefox (24.0) ````````Process Check: objlist.exe by Laurent```````` Microsoft Security Essentials MSMpEng.exe Microsoft Security Essentials msseces.exe WinPatrol winpatrol.exe Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbamgui.exe Malwarebytes' Anti-Malware mbamscheduler.exe BillP Studios WinPatrol WinPatrol.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-10-2013 01 Ran by Gabriele (administrator) on NB-GABRIELE on 27-10-2013 13:41:47 Running from C:\Users\Gabriele\Pictures\Desktop Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 10 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe (Microsoft Corporation) C:\Windows\system32\WLANExt.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe (Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe (InterVideo) C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe () C:\ProgramData\MobileBrServ\mbbservice.exe (NTI, Inc.) C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe (Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe (Sun Microsystems, Inc.) C:\Program Files\Java\jre6\bin\jusched.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe (BillP Studios) C:\Program Files (x86)\BillP Studios\WinPatrol\WinPatrol.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Opera Software) C:\Program Files (x86)\Opera\opera.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.EXE (shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe (Lexware GmbH & Co. KG) C:\Program Files (x86)\Common Files\Lexware\Update Manager\LxUpdateManager.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [cAudioFilterAgent] - C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [503864 2009-07-20] (Conexant Systems, Inc.) HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1842472 2009-09-17] (Synaptics Incorporated) HKLM\...\Run: [Acer ePower Management] - C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [818720 2010-02-26] (Acer Incorporated) HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Java\jre6\bin\jusched.exe [170496 2010-11-30] (Sun Microsystems, Inc.) HKLM\...\Run: [MSC] - c:\Program Files\Microsoft Security Client\msseces.exe [1356240 2013-08-12] (Microsoft Corporation) HKCU\...\Run: [WinPatrol] - C:\Program Files (x86)\BillP Studios\WinPatrol\winpatrol.exe [441408 2013-09-24] (BillP Studios) HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-03-04] (Intel Corporation) HKLM-x32\...\Run: [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe [825864 2009-09-24] (Dritek System Inc.) HKLM-x32\...\Run: [FreePDF Assistant] - C:\Program Files (x86)\FreePDF_XP\fpassist.exe [370176 2010-06-17] (shbox.de) HKLM-x32\...\Run: [LexwareInfoService] - C:\Program Files (x86)\Common Files\Lexware\Update Manager\LxUpdateManager.exe [339240 2008-11-03] (Lexware GmbH & Co. KG) HKLM-x32\...\Run: [] - [x] HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.) HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.) HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-09-05] (Adobe Systems Incorporated) HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default HKU\Default User\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default Startup: C:\Users\Gabriele\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation) Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\Gabriele\AppData\Roaming\Mozilla\Firefox\Profiles\8pdx3bji.default FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll () FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @microsoft.com/GENUINE - disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1167637.dll (Adobe Systems, Inc.) FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE - disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: dp Launcher Plugin - C:\Users\Gabriele\AppData\Roaming\Mozilla\Firefox\Profiles\8pdx3bji.default\Extensions\dplauncher@digitalpublishing.de FF Extension: Adblock Plus - C:\Users\Gabriele\AppData\Roaming\Mozilla\Firefox\Profiles\8pdx3bji.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} FF Extension: Adblock Plus - C:\Users\Gabriele\AppData\Roaming\Mozilla\Firefox\Profiles\8pdx3bji.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0034-ABCDEFFEDCBA} FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0039-ABCDEFFEDCBA} ==================== Services (Whitelisted) ================= S3 DfSdkS; C:\Program Files (x86)\Ashampoo\Ashampoo WinOptimizer Free\Dfsdks.exe [544768 2009-08-24] (mst software GmbH, Germany) R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation) R2 Mobile Broadband HL Service; C:\ProgramData\MobileBrServ\mbbservice.exe [232288 2012-03-12] () R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2013-08-12] (Microsoft Corporation) S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366600 2013-08-12] (Microsoft Corporation) R2 NTISchedulerSvc; C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [144640 2010-04-17] (NTI, Inc.) ==================== Drivers (Whitelisted) ==================== R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [247216 2013-06-18] (Microsoft Corporation) S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [139616 2013-06-18] (Microsoft Corporation) U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) S3 catchme; \??\C:\ComboFix\catchme.sys [x] S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [x] S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-10-27 09:23 - 2013-10-27 09:23 - 00000000 ____D C:\Program Files (x86)\ESET 2013-10-26 16:07 - 2013-10-26 16:07 - 00001465 _____ C:\Users\Gabriele\Desktop\JRT.txt 2013-10-26 16:00 - 2013-10-26 16:00 - 00000000 ____D C:\Windows\ERUNT 2013-10-26 15:46 - 2013-10-26 15:46 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2013-10-26 15:46 - 2013-10-26 15:46 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-10-26 15:46 - 2013-04-04 13:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2013-10-26 12:22 - 2013-10-26 12:22 - 00000000 ____D C:\Program Files\Microsoft Security Client 2013-10-26 12:22 - 2013-10-26 12:22 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client 2013-10-25 19:47 - 2013-10-25 19:47 - 00027590 _____ C:\ComboFix.txt 2013-10-25 19:34 - 2013-10-25 19:47 - 00000000 ____D C:\Qoobox 2013-10-25 19:34 - 2013-10-25 19:45 - 00000000 ____D C:\Windows\erdnt 2013-10-25 19:34 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe 2013-10-25 19:34 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe 2013-10-25 19:34 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2013-10-25 19:34 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2013-10-25 19:34 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2013-10-25 19:34 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe 2013-10-25 19:34 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe 2013-10-25 19:34 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe 2013-10-24 12:47 - 2013-10-24 17:06 - 00004544 _____ C:\Users\Gabriele\Pictures\Documents\spLog.log 2013-10-24 10:00 - 2013-10-24 10:00 - 00001147 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk 2013-10-24 09:59 - 2013-10-24 09:59 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2013-10-23 17:19 - 2013-10-26 12:15 - 00616358 _____ C:\Windows\PFRO.log 2013-10-23 13:44 - 2013-10-23 13:44 - 00090384 _____ C:\Users\Gabriele\AppData\Local\GDIPFONTCACHEV1.DAT 2013-10-23 13:43 - 2013-10-27 12:13 - 00001456 _____ C:\Windows\setupact.log 2013-10-23 13:43 - 2013-10-23 13:43 - 00000000 _____ C:\Windows\setuperr.log 2013-10-23 13:42 - 2013-10-23 13:43 - 00354960 _____ C:\Windows\system32\FNTCACHE.DAT 2013-10-23 12:47 - 2013-10-23 12:47 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2013-10-23 12:47 - 2013-10-23 12:47 - 00000000 ____D C:\ProgramData\Oracle 2013-10-23 12:47 - 2013-10-23 12:46 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2013-10-23 12:47 - 2013-10-23 12:46 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2013-10-23 12:47 - 2013-10-23 12:46 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2013-10-23 12:42 - 2013-10-23 12:42 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll 2013-10-23 12:31 - 2013-10-23 15:50 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Ywxou 2013-10-23 12:31 - 2013-10-23 12:32 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Kuoqig 2013-10-23 11:20 - 2013-10-23 11:20 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\AVAST Software 2013-10-23 11:19 - 2013-10-23 17:27 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe 2013-10-23 11:18 - 2013-10-23 19:52 - 00000000 ____D C:\ProgramData\AVAST Software 2013-10-23 11:12 - 2013-10-23 15:50 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Ysex 2013-10-23 11:12 - 2013-10-23 11:12 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Sauxw 2013-10-23 11:12 - 2013-10-23 11:12 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Omoz 2013-10-21 16:31 - 2013-10-26 15:55 - 00000000 ____D C:\AdwCleaner 2013-10-21 16:31 - 2013-10-21 16:31 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\WinPatrol 2013-10-21 16:31 - 2013-10-21 16:31 - 00000000 ____D C:\ProgramData\InstallMate 2013-10-21 16:31 - 2013-10-21 16:31 - 00000000 ____D C:\Program Files (x86)\BillP Studios 2013-10-21 13:55 - 2013-10-23 14:01 - 00000000 ____D C:\Users\Gabriele\Texte 2013-10-21 09:49 - 2013-10-21 15:00 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Wyac 2013-10-21 09:49 - 2013-10-21 11:32 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Geok 2013-10-21 09:49 - 2013-10-21 09:49 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Ydote 2013-10-21 09:44 - 2013-10-23 09:23 - 00000000 ____D C:\Windows\Minidump 2013-10-21 09:28 - 2013-10-21 09:28 - 00000000 ____D C:\FRST 2013-10-21 09:04 - 2013-10-21 15:00 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Izcy 2013-10-21 09:04 - 2013-10-21 09:05 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Wezuza 2013-10-20 16:07 - 2013-10-21 13:56 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Xyege 2013-10-20 16:07 - 2013-10-20 16:07 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Nyof 2013-10-20 16:07 - 2013-10-20 16:07 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Myiliv 2013-10-19 17:09 - 2013-10-22 22:41 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Asma 2013-10-19 17:09 - 2013-10-22 15:14 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Wulyq 2013-10-19 17:09 - 2013-10-19 17:09 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Laxew 2013-10-17 14:12 - 2013-10-17 14:12 - 00002023 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk 2013-10-16 19:26 - 2013-10-19 19:30 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Uxubex 2013-10-16 19:26 - 2013-10-19 12:32 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Nunew 2013-10-16 19:26 - 2013-10-16 19:26 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Avyv 2013-10-16 14:04 - 2013-10-19 12:27 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Axaxt 2013-10-16 14:04 - 2013-10-17 21:10 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Niyfxe 2013-10-16 14:04 - 2013-10-16 14:04 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Utaxd 2013-10-16 08:56 - 2013-10-19 19:30 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Piidim 2013-10-16 08:56 - 2013-10-19 12:27 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Apog 2013-10-16 08:56 - 2013-10-16 08:56 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Xywue 2013-10-15 17:18 - 2013-10-21 15:00 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Okysz 2013-10-15 17:18 - 2013-10-20 16:01 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Myeh 2013-10-15 17:18 - 2013-10-15 17:18 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Yxacdy 2013-10-15 11:49 - 2013-10-19 19:30 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Racup 2013-10-15 11:49 - 2013-10-19 12:32 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Gahu 2013-10-15 11:49 - 2013-10-15 11:49 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Ufnafo 2013-10-15 09:29 - 2013-10-19 12:32 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Imynd 2013-10-15 09:29 - 2013-10-16 11:29 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Liel 2013-10-15 09:29 - 2013-10-15 09:29 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Huuk 2013-10-09 12:42 - 2013-09-23 00:28 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2013-10-09 12:42 - 2013-09-23 00:28 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2013-10-09 12:42 - 2013-09-23 00:27 - 14335488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2013-10-09 12:42 - 2013-09-23 00:27 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2013-10-09 12:42 - 2013-09-23 00:27 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2013-10-09 12:42 - 2013-09-23 00:27 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2013-10-09 12:42 - 2013-09-23 00:27 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2013-10-09 12:42 - 2013-09-23 00:27 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2013-10-09 12:42 - 2013-09-23 00:27 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2013-10-09 12:42 - 2013-09-23 00:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll 2013-10-09 12:42 - 2013-09-23 00:27 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2013-10-09 12:42 - 2013-09-23 00:27 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2013-10-09 12:42 - 2013-09-23 00:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2013-10-09 12:42 - 2013-09-22 23:55 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2013-10-09 12:42 - 2013-09-22 23:55 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2013-10-09 12:42 - 2013-09-22 23:55 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2013-10-09 12:42 - 2013-09-22 23:54 - 19252224 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2013-10-09 12:42 - 2013-09-22 23:54 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2013-10-09 12:42 - 2013-09-22 23:54 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2013-10-09 12:42 - 2013-09-22 23:54 - 02647552 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2013-10-09 12:42 - 2013-09-22 23:54 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2013-10-09 12:42 - 2013-09-22 23:54 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2013-10-09 12:42 - 2013-09-22 23:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2013-10-09 12:42 - 2013-09-22 23:54 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2013-10-09 12:42 - 2013-09-22 23:54 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2013-10-09 12:42 - 2013-09-22 23:54 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2013-10-09 12:42 - 2013-09-22 23:54 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2013-10-09 12:42 - 2013-09-21 04:38 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2013-10-09 12:42 - 2013-09-21 04:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2013-10-09 12:42 - 2013-09-21 03:48 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe 2013-10-09 12:42 - 2013-09-21 03:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe 2013-10-09 12:25 - 2013-09-14 02:10 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys 2013-10-09 12:25 - 2013-09-08 03:30 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys 2013-10-09 12:25 - 2013-09-08 03:27 - 00327168 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll 2013-10-09 12:25 - 2013-09-08 03:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswsock.dll 2013-10-09 12:25 - 2013-08-29 03:17 - 05549504 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2013-10-09 12:25 - 2013-08-29 03:16 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll 2013-10-09 12:25 - 2013-08-29 03:16 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll 2013-10-09 12:25 - 2013-08-29 03:16 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll 2013-10-09 12:25 - 2013-08-29 03:13 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll 2013-10-09 12:25 - 2013-08-29 02:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2013-10-09 12:25 - 2013-08-29 02:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2013-10-09 12:25 - 2013-08-29 02:50 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll 2013-10-09 12:25 - 2013-08-29 02:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll 2013-10-09 12:25 - 2013-08-29 02:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll 2013-10-09 12:25 - 2013-08-29 02:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll 2013-10-09 12:25 - 2013-08-29 01:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe 2013-10-09 12:25 - 2013-08-29 01:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll 2013-10-09 12:25 - 2013-08-29 01:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe 2013-10-09 12:25 - 2013-08-29 01:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe 2013-10-09 12:25 - 2013-08-28 02:21 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2013-10-09 12:25 - 2013-07-12 11:41 - 00185344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys 2013-10-09 12:25 - 2013-07-12 11:41 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys 2013-10-09 12:25 - 2013-07-04 13:57 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll 2013-10-09 12:25 - 2013-07-04 13:50 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll 2013-10-09 12:25 - 2013-07-04 13:50 - 00102400 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll 2013-10-09 12:25 - 2013-07-04 12:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll 2013-10-09 12:25 - 2013-07-04 12:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll 2013-10-09 12:25 - 2013-07-04 12:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll 2013-10-09 12:25 - 2013-07-04 11:11 - 00140800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys 2013-10-09 12:25 - 2013-07-03 05:40 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys 2013-10-09 12:25 - 2013-07-03 05:05 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys 2013-10-09 12:25 - 2013-07-03 05:05 - 00032896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys 2013-10-09 12:25 - 2013-06-25 23:55 - 00785624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys 2013-10-09 12:25 - 2013-06-06 06:50 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll 2013-10-09 12:25 - 2013-06-06 06:49 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll 2013-10-09 12:25 - 2013-06-06 06:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll 2013-10-09 12:25 - 2013-06-06 06:47 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll 2013-10-09 12:25 - 2013-06-06 05:57 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll 2013-10-09 12:25 - 2013-06-06 05:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll 2013-10-09 12:25 - 2013-06-06 05:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll 2013-10-09 12:25 - 2013-06-06 04:30 - 00368128 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll 2013-10-09 12:25 - 2013-06-06 04:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll 2013-10-09 12:25 - 2013-06-06 04:01 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll 2013-10-09 12:24 - 2013-09-04 13:12 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys 2013-10-09 12:24 - 2013-09-04 13:11 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys 2013-10-09 12:24 - 2013-09-04 13:11 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys 2013-10-09 12:24 - 2013-09-04 13:11 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys 2013-10-09 12:24 - 2013-09-04 13:11 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys 2013-10-09 12:24 - 2013-09-04 13:11 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys 2013-10-09 12:24 - 2013-09-04 13:11 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys 2013-10-09 12:24 - 2013-08-28 02:12 - 00461312 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll 2013-10-09 12:24 - 2013-08-01 13:09 - 00983488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys 2013-10-09 12:24 - 2013-07-20 11:33 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll 2013-10-09 12:24 - 2013-07-20 11:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll 2013-09-30 16:33 - 2013-10-23 21:06 - 00000000 ____D C:\Users\Gabriele\Pictures\Documents\Kita_Gründung ==================== One Month Modified Files and Folders ======= 2013-10-27 12:58 - 2012-04-06 18:36 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-10-27 12:13 - 2013-10-23 13:43 - 00001456 _____ C:\Windows\setupact.log 2013-10-27 12:13 - 2010-11-02 00:40 - 01164124 _____ C:\Windows\WindowsUpdate.log 2013-10-27 09:36 - 2010-11-02 09:31 - 00657948 _____ C:\Windows\system32\perfh007.dat 2013-10-27 09:36 - 2010-11-02 09:31 - 00131288 _____ C:\Windows\system32\perfc007.dat 2013-10-27 09:36 - 2009-07-14 06:13 - 01507502 _____ C:\Windows\system32\PerfStringBackup.INI 2013-10-27 09:36 - 2009-07-14 05:45 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-10-27 09:36 - 2009-07-14 05:45 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-10-27 09:29 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2013-10-27 09:23 - 2013-10-27 09:23 - 00000000 ____D C:\Program Files (x86)\ESET 2013-10-26 16:07 - 2013-10-26 16:07 - 00001465 _____ C:\Users\Gabriele\Desktop\JRT.txt 2013-10-26 16:00 - 2013-10-26 16:00 - 00000000 ____D C:\Windows\ERUNT 2013-10-26 15:55 - 2013-10-21 16:31 - 00000000 ____D C:\AdwCleaner 2013-10-26 15:46 - 2013-10-26 15:46 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2013-10-26 15:46 - 2013-10-26 15:46 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-10-26 12:22 - 2013-10-26 12:22 - 00000000 ____D C:\Program Files\Microsoft Security Client 2013-10-26 12:22 - 2013-10-26 12:22 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client 2013-10-26 12:22 - 2011-12-06 21:08 - 00001912 _____ C:\Windows\epplauncher.mif 2013-10-26 12:15 - 2013-10-23 17:19 - 00616358 _____ C:\Windows\PFRO.log 2013-10-25 19:54 - 2011-12-06 21:08 - 01527912 _____ C:\Windows\SysWOW64\PerfStringBackup.INI 2013-10-25 19:47 - 2013-10-25 19:47 - 00027590 _____ C:\ComboFix.txt 2013-10-25 19:47 - 2013-10-25 19:34 - 00000000 ____D C:\Qoobox 2013-10-25 19:47 - 2009-07-14 04:20 - 00000000 __RHD C:\Users\Default 2013-10-25 19:45 - 2013-10-25 19:34 - 00000000 ____D C:\Windows\erdnt 2013-10-25 19:45 - 2010-11-26 17:38 - 00000000 ___RD C:\Users\Gabriele\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2013-10-25 19:44 - 2009-07-14 03:34 - 00000215 _____ C:\Windows\system.ini 2013-10-25 19:43 - 2013-02-27 21:45 - 00000000 ____D C:\Program Files (x86)\ViiKiiDesktopPlugin 2013-10-24 17:06 - 2013-10-24 12:47 - 00004544 _____ C:\Users\Gabriele\Pictures\Documents\spLog.log 2013-10-24 12:26 - 2010-11-27 15:30 - 00000000 ____D C:\Users\Gabriele\AppData\Local\FreePDF_XP 2013-10-24 10:00 - 2013-10-24 10:00 - 00001147 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk 2013-10-24 10:00 - 2013-04-16 18:04 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-10-24 09:59 - 2013-10-24 09:59 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2013-10-23 21:07 - 2010-11-26 17:38 - 00000000 ____D C:\Users\Gabriele 2013-10-23 21:06 - 2013-09-30 16:33 - 00000000 ____D C:\Users\Gabriele\Pictures\Documents\Kita_Gründung 2013-10-23 19:52 - 2013-10-23 11:18 - 00000000 ____D C:\ProgramData\AVAST Software 2013-10-23 18:56 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache 2013-10-23 17:28 - 2012-10-08 18:03 - 00000000 ____D C:\Program Files (x86)\Google 2013-10-23 17:27 - 2013-10-23 11:19 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe 2013-10-23 15:50 - 2013-10-23 12:31 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Ywxou 2013-10-23 15:50 - 2013-10-23 11:12 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Ysex 2013-10-23 14:01 - 2013-10-21 13:55 - 00000000 ____D C:\Users\Gabriele\Texte 2013-10-23 13:47 - 2012-10-08 18:03 - 00000000 ____D C:\Users\Gabriele\AppData\Local\Google 2013-10-23 13:44 - 2013-10-23 13:44 - 00090384 _____ C:\Users\Gabriele\AppData\Local\GDIPFONTCACHEV1.DAT 2013-10-23 13:43 - 2013-10-23 13:43 - 00000000 _____ C:\Windows\setuperr.log 2013-10-23 13:43 - 2013-10-23 13:42 - 00354960 _____ C:\Windows\system32\FNTCACHE.DAT 2013-10-23 12:47 - 2013-10-23 12:47 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2013-10-23 12:47 - 2013-10-23 12:47 - 00000000 ____D C:\ProgramData\Oracle 2013-10-23 12:46 - 2013-10-23 12:47 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2013-10-23 12:46 - 2013-10-23 12:47 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2013-10-23 12:46 - 2013-10-23 12:47 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2013-10-23 12:46 - 2010-11-26 18:22 - 00000000 ____D C:\Program Files (x86)\Java 2013-10-23 12:42 - 2013-10-23 12:42 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll 2013-10-23 12:42 - 2013-02-05 11:33 - 00312744 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe 2013-10-23 12:42 - 2010-11-30 19:09 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe 2013-10-23 12:42 - 2010-11-30 19:09 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe 2013-10-23 12:42 - 2010-11-30 19:09 - 00000000 ____D C:\Program Files\Java 2013-10-23 12:32 - 2013-10-23 12:31 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Kuoqig 2013-10-23 11:20 - 2013-10-23 11:20 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\AVAST Software 2013-10-23 11:12 - 2013-10-23 11:12 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Sauxw 2013-10-23 11:12 - 2013-10-23 11:12 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Omoz 2013-10-23 09:23 - 2013-10-21 09:44 - 00000000 ____D C:\Windows\Minidump 2013-10-23 09:23 - 2012-09-07 19:58 - 00000000 ___DC C:\Users\Gabriele\AppData\Local\MigWiz 2013-10-22 22:41 - 2013-10-19 17:09 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Asma 2013-10-22 15:14 - 2013-10-19 17:09 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Wulyq 2013-10-21 16:31 - 2013-10-21 16:31 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\WinPatrol 2013-10-21 16:31 - 2013-10-21 16:31 - 00000000 ____D C:\ProgramData\InstallMate 2013-10-21 16:31 - 2013-10-21 16:31 - 00000000 ____D C:\Program Files (x86)\BillP Studios 2013-10-21 15:00 - 2013-10-21 09:49 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Wyac 2013-10-21 15:00 - 2013-10-21 09:04 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Izcy 2013-10-21 15:00 - 2013-10-15 17:18 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Okysz 2013-10-21 13:56 - 2013-10-20 16:07 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Xyege 2013-10-21 11:49 - 2012-01-28 18:26 - 00000000 ____D C:\Program Files\WinRAR 2013-10-21 11:32 - 2013-10-21 09:49 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Geok 2013-10-21 09:49 - 2013-10-21 09:49 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Ydote 2013-10-21 09:28 - 2013-10-21 09:28 - 00000000 ____D C:\FRST 2013-10-21 09:05 - 2013-10-21 09:04 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Wezuza 2013-10-20 18:53 - 2010-12-08 16:00 - 00000043 _____ C:\Windows\gswin32.ini 2013-10-20 16:07 - 2013-10-20 16:07 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Nyof 2013-10-20 16:07 - 2013-10-20 16:07 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Myiliv 2013-10-20 16:01 - 2013-10-15 17:18 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Myeh 2013-10-20 13:44 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\registration 2013-10-19 19:30 - 2013-10-16 19:26 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Uxubex 2013-10-19 19:30 - 2013-10-16 08:56 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Piidim 2013-10-19 19:30 - 2013-10-15 11:49 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Racup 2013-10-19 18:25 - 2010-11-26 17:58 - 00000000 ____D C:\ProgramData\Microsoft Help 2013-10-19 18:25 - 2009-07-14 03:34 - 00000478 _____ C:\Windows\win.ini 2013-10-19 17:09 - 2013-10-19 17:09 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Laxew 2013-10-19 12:32 - 2013-10-16 19:26 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Nunew 2013-10-19 12:32 - 2013-10-15 11:49 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Gahu 2013-10-19 12:32 - 2013-10-15 09:29 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Imynd 2013-10-19 12:27 - 2013-10-16 14:04 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Axaxt 2013-10-19 12:27 - 2013-10-16 08:56 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Apog 2013-10-17 21:10 - 2013-10-16 14:04 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Niyfxe 2013-10-17 14:13 - 2010-11-26 18:08 - 00000000 ____D C:\Users\Gabriele\AppData\Local\Adobe 2013-10-17 14:12 - 2013-10-17 14:12 - 00002023 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk 2013-10-17 14:12 - 2012-10-20 19:31 - 00000000 ____D C:\Program Files (x86)\Adobe 2013-10-17 14:12 - 2010-09-23 04:33 - 00000000 ____D C:\ProgramData\Adobe 2013-10-16 19:26 - 2013-10-16 19:26 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Avyv 2013-10-16 14:04 - 2013-10-16 14:04 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Utaxd 2013-10-16 11:29 - 2013-10-15 09:29 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Liel 2013-10-16 08:56 - 2013-10-16 08:56 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Xywue 2013-10-15 18:29 - 2007-07-12 02:49 - 00000000 ____D C:\Windows\Panther 2013-10-15 17:18 - 2013-10-15 17:18 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Yxacdy 2013-10-15 11:49 - 2013-10-15 11:49 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Ufnafo 2013-10-15 09:29 - 2013-10-15 09:29 - 00000000 ____D C:\Users\Gabriele\AppData\Roaming\Huuk 2013-10-09 17:50 - 2011-12-31 18:15 - 00000000 ____D C:\Program Files\Microsoft Silverlight 2013-10-09 17:50 - 2011-12-31 18:15 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight 2013-10-09 12:34 - 2013-07-19 17:04 - 00000000 ____D C:\Windows\system32\MRT 2013-10-09 12:31 - 2010-11-23 12:44 - 80541720 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2013-10-09 09:58 - 2012-04-06 18:36 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2013-10-09 09:58 - 2012-04-06 18:36 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater 2013-10-09 09:58 - 2011-05-15 15:20 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2013-10-04 10:05 - 2013-09-03 11:02 - 00000000 ____D C:\Users\Gabriele\Pictures\Documents\OE 2013-10-01 09:22 - 2010-11-27 12:13 - 00000000 ____D C:\Users\Gabriele\AppData\Local\Mozilla 2013-09-30 16:48 - 2010-11-27 12:43 - 00000000 ____D C:\Users\Gabriele\Pictures\Documents\Fundraising Some content of TEMP: ==================== C:\Users\Gabriele\AppData\Local\Temp\Quarantine.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-10-21 10:14 ==================== End Of Log ============================ Soweit läuft das Laptop normal, es gibt keine Probleme. Schöne Grüße Gabi |
27.10.2013, 18:09 | #8 |
/// the machine /// TB-Ausbilder | Windows, Trojaner, Antivirenprogramm gelöscht von extern Fertig Die Reihenfolge ist hier entscheidend.
Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
27.10.2013, 21:06 | #9 |
| Windows, Trojaner, Antivirenprogramm gelöscht von extern Hallo, ich habe alles nach Deinen Anweisungen erledigt. Von Malware bekomme ich jetzt regelmässig den Stopp einer gefährlichen Webseite gemeldet, Art: ausgehend, svchost.exe. Muss ich da noch etwas tun? Und Secunia PSI hängt sich gern auf... Oder liegt das am Laptop? Schönen Gruß Gabi |
28.10.2013, 11:55 | #10 |
/// the machine /// TB-Ausbilder | Windows, Trojaner, Antivirenprogramm gelöscht von extern Gestern MIttag hast du noch gesagt es gibt keine Probleme Logfile oder Screenshot von der Meldung bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
28.10.2013, 12:52 | #11 |
| Windows, Trojaner, Antivirenprogramm gelöscht von extern Uuuaaah, imeinst Du das hier? Code:
ATTFilter 2013/10/28 08:18:59 +0100 NB-GABRIELE Gabriele MESSAGE Starting protection 2013/10/28 08:18:59 +0100 NB-GABRIELE Gabriele MESSAGE Protection started successfully 2013/10/28 08:18:59 +0100 NB-GABRIELE Gabriele MESSAGE Starting IP protection 2013/10/28 08:19:06 +0100 NB-GABRIELE Gabriele MESSAGE IP Protection started successfully 2013/10/28 08:29:19 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.185 (Type: outgoing, Port: 49317, Process: svchost.exe) 2013/10/28 08:29:19 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.203 (Type: outgoing, Port: 49318, Process: svchost.exe) 2013/10/28 08:29:19 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.183 (Type: outgoing, Port: 49319, Process: svchost.exe) 2013/10/28 08:29:19 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.206 (Type: outgoing, Port: 49320, Process: svchost.exe) 2013/10/28 10:09:32 +0100 NB-GABRIELE (null) MESSAGE Executing scheduled update: Daily 2013/10/28 10:09:33 +0100 NB-GABRIELE (null) MESSAGE Starting protection 2013/10/28 10:09:35 +0100 NB-GABRIELE (null) MESSAGE Protection started successfully 2013/10/28 10:09:35 +0100 NB-GABRIELE (null) MESSAGE Starting IP protection 2013/10/28 10:09:41 +0100 NB-GABRIELE (null) MESSAGE IP Protection started successfully 2013/10/28 10:09:49 +0100 NB-GABRIELE (null) MESSAGE Scheduled update executed successfully: database updated from version v2013.10.27.04 to version v2013.10.28.03 2013/10/28 10:09:49 +0100 NB-GABRIELE (null) MESSAGE Starting database refresh 2013/10/28 10:09:50 +0100 NB-GABRIELE (null) MESSAGE Stopping IP protection 2013/10/28 10:09:50 +0100 NB-GABRIELE (null) MESSAGE IP Protection stopped successfully 2013/10/28 10:09:54 +0100 NB-GABRIELE (null) MESSAGE Database refreshed successfully 2013/10/28 10:09:54 +0100 NB-GABRIELE (null) MESSAGE Starting IP protection 2013/10/28 10:09:58 +0100 NB-GABRIELE (null) MESSAGE IP Protection started successfully 2013/10/28 10:20:06 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.185 (Type: outgoing, Port: 49391, Process: svchost.exe) 2013/10/28 10:20:07 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.203 (Type: outgoing, Port: 49392, Process: svchost.exe) 2013/10/28 10:20:07 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.183 (Type: outgoing, Port: 49393, Process: svchost.exe) 2013/10/28 10:20:07 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.206 (Type: outgoing, Port: 49394, Process: svchost.exe) 2013/10/28 10:30:08 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.185 (Type: outgoing, Port: 49559, Process: svchost.exe) 2013/10/28 10:30:08 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.203 (Type: outgoing, Port: 49560, Process: svchost.exe) 2013/10/28 10:30:08 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.183 (Type: outgoing, Port: 49561, Process: svchost.exe) 2013/10/28 10:30:08 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.206 (Type: outgoing, Port: 49562, Process: svchost.exe) 2013/10/28 10:40:10 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.185 (Type: outgoing, Port: 49765, Process: svchost.exe) 2013/10/28 10:40:10 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.203 (Type: outgoing, Port: 49766, Process: svchost.exe) 2013/10/28 10:40:10 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.183 (Type: outgoing, Port: 49767, Process: svchost.exe) 2013/10/28 10:40:10 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.206 (Type: outgoing, Port: 49768, Process: svchost.exe) 2013/10/28 10:50:12 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.185 (Type: outgoing, Port: 49924, Process: svchost.exe) 2013/10/28 10:50:12 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.203 (Type: outgoing, Port: 49925, Process: svchost.exe) 2013/10/28 10:50:12 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.183 (Type: outgoing, Port: 49926, Process: svchost.exe) 2013/10/28 10:50:12 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.206 (Type: outgoing, Port: 49927, Process: svchost.exe) 2013/10/28 11:00:08 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.200 (Type: outgoing, Port: 50071, Process: svchost.exe) 2013/10/28 11:10:11 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.185 (Type: outgoing, Port: 50073, Process: svchost.exe) 2013/10/28 11:10:11 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.203 (Type: outgoing, Port: 50074, Process: svchost.exe) 2013/10/28 11:10:11 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.183 (Type: outgoing, Port: 50075, Process: svchost.exe) 2013/10/28 11:10:11 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.206 (Type: outgoing, Port: 50076, Process: svchost.exe) 2013/10/28 11:20:12 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.185 (Type: outgoing, Port: 50085, Process: svchost.exe) 2013/10/28 11:20:12 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.203 (Type: outgoing, Port: 50086, Process: svchost.exe) 2013/10/28 11:20:12 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.183 (Type: outgoing, Port: 50087, Process: svchost.exe) 2013/10/28 11:20:12 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.206 (Type: outgoing, Port: 50088, Process: svchost.exe) 2013/10/28 11:30:14 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.185 (Type: outgoing, Port: 50314, Process: svchost.exe) 2013/10/28 11:30:14 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.203 (Type: outgoing, Port: 50315, Process: svchost.exe) 2013/10/28 11:30:14 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.183 (Type: outgoing, Port: 50316, Process: svchost.exe) 2013/10/28 11:30:14 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.206 (Type: outgoing, Port: 50317, Process: svchost.exe) 2013/10/28 11:40:09 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.185 (Type: outgoing, Port: 50830, Process: svchost.exe) 2013/10/28 11:40:09 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.203 (Type: outgoing, Port: 50831, Process: svchost.exe) 2013/10/28 11:40:09 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.183 (Type: outgoing, Port: 50832, Process: svchost.exe) 2013/10/28 11:40:09 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.206 (Type: outgoing, Port: 50833, Process: svchost.exe) 2013/10/28 11:50:11 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.200 (Type: outgoing, Port: 51051, Process: svchost.exe) 2013/10/28 12:00:13 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.206 (Type: outgoing, Port: 51280, Process: svchost.exe) 2013/10/28 12:00:13 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.185 (Type: outgoing, Port: 51281, Process: svchost.exe) 2013/10/28 12:00:13 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.183 (Type: outgoing, Port: 51282, Process: svchost.exe) 2013/10/28 12:00:13 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.203 (Type: outgoing, Port: 51283, Process: svchost.exe) 2013/10/28 12:10:14 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.206 (Type: outgoing, Port: 51285, Process: svchost.exe) 2013/10/28 12:10:14 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.185 (Type: outgoing, Port: 51286, Process: svchost.exe) 2013/10/28 12:10:14 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.183 (Type: outgoing, Port: 51287, Process: svchost.exe) 2013/10/28 12:10:15 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.203 (Type: outgoing, Port: 51288, Process: svchost.exe) 2013/10/28 12:20:10 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.206 (Type: outgoing, Port: 51295, Process: svchost.exe) 2013/10/28 12:20:10 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.185 (Type: outgoing, Port: 51296, Process: svchost.exe) 2013/10/28 12:20:10 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.183 (Type: outgoing, Port: 51297, Process: svchost.exe) 2013/10/28 12:20:10 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.203 (Type: outgoing, Port: 51298, Process: svchost.exe) 2013/10/28 12:30:11 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.206 (Type: outgoing, Port: 51378, Process: svchost.exe) 2013/10/28 12:30:12 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.185 (Type: outgoing, Port: 51379, Process: svchost.exe) 2013/10/28 12:30:12 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.183 (Type: outgoing, Port: 51380, Process: svchost.exe) 2013/10/28 12:30:12 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.203 (Type: outgoing, Port: 51381, Process: svchost.exe) 2013/10/28 12:40:14 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.200 (Type: outgoing, Port: 51962, Process: svchost.exe) 2013/10/28 12:50:16 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.206 (Type: outgoing, Port: 52340, Process: svchost.exe) 2013/10/28 12:50:16 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.185 (Type: outgoing, Port: 52341, Process: svchost.exe) 2013/10/28 12:50:16 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.183 (Type: outgoing, Port: 52342, Process: svchost.exe) 2013/10/28 12:50:16 +0100 NB-GABRIELE Gabriele IP-BLOCK 82.98.97.203 (Type: outgoing, Port: 52343, Process: svchost.exe) |
28.10.2013, 18:52 | #12 |
/// the machine /// TB-Ausbilder | Windows, Trojaner, Antivirenprogramm gelöscht von extern Die IP gehört zur Plus.line AG in Deutschland.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
29.10.2013, 11:13 | #13 |
| Windows, Trojaner, Antivirenprogramm gelöscht von extern Hallo, ok, vielen Dank. Muss ich jetzt noch etwas tun, oder ist jetzt alles gut? Ach, und ich bitte um Entschuldigung, dass ich das Ganze evtl. unnötig verlängert habe. Viele Grüße Gabi |
29.10.2013, 15:49 | #14 |
/// the machine /// TB-Ausbilder | Windows, Trojaner, Antivirenprogramm gelöscht von extern Nö alles gut
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
30.10.2013, 08:08 | #15 |
| Windows, Trojaner, Antivirenprogramm gelöscht von extern Hallo, super! Vielen, vielen Dank an Dich, dass Du Dich so reingehängt hast und mir dieses Problem vom Hals geschafft hast! Dass Du und Deine Kollegen soviel Freizeit darein steckt, ist bemerkenswert. Herzlichzen Dank, nochmal! Viele Grüße Gabi |
Themen zu Windows, Trojaner, Antivirenprogramm gelöscht von extern |
adblock, adobe, converter, defender, device driver, dvdvideosoft ltd., error, excel, farbar, farbar recovery scan tool, firefox, flash player, helper, home, homepage, mp3, newtab, ntdll.dll, object, plug-in, programm, registry, rundll, scan, security, server, services.exe, software, svchost.exe, system, trojaner, trojaner gemeldet, usb, windows |