| |
| |||||||
Log-Analyse und Auswertung: Malwarebytes meldet Trojaner kbdusr32.exeWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
27.10.2013, 19:11
| #16 |
| /// the machine /// TB-Ausbilder    |  Malwarebytes meldet Trojaner kbdusr32.exe Hinweis für Mitleser: Folgendes ComboFix Skript ist ausschließlich für diesen User in dieser Situtation erstellt worden. Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen! Lösche die vorhandene Combofix.exe von deinem Desktop und lade das Programm vom folgenden Download-Spiegel neu herunter: BleepingComputer.comund speichere es erneut auf dem Desktop (nicht woanders hin, das ist wichtig)! Drücke die Windows + R Taste --> Notepad (hinein schreiben) --> OK Kopiere nun den Text aus der folgenden Codebox komplett in das leere Textdokument. Code:
ATTFilter File::
C:\Windows\System32\KBDUSR32.exe
C:\Users\Marc\AppData\Roaming\appconf32.exe
Folder::
C:\Users\Marc\AppData\Roaming\3D8E0C51C266AFA21D32C7E4B4113370
Wichtig:
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
27.10.2013, 21:23
| #17 |
 | Malwarebytes meldet Trojaner kbdusr32.exe Hallo schrauber,
__________________ich bin noch sehr sehr vorsichtig aber: MBAM meldet nichts mehr  Combofix hat sehr stark über Avira gemeckert, jedoch kann ich doch nicht mehr tun als die Dienste zu Stoppen und es im Taskmanager zu beenden oder? Hier das Log: Code:
ATTFilter ComboFix 13-10-26.01 - Marc 27.10.2013 20:37:37.5.3 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.3326.2344 [GMT 1:00]
ausgeführt von:: c:\users\Marc\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: c:\users\Marc\Desktop\CFScript.txt
AV: Avira Desktop *Enabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Enabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\users\Marc\AppData\Roaming\appconf32.exe"
"c:\windows\System32\KBDUSR32.exe"
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Marc\AppData\Roaming\3D8E0C51C266AFA21D32C7E4B4113370
c:\users\Marc\AppData\Roaming\3D8E0C51C266AFA21D32C7E4B4113370\enemies-names.txt
c:\windows\System32\KBDUSR32.exe
.
.
((((((((((((((((((((((((((((((((((((((( Treiber/Dienste )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_cmmon32d
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-09-27 bis 2013-10-27 ))))))))))))))))))))))))))))))
.
.
2013-10-27 19:49 . 2013-10-27 19:52 -------- d-----w- c:\users\Marc\AppData\Local\temp
2013-10-27 19:49 . 2013-10-27 19:49 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-10-27 19:49 . 2013-10-27 19:49 -------- d-----w- c:\users\Administrator\AppData\Local\temp
2013-10-27 11:41 . 2013-10-27 11:41 -------- d-----w- c:\users\Marc\AppData\Roaming\Avira
2013-10-27 11:31 . 2013-10-27 11:31 -------- d-----w- c:\program files\AskPartnerNetwork
2013-10-27 11:30 . 2013-10-27 11:30 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2013-10-27 11:29 . 2013-10-10 18:14 67680 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2013-10-27 11:29 . 2013-10-10 18:14 37352 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2013-10-27 11:29 . 2013-10-10 18:14 89376 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2013-10-27 11:29 . 2013-10-10 18:14 137208 ----a-w- c:\windows\system32\drivers\avipbb.sys
2013-10-27 11:29 . 2013-10-27 11:29 -------- d-----w- c:\program files\Avira
2013-10-26 13:51 . 2013-10-26 13:51 -------- d-----w- c:\program files\Common Files\Java
2013-10-25 09:44 . 2013-10-25 09:44 -------- d-----w- c:\windows\ERUNT
2013-10-25 09:31 . 2013-10-27 12:10 -------- d-----w- C:\AdwCleaner
2013-10-24 15:49 . 2013-10-24 15:50 402189 ----a-w- c:\windows\system32\~.tmp
2013-10-24 06:12 . 2013-10-24 06:12 -------- d-----w- C:\FRST
2013-10-23 11:35 . 2013-10-23 11:42 -------- d-----w- c:\users\Marc\AppData\Roaming\Wise Registry Cleaner
2013-10-23 11:35 . 2013-10-23 11:35 -------- d-----w- c:\program files\Wise
2013-10-22 17:41 . 2013-10-22 17:41 -------- d-----w- c:\users\Marc\AppData\Roaming\Malwarebytes
2013-10-22 17:40 . 2013-10-22 17:40 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2013-10-22 17:40 . 2013-04-04 12:50 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-10-22 06:21 . 2013-09-04 01:15 258560 ----a-w- c:\windows\system32\drivers\usbhub.sys
2013-10-22 06:21 . 2013-09-04 01:14 284672 ----a-w- c:\windows\system32\drivers\usbport.sys
2013-10-22 06:21 . 2013-09-04 01:14 43008 ----a-w- c:\windows\system32\drivers\usbehci.sys
2013-10-22 06:21 . 2013-09-04 01:14 20480 ----a-w- c:\windows\system32\drivers\usbohci.sys
2013-10-22 06:21 . 2013-09-04 01:14 24064 ----a-w- c:\windows\system32\drivers\usbuhci.sys
2013-10-22 06:21 . 2013-09-04 01:14 6016 ----a-w- c:\windows\system32\drivers\usbd.sys
2013-10-22 05:40 . 2013-10-22 05:40 -------- d-----w- c:\users\Marc\AppData\Local\Programs
2013-10-11 07:48 . 2013-10-11 07:48 -------- d-----w- c:\program files\iPod
2013-10-11 07:48 . 2013-10-11 07:50 -------- d-----w- c:\program files\iTunes
2013-10-10 19:15 . 2013-07-04 11:50 530432 ----a-w- c:\windows\system32\comctl32.dll
2013-10-10 19:15 . 2013-07-03 04:02 36352 ----a-w- c:\windows\system32\drivers\usbscan.sys
2013-10-10 19:15 . 2013-09-14 00:48 338944 ----a-w- c:\windows\system32\drivers\afd.sys
2013-10-10 19:15 . 2013-09-08 02:07 1294272 ----a-w- c:\windows\system32\drivers\tcpip.sys
2013-10-10 19:15 . 2013-09-08 02:03 231424 ----a-w- c:\windows\system32\mswsock.dll
2013-10-10 19:15 . 2013-08-01 11:03 729024 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2013-10-10 19:15 . 2013-08-29 01:51 3969472 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-10-10 19:15 . 2013-08-29 01:51 3914176 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-10-10 19:15 . 2013-08-29 01:50 1289096 ----a-w- c:\windows\system32\ntdll.dll
2013-10-10 19:15 . 2013-08-29 01:50 619520 ----a-w- c:\windows\system32\tdh.dll
2013-10-10 19:15 . 2013-08-29 01:48 640512 ----a-w- c:\windows\system32\advapi32.dll
2013-10-10 19:14 . 2013-07-20 10:33 102608 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-10 19:14 . 2013-06-06 04:52 26112 ----a-w- c:\windows\system32\lpk.dll
2013-10-10 19:14 . 2013-06-06 04:51 70656 ----a-w- c:\windows\system32\fontsub.dll
2013-10-10 19:14 . 2013-06-06 04:50 10240 ----a-w- c:\windows\system32\dciman32.dll
2013-10-10 19:14 . 2013-06-06 03:01 295424 ----a-w- c:\windows\system32\atmfd.dll
2013-10-10 19:14 . 2013-06-06 03:01 34304 ----a-w- c:\windows\system32\atmlib.dll
2013-10-10 19:14 . 2013-08-28 00:57 434688 ----a-w- c:\windows\system32\scavengeui.dll
2013-10-10 19:14 . 2013-08-28 01:04 2348544 ----a-w- c:\windows\system32\win32k.sys
2013-10-10 19:14 . 2013-07-04 11:57 205824 ----a-w- c:\windows\system32\WebClnt.dll
2013-10-10 19:14 . 2013-07-04 11:51 81920 ----a-w- c:\windows\system32\davclnt.dll
2013-10-10 19:14 . 2013-07-04 09:48 115712 ----a-w- c:\windows\system32\drivers\mrxdav.sys
2013-10-10 19:13 . 2013-07-12 10:07 86016 ----a-w- c:\windows\system32\drivers\usbcir.sys
2013-10-10 19:13 . 2013-06-25 22:56 527064 ----a-w- c:\windows\system32\drivers\Wdf01000.sys
2013-10-07 11:48 . 2013-10-07 11:48 -------- d-----w- c:\users\Marc\AppData\Roaming\CodeTwo Sync for iCloud
2013-10-07 05:47 . 2013-10-27 15:59 -------- d-----w- c:\users\Marc\AppData\Local\650F40B6-DC35-49F0-A016-75A1DC674132.aplzod
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-10-26 13:50 . 2011-06-23 08:42 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.DLL
2013-10-26 13:46 . 2012-04-10 16:05 692616 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-10-26 13:46 . 2011-10-20 08:07 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-08-02 01:50 . 2013-09-13 05:24 169984 ----a-w- c:\windows\system32\winsrv.dll
2013-08-02 01:49 . 2013-09-13 05:24 293376 ----a-w- c:\windows\system32\KernelBase.dll
2013-08-02 01:48 . 2013-09-13 05:24 5120 ---ha-w- c:\windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-08-02 01:48 . 2013-09-13 05:24 4608 ---ha-w- c:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-08-02 01:48 . 2013-09-13 05:24 4096 ---ha-w- c:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-08-02 01:48 . 2013-09-13 05:24 4096 ---ha-w- c:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-08-02 01:48 . 2013-09-13 05:24 4096 ---ha-w- c:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-08-02 01:48 . 2013-09-13 05:24 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-08-02 01:48 . 2013-09-13 05:24 3584 ---ha-w- c:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-08-02 01:48 . 2013-09-13 05:24 3584 ---ha-w- c:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-08-02 01:48 . 2013-09-13 05:24 3584 ---ha-w- c:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-08-02 01:48 . 2013-09-13 05:24 3584 ---ha-w- c:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-08-02 01:48 . 2013-09-13 05:24 3584 ---ha-w- c:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-08-02 01:48 . 2013-09-13 05:24 3584 ---ha-w- c:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-08-02 01:48 . 2013-09-13 05:24 3072 ---ha-w- c:\windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-08-02 01:48 . 2013-09-13 05:24 3072 ---ha-w- c:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-08-02 01:48 . 2013-09-13 05:24 3072 ---ha-w- c:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-08-02 01:48 . 2013-09-13 05:24 3072 ---ha-w- c:\windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-08-02 01:48 . 2013-09-13 05:24 3072 ---ha-w- c:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-08-02 01:48 . 2013-09-13 05:24 3072 ---ha-w- c:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-08-02 01:48 . 2013-09-13 05:24 3072 ---ha-w- c:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-08-02 01:48 . 2013-09-13 05:24 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-08-02 01:48 . 2013-09-13 05:24 3072 ---ha-w- c:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-08-02 01:48 . 2013-09-13 05:24 3072 ---ha-w- c:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-08-02 01:48 . 2013-09-13 05:24 3072 ---ha-w- c:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-08-02 01:48 . 2013-09-13 05:24 3072 ---ha-w- c:\windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-08-02 00:52 . 2013-09-13 05:24 271360 ----a-w- c:\windows\system32\conhost.exe
2013-08-02 00:43 . 2013-09-13 05:24 6144 ---ha-w- c:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-08-02 00:43 . 2013-09-13 05:24 4608 ---ha-w- c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-08-02 00:43 . 2013-09-13 05:24 3584 ---ha-w- c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-08-02 00:43 . 2013-09-13 05:24 3072 ---ha-w- c:\windows\system32\api-ms-win-core-util-l1-1-0.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{C9EE92B7-EDD5-4ad9-8029-2EC6818E653A}]
2013-05-27 14:33 3075712 ----a-w- c:\program files\AusweisApp\siqeCardClient.ols
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Outlook Sync"="c:\program files\CodeTwo\Outlook Sync\C2OutlookSync.exe" [2012-08-03 9702912]
"iCloudServices"="c:\program files\Common Files\Apple\Internet Services\iCloudServices.exe" [2013-09-14 59720]
"AppleIEDAV"="c:\program files\Common Files\Apple\Internet Services\AppleIEDAV.exe" [2013-09-04 1315144]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-09-25 98304]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-07-20 7625248]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdcBase.exe" [2007-05-31 648072]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-10-06 59240]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2013-10-01 152392]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2013-10-10 681032]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
CAPIControl.lnk - c:\program files\Telekom\T-Eumex 220PC\Capictrl.exe [2003-9-9 274432]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
R2 StarMoney 8.0 OnlineUpdate;StarMoney 8.0 OnlineUpdate;c:\program files\StarMoney 8.0\ouservice\StarMoneyOnlineUpdate.exe [2012-12-21 699680]
R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\Common Files\MAGIX Services\Database\bin\fbserver.exe [2008-08-07 3276800]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 14848]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 49664]
R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2010-04-03 44896]
R4 RsFx0151;RsFx0151 Driver;c:\windows\system32\DRIVERS\RsFx0151.sys [2011-06-17 240736]
R4 SQLAgent$CANTOR2008;SQL Server Agent (CANTOR2008);c:\program files\Microsoft SQL Server\MSSQL10_50.CANTOR2008\MSSQL\Binn\SQLAGENT.EXE [2011-06-17 370016]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2013-10-10 37352]
S1 bizVSerial;Franson VSerial;c:\windows\system32\drivers\bizVSerialNT.sys [2007-05-31 14949]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-09-23 172032]
S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2013-10-10 440392]
S2 AntiVirWebService;Avira Browser-Schutz;c:\program files\Avira\AntiVir Desktop\avwebg7.exe [2013-10-10 1164360]
S2 APNMCP;Ask Aktualisierungsdienst;c:\program files\AskPartnerNetwork\Toolbar\apnmcp.exe [2013-10-23 166352]
S2 avnetflt;avnetflt;c:\windows\system32\DRIVERS\avnetflt.sys [2013-10-10 67680]
S2 CAPI20;Eumex 220PC;c:\windows\system32\drivers\capi20.sys [2003-11-26 962424]
S2 cjpcsc;cyberJack PC/SC COM Service ;c:\windows\system32\cjpcsc.exe [2011-07-22 511920]
S2 DETEWECP;Telekom CapiPort;c:\windows\System32\drivers\detewecp.sys [2003-03-19 37696]
S2 EPSON_EB_RPCV4_04;EPSON V5 Service4(04);c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50ST7.EXE [2009-09-14 153600]
S2 EPSON_PM_RPCV4_04;EPSON V3 Service4(04);c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50RP7.EXE [2009-09-14 121856]
S2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files\Common Files\MAGIX Services\Database\bin\FABS.exe [2009-02-03 1155072]
S2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-04-04 418376]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2013-04-04 701512]
S2 MSSQL$CANTOR2005;SQL Server (CANTOR2005);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2010-12-10 29293408]
S2 MSSQL$CANTOR2008;SQL Server (CANTOR2008);c:\program files\Microsoft SQL Server\MSSQL10_50.CANTOR2008\MSSQL\Binn\sqlservr.exe [2011-06-17 43040096]
S3 cjusb;REINER SCT cyberJack USB Driver;c:\windows\system32\DRIVERS\cjusb.sys [2011-03-29 28144]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2013-04-04 22856]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2011-06-10 394856]
S3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192su.sys [2010-11-25 603240]
S3 ulisa;Telekom ISDN-Adapter (USB);c:\windows\system32\Drivers\ulisa.sys [2003-10-02 121020]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2009-06-05 27320]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
.
Inhalt des "geplante Tasks" Ordners
.
2013-10-27 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-10 13:46]
.
2013-10-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore1ce8124cd2f07e5.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-15 17:51]
.
2013-10-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-15 17:51]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.t-online.de/
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MIF5BA~1\Office12\EXCEL.EXE/3000
IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4
TCP: DhcpNameServer = 192.168.2.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{41564952-412D-5637-00A7-7A786E7484D7} - (no file)
Toolbar-{41564952-412D-5637-00A7-7A786E7484D7} - (no file)
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_9_900_117_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_9_900_117_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\atieclxx.exe
c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\windows\system32\taskhost.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\windows\system32\conhost.exe
c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe
c:\windows\system32\PSIService.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\program files\Common Files\Apple\Internet Services\APSDaemon.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\System32\WUDFHost.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\DllHost.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2013-10-27 21:06:55 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2013-10-27 20:06
ComboFix2.txt 2013-10-27 11:17
ComboFix3.txt 2013-10-27 09:53
ComboFix4.txt 2013-10-24 11:54
ComboFix5.txt 2013-10-27 19:36
.
Vor Suchlauf: 16 Verzeichnis(se), 522.437.787.648 Bytes frei
Nach Suchlauf: 18 Verzeichnis(se), 522.171.310.080 Bytes frei
.
- - End Of File - - 6F2D33E79A95E33A170D6E51517364F3
7827CE22D5B6A2E3FA5111270DD20242
|
|
28.10.2013, 11:56
| #18 |
| /// the machine /// TB-Ausbilder | Malwarebytes meldet Trojaner kbdusr32.exe Poste bitte ein frisches FRST log.
__________________
__________________ |
|
28.10.2013, 18:19
| #19 |
| | Malwarebytes meldet Trojaner kbdusr32.exe Hallo schrauber, hier das FRST Log: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 28-10-2013
Ran by Marc (administrator) on MARC-PC on 28-10-2013 18:06:17
Running from C:\Users\Marc\Desktop
Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) ===================
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdcBase.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(APN LLC.) C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(REINER SCT) C:\Windows\system32\cjpcsc.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50ST7.EXE
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RP7.EXE
(MAGIX AG) C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
(Microsoft Corporation) c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL10_50.CANTOR2008\MSSQL\Binn\sqlservr.exe
() C:\Windows\system32\PSIService.exe
(Microsoft Corporation) C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
(Microsoft Corporation) c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(CodeTwo) C:\Program Files\CodeTwo\Outlook Sync\C2OutlookSync.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe
(DeTeWe AG & Co.) C:\Program Files\Telekom\T-Eumex 220PC\Capictrl.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(ALBAT+WIRSAM Software GmbH) C:\Program Files\HoffmannHandel\cversion\CaMain.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [StartCCC] - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-09-25] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7625248 2009-07-20] (Realtek Semiconductor)
HKLM\...\Run: [Windows Mobile-based device management] - C:\Windows\WindowsMobile\wmdcBase.exe [648072 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [AppleSyncNotifier] - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [59240 2011-10-06] (Apple Inc.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM\...\Run: [BCSSync] - C:\Program Files\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
HKLM\...\Run: [iTunesHelper] - C:\Program Files\iTunes\iTunesHelper.exe [152392 2013-10-01] (Apple Inc.)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [681032 2013-10-10] (Avira Operations GmbH & Co. KG)
HKCU\...\Run: [Outlook Sync] - C:\Program Files\CodeTwo\Outlook Sync\C2OutlookSync.exe [9702912 2012-08-03] (CodeTwo)
HKCU\...\Run: [iCloudServices] - C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-09-14] (Apple Inc.)
HKCU\...\Run: [AppleIEDAV] - C:\Program Files\Common Files\Apple\Internet Services\AppleIEDAV.exe [1315144 2013-09-04] (Apple Inc.)
HKCU\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\Default\...\RunOnce: [LangBar] - C:\Windows\System32\oobe\info\LangBar.vbs [ 2009-10-23] ()
HKU\Default\...\RunOnce: [MEDION] - C:\Windows\Web\Wallpaper\MEDION\start.vbs [ 2009-10-23] ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.t-online.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://medion.msn.com
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {71A82072-8E19-4068-8683-E08B0B7BD5A7} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MEDTDF&pc=MAMD&src=IE-SearchBox
SearchScopes: HKCU - {C07E3489-0285-4C1C-8E72-BEF0DF22BED6} URL = hxxp://de.search.yahoo.com/search?p={searchterms}&ei=UTF-8&fr=w3i&type=W3i_DS,136,0_0,Search,20110937,17131,0,18,0
BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: AusweisApp 1.8.0.0 - {C9EE92B7-EDD5-4ad9-8029-2EC6818E653A} - C:\Program Files\AusweisApp\siqeCardClient.ols (OpenLimit SignCubes AG)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: ftd - C:\Users\Marc\AppData\Roaming\Mozilla\Firefox\profiles\extensions\ftd@ftd.com.xpi
Chrome:
=======
========================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440392 2013-10-10] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440392 2013-10-10] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe [1164360 2013-10-10] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2013-10-23] (APN LLC.)
R2 cjpcsc; C:\Windows\system32\cjpcsc.exe [511920 2011-07-22] (REINER SCT)
R2 EPSON_EB_RPCV4_04; C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50ST7.EXE [153600 2009-09-14] (SEIKO EPSON CORPORATION)
R2 EPSON_PM_RPCV4_04; C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RP7.EXE [121856 2009-09-14] (SEIKO EPSON CORPORATION)
R2 Fabs; C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe [1155072 2009-02-03] (MAGIX AG)
S3 FirebirdServerMAGIXInstance; C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe [3276800 2008-08-07] (MAGIX®)
S3 FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [1044816 2011-05-19] (Flexera Software, Inc.)
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MSSQL$CANTOR2005; c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
R2 MSSQL$CANTOR2008; C:\Program Files\Microsoft SQL Server\MSSQL10_50.CANTOR2008\MSSQL\Binn\sqlservr.exe [43040096 2011-06-17] (Microsoft Corporation)
S4 MSSQLServerADHelper; c:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [44384 2010-12-10] (Microsoft Corporation)
R2 ProtexisLicensing; C:\Windows\system32\PSIService.exe [177704 2007-06-05] ()
S4 SQLAgent$CANTOR2008; C:\Program Files\Microsoft SQL Server\MSSQL10_50.CANTOR2008\MSSQL\Binn\SQLAGENT.EXE [370016 2011-06-17] (Microsoft Corporation)
S2 StarMoney 8.0 OnlineUpdate; C:\Program Files\StarMoney 8.0\ouservice\StarMoneyOnlineUpdate.exe [699680 2012-12-21] (Star Finanz - Software Entwicklung und Vertriebs GmbH)
==================== Drivers (Whitelisted) ====================
R0 amdide; C:\Windows\System32\DRIVERS\amdide.sys [11832 2009-07-07] (Advanced Micro Devices Inc.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [89376 2013-10-10] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [137208 2013-10-10] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-10] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [67680 2013-10-10] (Avira Operations GmbH & Co. KG)
R1 bizVSerial; C:\Windows\System32\drivers\bizVSerialNT.sys [14949 2007-05-31] (franson.biz)
R2 CAPI20; C:\Windows\System32\drivers\capi20.sys [962424 2003-11-26] (DeTeWe Berlin)
R3 cjusb; C:\Windows\System32\DRIVERS\cjusb.sys [28144 2011-03-29] (REINER SCT)
R2 DETEWECP; C:\Windows\System32\drivers\detewecp.sys [37696 2003-03-19] (DeTeWe Berlin)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
S4 RsFx0151; C:\Windows\System32\DRIVERS\RsFx0151.sys [240736 2011-06-17] (Microsoft Corporation)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-10-10] (Avira GmbH)
R3 ulisa; C:\Windows\System32\Drivers\ulisa.sys [121020 2003-10-02] (DeTeWe Berlin)
U5 AppMgmt; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Marc\AppData\Local\Temp\catchme.sys [x]
S3 pccsmcfd; system32\DRIVERS\pccsmcfd.sys [x]
S3 Ser2pl; system32\DRIVERS\ser2pl.sys [x]
S3 upperdev; system32\DRIVERS\usbser_lowerflt.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-10-28 18:05 - 2013-10-28 18:05 - 01089183 _____ (Farbar) C:\Users\Marc\Desktop\FRST.exe
2013-10-28 08:06 - 2013-10-28 08:06 - 00144208 _____ C:\Windows\Minidump\102813-24320-01.dmp
2013-10-28 08:00 - 2013-10-28 08:00 - 00144208 _____ C:\Windows\Minidump\102813-23790-01.dmp
2013-10-27 21:07 - 2013-10-27 21:07 - 00019657 _____ C:\ComboFix.txt
2013-10-27 20:27 - 2013-10-27 20:27 - 05136694 ____R (Swearware) C:\Users\Marc\Desktop\ComboFix.exe
2013-10-27 17:14 - 2013-10-27 17:14 - 00001166 _____ C:\Users\Marc\Desktop\checkup.txt
2013-10-27 13:17 - 2013-10-27 13:17 - 00000899 _____ C:\Users\Marc\Desktop\JRT.txt
2013-10-27 12:41 - 2013-10-27 12:41 - 00000000 ____D C:\Users\Marc\AppData\Roaming\Avira
2013-10-27 12:31 - 2013-10-27 12:31 - 00000000 ____D C:\ProgramData\AskPartnerNetwork
2013-10-27 12:31 - 2013-10-27 12:31 - 00000000 ____D C:\Program Files\AskPartnerNetwork
2013-10-27 12:29 - 2013-10-27 12:29 - 00002016 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-10-27 12:29 - 2013-10-27 12:29 - 00000000 ____D C:\Program Files\Avira
2013-10-27 12:29 - 2013-10-10 19:14 - 00137208 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-10-27 12:29 - 2013-10-10 19:14 - 00089376 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-10-27 12:29 - 2013-10-10 19:14 - 00067680 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-10-27 12:29 - 2013-10-10 19:14 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-10-27 12:29 - 2013-10-10 19:14 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
2013-10-26 14:57 - 2013-10-26 14:57 - 00002979 _____ C:\Users\Marc\Desktop\FSS.txt
2013-10-26 14:55 - 2013-10-26 14:55 - 00359085 _____ (Farbar) C:\Users\Marc\Desktop\FSS.exe
2013-10-26 14:51 - 2013-10-26 14:51 - 00000000 ____D C:\ProgramData\Sun
2013-10-26 14:51 - 2013-10-26 14:51 - 00000000 ____D C:\ProgramData\Oracle
2013-10-26 14:51 - 2013-10-26 14:51 - 00000000 ____D C:\Program Files\Common Files\Java
2013-10-26 14:50 - 2013-10-26 14:50 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-10-26 14:50 - 2013-10-26 14:50 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-10-26 14:50 - 2013-10-26 14:50 - 00174504 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-10-25 22:58 - 2013-10-26 20:39 - 00017563 _____ C:\Users\Marc\Desktop\Addition.txt
2013-10-25 11:45 - 2013-10-25 11:45 - 02347384 _____ (ESET) C:\Users\Marc\Desktop\esetsmartinstaller_enu.exe
2013-10-25 11:45 - 2013-10-25 11:45 - 00891167 _____ C:\Users\Marc\Desktop\SecurityCheck.exe
2013-10-25 10:44 - 2013-10-25 10:44 - 00000000 ____D C:\Windows\ERUNT
2013-10-25 10:41 - 2013-10-25 10:41 - 01033335 _____ (Thisisu) C:\Users\Marc\Desktop\JRT.exe
2013-10-25 10:31 - 2013-10-27 13:10 - 00000000 ____D C:\AdwCleaner
2013-10-25 10:29 - 2013-10-25 10:29 - 01060070 _____ C:\Users\Marc\Desktop\adwcleaner.exe
2013-10-25 10:28 - 2013-10-26 20:36 - 00000000 ____D C:\Users\Marc\Desktop\Logfiles 25.10
2013-10-25 10:28 - 2013-10-25 10:28 - 00000000 ____D C:\Users\Marc\Desktop\Logfiles 24.10
2013-10-24 16:49 - 2013-10-28 07:42 - 00200349 _____ C:\Windows\system32\~.tmp
2013-10-24 12:31 - 2013-10-28 08:06 - 316379245 _____ C:\Windows\MEMORY.DMP
2013-10-24 12:31 - 2013-10-24 12:31 - 00613968 _____ C:\Windows\Minidump\102413-58469-01.dmp
2013-10-24 07:12 - 2013-10-24 07:12 - 00000000 ____D C:\FRST
2013-10-23 13:36 - 2013-10-23 13:36 - 00000000 ____D C:\Users\Marc\Desktop\Zubehör
2013-10-23 13:27 - 2013-10-28 07:46 - 00000000 ____D C:\Users\Marc\Desktop\Projekte
2013-10-23 13:27 - 2013-10-25 23:37 - 00000000 ___RD C:\Users\Marc\Desktop\Urban Montagebau
2013-10-23 13:27 - 2013-10-23 13:27 - 00000000 ____D C:\Users\Marc\Desktop\ReportDesignerVersion6.3
2013-10-23 13:25 - 2013-10-26 15:23 - 00000000 ____D C:\Users\Marc\Desktop\Mailfotos
2013-10-23 13:24 - 2013-10-26 21:30 - 00089132 _____ C:\Users\Marc\Desktop\Rechnungen 2013.xlsx
2013-10-23 13:24 - 2013-10-24 18:36 - 00015451 _____ C:\Users\Marc\Desktop\EKH-Bestellung.xlsx
2013-10-23 13:24 - 2013-10-11 18:45 - 00011225 _____ C:\Users\Marc\Desktop\Sonstiges Material.xlsx
2013-10-23 13:24 - 2013-10-08 08:29 - 00011217 _____ C:\Users\Marc\Desktop\ASD-Bestellung Nebenmaterial.xlsx
2013-10-23 13:24 - 2013-10-08 08:26 - 00012302 _____ C:\Users\Marc\Desktop\ASD-Bestellung.xlsx
2013-10-23 13:24 - 2013-09-13 14:03 - 00000184 _____ C:\Users\Marc\Desktop\Geheimtermine.txt
2013-10-23 13:24 - 2013-01-13 18:52 - 00094541 _____ C:\Users\Marc\Desktop\Rechnungen 2012.xlsx
2013-10-23 13:24 - 2012-10-15 22:20 - 00010431 _____ C:\Users\Marc\Desktop\Skontosumme berechnen.xlsx
2013-10-23 13:24 - 2012-07-04 09:24 - 00047616 _____ C:\Users\Marc\Desktop\Silkonrechner.xls
2013-10-23 13:24 - 2012-07-04 09:23 - 00037888 _____ C:\Users\Marc\Desktop\Schaumrechner.xls
2013-10-23 13:24 - 2011-06-01 11:41 - 00030208 _____ C:\Users\Marc\Desktop\U-Werttabelle Kunststoff Fenster.xls
2013-10-23 13:24 - 2010-03-24 09:32 - 00028672 _____ C:\Users\Marc\Desktop\U-Werttabelle Aluminium Schüco AWS.xls
2013-10-23 13:11 - 2013-10-24 11:51 - 00000000 ____D C:\Users\Marc\Desktop\Virustools
2013-10-23 12:44 - 2013-10-27 20:51 - 00009124 _____ C:\Windows\PFRO.log
2013-10-23 12:35 - 2013-10-23 12:42 - 00000000 ____D C:\Users\Marc\AppData\Roaming\Wise Registry Cleaner
2013-10-23 12:35 - 2013-10-23 12:35 - 00001189 _____ C:\Users\Public\Desktop\Wise Registry Cleaner.lnk
2013-10-23 12:35 - 2013-10-23 12:35 - 00000000 ____D C:\Program Files\Wise
2013-10-23 12:07 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2013-10-23 12:07 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2013-10-23 12:07 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-10-23 12:07 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-10-23 12:07 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-10-23 12:07 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2013-10-23 12:07 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2013-10-23 12:07 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2013-10-23 12:06 - 2013-10-27 21:07 - 00000000 ____D C:\Qoobox
2013-10-23 12:06 - 2013-10-27 20:49 - 00000000 ____D C:\Windows\erdnt
2013-10-22 18:41 - 2013-10-22 18:41 - 00000000 ____D C:\Users\Marc\AppData\Roaming\Malwarebytes
2013-10-22 18:40 - 2013-10-22 18:40 - 00001071 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-10-22 18:40 - 2013-10-22 18:40 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-22 18:40 - 2013-10-22 18:40 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-10-22 18:40 - 2013-04-04 13:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-10-22 07:21 - 2013-09-04 02:15 - 00258560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2013-10-22 07:21 - 2013-09-04 02:14 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2013-10-22 07:21 - 2013-09-04 02:14 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2013-10-22 07:21 - 2013-09-04 02:14 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2013-10-22 07:21 - 2013-09-04 02:14 - 00020480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2013-10-22 07:21 - 2013-09-04 02:14 - 00006016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2013-10-18 18:13 - 2013-10-18 18:13 - 00000000 ____D C:\Users\Marc\AppData\Roaming\Mozilla
2013-10-16 05:33 - 2013-10-16 05:33 - 00144208 _____ C:\Windows\Minidump\101613-24476-01.dmp
2013-10-14 11:02 - 2006-06-22 19:52 - 00737280 _____ (Nonne & Schneider Informationssysteme GmbH) C:\Users\Marc\Desktop\RepDes.exe
2013-10-11 08:50 - 2013-10-11 08:50 - 00001757 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-10-11 08:48 - 2013-10-11 08:50 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-10-11 08:48 - 2013-10-11 08:50 - 00000000 ____D C:\Program Files\iTunes
2013-10-11 08:48 - 2013-10-11 08:48 - 00000000 ____D C:\Program Files\iPod
2013-10-10 20:21 - 2013-09-23 00:28 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-10-10 20:21 - 2013-09-23 00:28 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-10-10 20:21 - 2013-09-23 00:28 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-10-10 20:21 - 2013-09-23 00:27 - 14335488 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-10-10 20:21 - 2013-09-23 00:27 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-10-10 20:21 - 2013-09-23 00:27 - 02876928 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-10-10 20:21 - 2013-09-23 00:27 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-10-10 20:21 - 2013-09-23 00:27 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-10-10 20:21 - 2013-09-23 00:27 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-10-10 20:21 - 2013-09-23 00:27 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-10-10 20:21 - 2013-09-23 00:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-10-10 20:21 - 2013-09-23 00:27 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-10-10 20:21 - 2013-09-23 00:27 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-10-10 20:21 - 2013-09-23 00:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-10-10 20:21 - 2013-09-21 04:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-10-10 20:21 - 2013-09-21 03:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-10-10 20:15 - 2013-09-14 01:48 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-10-10 20:15 - 2013-09-08 03:07 - 01294272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-10-10 20:15 - 2013-09-08 03:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2013-10-10 20:15 - 2013-08-29 02:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2013-10-10 20:15 - 2013-08-29 02:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-10-10 20:15 - 2013-08-29 02:50 - 01289096 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-10-10 20:15 - 2013-08-29 02:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2013-10-10 20:15 - 2013-08-29 02:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2013-10-10 20:15 - 2013-08-01 12:03 - 00729024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-10-10 20:15 - 2013-07-04 12:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2013-10-10 20:15 - 2013-07-03 05:02 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys
2013-10-10 20:14 - 2013-08-28 02:04 - 02348544 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-10-10 20:14 - 2013-08-28 01:57 - 00434688 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll
2013-10-10 20:14 - 2013-07-20 11:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-10 20:14 - 2013-07-04 12:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2013-10-10 20:14 - 2013-07-04 12:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2013-10-10 20:14 - 2013-07-04 10:48 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2013-10-10 20:14 - 2013-06-06 05:52 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2013-10-10 20:14 - 2013-06-06 05:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2013-10-10 20:14 - 2013-06-06 05:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2013-10-10 20:14 - 2013-06-06 04:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-10-10 20:14 - 2013-06-06 04:01 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2013-10-10 20:13 - 2013-07-12 11:07 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
2013-10-10 20:13 - 2013-06-25 23:56 - 00527064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2013-10-07 12:48 - 2013-10-07 12:48 - 00000000 ____D C:\Users\Marc\AppData\Roaming\CodeTwo Sync for iCloud
2013-10-07 12:48 - 2013-10-07 12:48 - 00000000 ____D C:\ProgramData\CodeTwo
2013-10-07 06:47 - 2013-10-28 16:12 - 00000000 ____D C:\Users\Marc\AppData\Local\650F40B6-DC35-49F0-A016-75A1DC674132.aplzod
==================== One Month Modified Files and Folders =======
2013-10-28 18:05 - 2013-10-28 18:05 - 01089183 _____ (Farbar) C:\Users\Marc\Desktop\FRST.exe
2013-10-28 17:31 - 2010-02-15 18:51 - 00001094 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-10-28 17:12 - 2012-04-10 17:05 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-10-28 16:50 - 2009-12-14 20:24 - 01952528 _____ C:\Windows\WindowsUpdate.log
2013-10-28 16:12 - 2013-10-07 06:47 - 00000000 ____D C:\Users\Marc\AppData\Local\650F40B6-DC35-49F0-A016-75A1DC674132.aplzod
2013-10-28 13:26 - 2009-07-14 05:34 - 00009696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-28 13:26 - 2009-07-14 05:34 - 00009696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-28 12:31 - 2013-07-15 07:30 - 00001094 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore1ce8124cd2f07e5.job
2013-10-28 08:13 - 2009-09-25 11:51 - 01984554 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-28 08:06 - 2013-10-28 08:06 - 00144208 _____ C:\Windows\Minidump\102813-24320-01.dmp
2013-10-28 08:06 - 2013-10-24 12:31 - 316379245 _____ C:\Windows\MEMORY.DMP
2013-10-28 08:06 - 2010-04-26 09:06 - 00000000 ____D C:\Windows\Minidump
2013-10-28 08:06 - 2009-07-14 05:53 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-10-28 08:06 - 2009-07-14 05:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-28 08:06 - 2009-07-14 05:39 - 00229101 _____ C:\Windows\setupact.log
2013-10-28 08:00 - 2013-10-28 08:00 - 00144208 _____ C:\Windows\Minidump\102813-23790-01.dmp
2013-10-28 07:46 - 2013-10-23 13:27 - 00000000 ____D C:\Users\Marc\Desktop\Projekte
2013-10-28 07:43 - 2010-01-04 10:33 - 00000000 ____D C:\Program Files\ROMBIcalc
2013-10-28 07:42 - 2013-10-24 16:49 - 00200349 _____ C:\Windows\system32\~.tmp
2013-10-27 21:07 - 2013-10-27 21:07 - 00019657 _____ C:\ComboFix.txt
2013-10-27 21:07 - 2013-10-23 12:06 - 00000000 ____D C:\Qoobox
2013-10-27 20:52 - 2009-07-14 03:04 - 00000215 _____ C:\Windows\system.ini
2013-10-27 20:51 - 2013-10-23 12:44 - 00009124 _____ C:\Windows\PFRO.log
2013-10-27 20:50 - 2009-07-14 03:03 - 63963136 _____ C:\Windows\system32\config\software.bak
2013-10-27 20:50 - 2009-07-14 03:03 - 28311552 _____ C:\Windows\system32\config\system.bak
2013-10-27 20:50 - 2009-07-14 03:03 - 00262144 _____ C:\Windows\system32\config\default.bak
2013-10-27 20:50 - 2009-07-14 03:03 - 00032768 _____ C:\Windows\system32\config\sam.bak
2013-10-27 20:50 - 2009-07-14 03:03 - 00028672 _____ C:\Windows\system32\config\security.bak
2013-10-27 20:49 - 2013-10-23 12:06 - 00000000 ____D C:\Windows\erdnt
2013-10-27 20:27 - 2013-10-27 20:27 - 05136694 ____R (Swearware) C:\Users\Marc\Desktop\ComboFix.exe
2013-10-27 17:14 - 2013-10-27 17:14 - 00001166 _____ C:\Users\Marc\Desktop\checkup.txt
2013-10-27 13:17 - 2013-10-27 13:17 - 00000899 _____ C:\Users\Marc\Desktop\JRT.txt
2013-10-27 13:10 - 2013-10-25 10:31 - 00000000 ____D C:\AdwCleaner
2013-10-27 12:41 - 2013-10-27 12:41 - 00000000 ____D C:\Users\Marc\AppData\Roaming\Avira
2013-10-27 12:31 - 2013-10-27 12:31 - 00000000 ____D C:\ProgramData\AskPartnerNetwork
2013-10-27 12:31 - 2013-10-27 12:31 - 00000000 ____D C:\Program Files\AskPartnerNetwork
2013-10-27 12:29 - 2013-10-27 12:29 - 00002016 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-10-27 12:29 - 2013-10-27 12:29 - 00000000 ____D C:\Program Files\Avira
2013-10-27 12:29 - 2011-10-20 09:14 - 00000000 ____D C:\ProgramData\Avira
2013-10-26 21:30 - 2013-10-23 13:24 - 00089132 _____ C:\Users\Marc\Desktop\Rechnungen 2013.xlsx
2013-10-26 20:39 - 2013-10-25 22:58 - 00017563 _____ C:\Users\Marc\Desktop\Addition.txt
2013-10-26 20:36 - 2013-10-25 10:28 - 00000000 ____D C:\Users\Marc\Desktop\Logfiles 25.10
2013-10-26 15:23 - 2013-10-23 13:25 - 00000000 ____D C:\Users\Marc\Desktop\Mailfotos
2013-10-26 14:57 - 2013-10-26 14:57 - 00002979 _____ C:\Users\Marc\Desktop\FSS.txt
2013-10-26 14:55 - 2013-10-26 14:55 - 00359085 _____ (Farbar) C:\Users\Marc\Desktop\FSS.exe
2013-10-26 14:51 - 2013-10-26 14:51 - 00000000 ____D C:\ProgramData\Sun
2013-10-26 14:51 - 2013-10-26 14:51 - 00000000 ____D C:\ProgramData\Oracle
2013-10-26 14:51 - 2013-10-26 14:51 - 00000000 ____D C:\Program Files\Common Files\Java
2013-10-26 14:50 - 2013-10-26 14:50 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-10-26 14:50 - 2013-10-26 14:50 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-10-26 14:50 - 2013-10-26 14:50 - 00174504 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-10-26 14:50 - 2011-06-23 09:42 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.DLL
2013-10-26 14:50 - 2009-11-05 16:58 - 00000000 ____D C:\Program Files\Java
2013-10-26 14:46 - 2012-04-10 17:05 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-10-26 14:46 - 2011-10-20 09:07 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-10-26 14:46 - 2009-12-21 19:08 - 00000000 ____D C:\Users\Marc\AppData\Local\Adobe
2013-10-26 14:41 - 2011-09-30 08:29 - 02624000 ___SH C:\Users\Marc\Desktop\Thumbs.db
2013-10-25 23:37 - 2013-10-23 13:27 - 00000000 ___RD C:\Users\Marc\Desktop\Urban Montagebau
2013-10-25 11:45 - 2013-10-25 11:45 - 02347384 _____ (ESET) C:\Users\Marc\Desktop\esetsmartinstaller_enu.exe
2013-10-25 11:45 - 2013-10-25 11:45 - 00891167 _____ C:\Users\Marc\Desktop\SecurityCheck.exe
2013-10-25 10:44 - 2013-10-25 10:44 - 00000000 ____D C:\Windows\ERUNT
2013-10-25 10:41 - 2013-10-25 10:41 - 01033335 _____ (Thisisu) C:\Users\Marc\Desktop\JRT.exe
2013-10-25 10:29 - 2013-10-25 10:29 - 01060070 _____ C:\Users\Marc\Desktop\adwcleaner.exe
2013-10-25 10:28 - 2013-10-25 10:28 - 00000000 ____D C:\Users\Marc\Desktop\Logfiles 24.10
2013-10-24 18:36 - 2013-10-23 13:24 - 00015451 _____ C:\Users\Marc\Desktop\EKH-Bestellung.xlsx
2013-10-24 13:48 - 2012-01-02 17:15 - 00000000 ____D C:\Users\Marc\AppData\Local\CrashDumps
2013-10-24 12:31 - 2013-10-24 12:31 - 00613968 _____ C:\Windows\Minidump\102413-58469-01.dmp
2013-10-24 11:51 - 2013-10-23 13:11 - 00000000 ____D C:\Users\Marc\Desktop\Virustools
2013-10-24 07:12 - 2013-10-24 07:12 - 00000000 ____D C:\FRST
2013-10-23 13:36 - 2013-10-23 13:36 - 00000000 ____D C:\Users\Marc\Desktop\Zubehör
2013-10-23 13:27 - 2013-10-23 13:27 - 00000000 ____D C:\Users\Marc\Desktop\ReportDesignerVersion6.3
2013-10-23 13:14 - 2009-12-14 20:25 - 00000000 ____D C:\Users\Marc
2013-10-23 12:42 - 2013-10-23 12:35 - 00000000 ____D C:\Users\Marc\AppData\Roaming\Wise Registry Cleaner
2013-10-23 12:35 - 2013-10-23 12:35 - 00001189 _____ C:\Users\Public\Desktop\Wise Registry Cleaner.lnk
2013-10-23 12:35 - 2013-10-23 12:35 - 00000000 ____D C:\Program Files\Wise
2013-10-23 12:20 - 2009-07-14 03:37 - 00000000 __RHD C:\Users\Default
2013-10-23 12:20 - 2009-07-14 03:37 - 00000000 ___RD C:\Users\Public
2013-10-23 09:20 - 2009-07-14 05:33 - 00365336 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-23 08:41 - 2009-12-14 20:26 - 00094888 _____ C:\Users\Marc\AppData\Local\GDIPFONTCACHEV1.DAT
2013-10-23 07:30 - 2010-02-22 14:08 - 00000000 ____D C:\Program Files\ABBYY FineReader 5.0 Sprint
2013-10-23 07:25 - 2009-12-21 18:24 - 00000000 ____D C:\Users\Marc\AppData\Roaming\Corel
2013-10-23 07:25 - 2009-11-09 16:15 - 00000000 ____D C:\ProgramData\Corel
2013-10-23 07:22 - 2009-11-10 10:55 - 00000000 ___HD C:\Program Files\InstallShield Installation Information
2013-10-23 07:22 - 2009-11-05 17:09 - 00000000 ____D C:\Program Files\Common Files\InstallShield
2013-10-23 07:17 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\system
2013-10-23 07:11 - 2013-01-29 09:30 - 00000000 ____D C:\Program Files(x86)
2013-10-23 07:09 - 2013-06-26 18:17 - 00000000 ____D C:\Program Files\WoodWorks
2013-10-22 20:48 - 2013-09-17 07:25 - 00000000 ____D C:\Users\Marc\AppData\Roaming\Kaygi
2013-10-22 20:48 - 2013-09-17 06:25 - 00000000 ____D C:\Users\Marc\AppData\Roaming\Ysmiex
2013-10-22 20:48 - 2013-09-16 06:20 - 00000000 ____D C:\Users\Marc\AppData\Roaming\Ivol
2013-10-22 20:48 - 2013-09-13 10:22 - 00000000 ____D C:\Users\Marc\AppData\Roaming\Apyky
2013-10-22 18:41 - 2013-10-22 18:41 - 00000000 ____D C:\Users\Marc\AppData\Roaming\Malwarebytes
2013-10-22 18:40 - 2013-10-22 18:40 - 00001071 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-10-22 18:40 - 2013-10-22 18:40 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-22 18:40 - 2013-10-22 18:40 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-10-21 13:21 - 2011-10-20 18:37 - 00000000 ____D C:\Program Files\StarMoney 8.0
2013-10-18 18:57 - 2009-07-14 05:52 - 00000000 ____D C:\Program Files\Windows Defender
2013-10-18 18:57 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\system32\wfp
2013-10-18 18:54 - 2010-01-08 08:31 - 00000000 ____D C:\Program Files\Google
2013-10-18 18:54 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\registration
2013-10-18 18:28 - 2010-02-15 18:51 - 00000000 ____D C:\Users\Marc\AppData\Local\Google
2013-10-18 18:13 - 2013-10-18 18:13 - 00000000 ____D C:\Users\Marc\AppData\Roaming\Mozilla
2013-10-16 05:33 - 2013-10-16 05:33 - 00144208 _____ C:\Windows\Minidump\101613-24476-01.dmp
2013-10-11 18:45 - 2013-10-23 13:24 - 00011225 _____ C:\Users\Marc\Desktop\Sonstiges Material.xlsx
2013-10-11 08:50 - 2013-10-11 08:50 - 00001757 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-10-11 08:50 - 2013-10-11 08:48 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-10-11 08:50 - 2013-10-11 08:48 - 00000000 ____D C:\Program Files\iTunes
2013-10-11 08:48 - 2013-10-11 08:48 - 00000000 ____D C:\Program Files\iPod
2013-10-11 08:06 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\rescache
2013-10-11 07:49 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-10-11 06:49 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\system32\de-DE
2013-10-11 06:33 - 2009-09-28 10:07 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-10-11 06:22 - 2009-09-28 09:31 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-10-10 20:26 - 2013-08-15 18:33 - 00000000 ____D C:\Windows\system32\MRT
2013-10-10 20:24 - 2009-09-25 15:29 - 78106760 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-10-10 19:14 - 2013-10-27 12:29 - 00137208 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-10-10 19:14 - 2013-10-27 12:29 - 00089376 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-10-10 19:14 - 2013-10-27 12:29 - 00067680 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-10-10 19:14 - 2013-10-27 12:29 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-10-10 19:14 - 2013-10-27 12:29 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
2013-10-08 08:29 - 2013-10-23 13:24 - 00011217 _____ C:\Users\Marc\Desktop\ASD-Bestellung Nebenmaterial.xlsx
2013-10-08 08:26 - 2013-10-23 13:24 - 00012302 _____ C:\Users\Marc\Desktop\ASD-Bestellung.xlsx
2013-10-07 12:48 - 2013-10-07 12:48 - 00000000 ____D C:\Users\Marc\AppData\Roaming\CodeTwo Sync for iCloud
2013-10-07 12:48 - 2013-10-07 12:48 - 00000000 ____D C:\ProgramData\CodeTwo
2013-10-07 12:46 - 2012-11-29 12:58 - 00000000 ____D C:\Users\Marc\AppData\Roaming\CodeTwo
2013-10-07 12:46 - 2012-11-29 12:58 - 00000000 ____D C:\Program Files\CodeTwo
2013-10-07 11:03 - 2010-08-28 16:18 - 00000000 ____D C:\Users\Marc\AppData\Roaming\Apple Computer
2013-10-07 11:03 - 2010-08-28 16:18 - 00000000 ____D C:\Users\Marc\AppData\Local\Apple Computer
2013-10-07 06:44 - 2010-08-28 16:16 - 00000000 ____D C:\Users\Marc\AppData\Local\Apple
Some content of TEMP:
====================
C:\Users\Marc\AppData\Local\temp\avgnt.exe
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-10-21 09:11
==================== End Of Log ============================
--- --- --- Und hier das Addition-Log: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 28-10-2013
Ran by Marc at 2013-10-28 18:06:49
Running from C:\Users\Marc\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
Update for Microsoft Office 2007 (KB2508958)
Adobe AIR (Version: 3.1.0.4880)
Adobe Flash Player 10 Plugin (Version: 10.0.32.18)
Adobe Flash Player 11 ActiveX (Version: 11.9.900.117)
Adobe Reader X (10.1.8) - Deutsch (Version: 10.1.8)
Adobe Shockwave Player 11.5 (Version: 11.5.1.601)
AMD USB Filter Driver (Version: 1.0.13.88)
Apple Application Support (Version: 2.3.6)
Apple Mobile Device Support (Version: 7.0.0.117)
Apple Software Update (Version: 2.1.3.127)
ATI Catalyst Install Manager (Version: 3.0.745.0)
AusweisApp (Version: 1.11.0)
AutoHotkey 1.0.48.05 (Version: 1.0.48.05)
Avira Free Antivirus (Version: 14.0.0.411)
Avira SearchFree Toolbar (Version: 12.6.0.1898)
Brother HL-2035 (Version: 1.00)
Bullzip PDF Printer 7.2.0.1319 (Version: 7.2.0.1319)
Cantor 2008.1 Prerequisites (Version: 2008.1.0000)
Cantor 2009.1 Prerequisites (Version: 9.1.0000)
Cantor 2011.1 Prerequisites (Version: 11.1.0000)
Cantor 2012.1 Prerequisites (Version: 12.1.0000)
Cantor Crystal Reports 10 Components (Version: 1.00.0000)
Cantor Crystal Reports 11.5 Components V2 (Version: 11.5.0000)
Catalyst Control Center Core Implementation (Version: 2009.0925.1707.28889)
Catalyst Control Center Graphics Full Existing (Version: 2009.0925.1707.28889)
Catalyst Control Center Graphics Full New (Version: 2009.0925.1707.28889)
Catalyst Control Center Graphics Light (Version: 2009.0925.1707.28889)
Catalyst Control Center Graphics Previews Vista (Version: 2009.0925.1707.28889)
Catalyst Control Center InstallProxy (Version: 2009.0925.1707.28889)
Catalyst Control Center Localization All (Version: 2009.0925.1707.28889)
CCC Help Danish (Version: 2009.0925.1706.28889)
CCC Help Dutch (Version: 2009.0925.1706.28889)
CCC Help English (Version: 2009.0925.1706.28889)
CCC Help Finnish (Version: 2009.0925.1706.28889)
CCC Help French (Version: 2009.0925.1706.28889)
CCC Help German (Version: 2009.0925.1706.28889)
CCC Help Italian (Version: 2009.0925.1706.28889)
CCC Help Japanese (Version: 2009.0925.1706.28889)
CCC Help Norwegian (Version: 2009.0925.1706.28889)
CCC Help Spanish (Version: 2009.0925.1706.28889)
CCC Help Swedish (Version: 2009.0925.1706.28889)
ccc-core-static (Version: 2009.0925.1707.28889)
ccc-utility (Version: 2009.0925.1707.28889)
CodeTwo Outlook Sync (Version: 1.0.13.2)
CodeTwo Sync for iCloud (Version: 1.3.2.2)
Compatibility Pack für 2007 Office System (Version: 12.0.6612.1000)
cyberJack Base Components (Version: 6.9.13)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition
Device Diagnosis Tool Build:
DHTML Editing Component (Version: 6.02.0001)
Driver Updater (Version: 1.1.0.0)
Druckerdeinstallation für EPSON S22 Series
Firebird SQL Server - MAGIX Edition (Version: 2.1.23.0)
Google Earth (Version: 7.1.1.1888)
Google Update Helper (Version: 1.3.21.165)
Hoffmann Handel (Version: 12.1.0000)
iCloud (Version: 3.0.2.163)
iTunes (Version: 11.1.1.11)
Java 7 Update 45 (Version: 7.0.450)
Java Auto Updater (Version: 2.1.9.8)
Malwarebytes Anti-Malware Version 1.75.0.1300 (Version: 1.75.0.1300)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6012.5000)
Microsoft Choice Guard (Version: 2.0.48.0)
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office 2010 Service Pack 1 (SP1)
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003)
Microsoft Office Home and Student 2007 (Version: 12.0.6612.1000)
Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1)
Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Outlook 2010 (Version: 14.0.6029.1000)
Microsoft Office Outlook MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office PowerPoint Viewer 2007 (German) (Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (Italian) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proofing (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Outlook 2010 (Version: 14.0.6029.1000)
Microsoft Search Enhancement Pack (Version: 1.3.59.0)
Microsoft Silverlight (Version: 5.1.20913.0)
Microsoft SQL Server 2005
Microsoft SQL Server 2005 Compact Edition [DEU] (Version: 3.1.0000)
Microsoft SQL Server 2005 Express Edition (CANTOR2005) (Version: 9.4.5000.00)
Microsoft SQL Server 2008 R2
Microsoft SQL Server 2008 R2 Native Client (Version: 10.50.1600.1)
Microsoft SQL Server 2008 R2 RsFx Driver (Version: 10.51.2500.0)
Microsoft SQL Server 2008 R2 Setup (English) (Version: 10.51.2500.0)
Microsoft SQL Server 2008 Setup Support Files (Version: 10.1.2731.0)
Microsoft SQL Server Browser (Version: 10.51.2500.0)
Microsoft SQL Server Native Client (Version: 9.00.5000.00)
Microsoft SQL Server VSS Writer (Version: 10.51.2500.0)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Works (Version: 9.7.0621)
MobileMe Control Panel (Version: 3.1.8.0)
MSVC80_x86_v2 (Version: 1.0.3.0)
MSVC90_x86 (Version: 1.0.1.2)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
OGA Notifier 2.0.0048.0 (Version: 2.0.0048.0)
Outlook Backup Assistant 4 (Testversion)
PDFCreator (Version: 1.2.0)
Realtek High Definition Audio Driver (Version: 6.0.1.5898)
RedMon - Redirection Port Monitor
ROMBIcalc 1.4
Schüco PlanSoft 3.1
Schueco U-Cal
Service Pack 1 für SQL Server 2008 R2 (KB2528583) (Version: 10.51.2500.0)
Spelling Dictionaries Support For Adobe Reader 9 (Version: 9.0.0)
SQL Server 2008 R2 SP1 Common Files (Version: 10.51.2500.0)
SQL Server 2008 R2 SP1 Database Engine Services (Version: 10.51.2500.0)
SQL Server 2008 R2 SP1 Database Engine Shared (Version: 10.51.2500.0)
Sql Server Customer Experience Improvement Program (Version: 10.50.1600.1)
StarMoney (Version: 2.0)
StarMoney (Version: 3.0.0.124)
StarMoney 8.0 (Version: 8.0)
T-Eumex 220PC (Version: 1.1.0.345)
Tools für Microsoft SQL Server 2005 Express Edition (Version: 9.4.5000.00)
Uninstall 1.0.0.1
Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch) (Version: 9.00.5000.00)
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (Version: 3)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2836939v3) (Version: 3)
Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553270) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition
Update for Microsoft Office 2010 (KB2566458)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition
Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition
Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition
Update for Microsoft Office 2010 (KB2687503) 32-Bit Edition
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition
Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition
Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition
Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition
Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition
Update for Microsoft Word 2010 (KB2827323) 32-Bit Edition
Update für Microsoft Office Excel 2007 Help (KB963678)
Update für Microsoft Office Powerpoint 2007 Help (KB963669)
Update für Microsoft Office Word 2007 Help (KB963665)
Update Manager (Version: 4.60)
Windows Live ID-Anmelde-Assistent (Version: 6.500.3146.0)
WinRAR
Wise Registry Cleaner 7.88 (Version: 7.88)
==================== Restore Points =========================
26-10-2013 13:48:48 Removed Java(TM) 6 Update 17
26-10-2013 13:50:22 Installed Java 7 Update 45
==================== Hosts content: ==========================
2009-07-14 03:04 - 2013-10-27 20:51 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
Task: {0BFF84D7-575C-4475-AB3D-64E936692E56} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2010-02-15] (Google Inc.)
Task: {0DCB052F-DD5B-45A8-9010-A92A6251F0A0} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-11] (Microsoft Corporation)
Task: {12C5A9EC-6DF6-4675-A006-84712AC0B0E5} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2010-02-15] (Google Inc.)
Task: {5F60B6A9-EEF3-4801-B163-8927FF204086} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-26] (Adobe Systems Incorporated)
Task: {8EF4046D-CB85-4B89-B66E-60D1167211C0} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {DBD4B5B4-6F9E-4181-B012-46292E1E8AB1} - System32\Tasks\GoogleUpdateTaskMachineCore1ce8124cd2f07e5 => C:\Program Files\Google\Update\GoogleUpdate.exe [2010-02-15] (Google Inc.)
Task: {DDC22512-50CF-4327-AE4F-F14E76CC72CF} - System32\Tasks\Apple Diagnostics => C:\Program Files\Common Files\Apple\Internet Services\EReporter.exe [2013-09-14] (Apple Inc.)
Task: {FA16513A-0C48-4FB9-9DC9-F3488F37D749} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1ce8124cd2f07e5.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2010-06-08 18:42 - 2010-03-15 10:28 - 00141824 _____ () C:\Program Files\WinRAR\rarext.dll
2011-03-16 23:11 - 2011-03-16 23:11 - 04297568 _____ () C:\Program Files\Common Files\Microsoft Shared\office14\Cultures\office.odf
2013-09-14 00:51 - 2013-09-14 00:51 - 00087952 _____ () C:\Program Files\Common Files\Apple\Internet Services\zlib1.dll
2013-09-14 00:50 - 2013-09-14 00:50 - 01242952 _____ () C:\Program Files\Common Files\Apple\Internet Services\libxml2.dll
2003-01-14 12:04 - 2003-01-14 12:04 - 00032768 _____ () C:\Program Files\Telekom\T-Eumex 220PC\cc_lang.dll
2003-08-27 13:14 - 2003-08-27 13:14 - 00077824 _____ () C:\Program Files\Telekom\T-Eumex 220PC\conf.dll
2009-11-05 17:23 - 2009-11-05 17:23 - 00270336 _____ () C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2010-01-05 09:57 - 2008-12-01 13:16 - 01048576 _____ () C:\Program Files\Outlook Backup Assistant\OBA_OutlookAddIn.dll
2010-12-21 00:15 - 2010-12-21 00:15 - 01041248 _____ () C:\Program Files\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll
2011-09-01 20:10 - 2011-09-01 20:10 - 00122720 _____ () C:\Program Files\Microsoft Office\Office14\OUTLCTL.DLL
2012-02-10 06:17 - 2012-09-06 16:15 - 00705152 _____ () C:\Program Files\HoffmannHandel\cversion\CaGrid.dll
2008-04-24 12:10 - 2001-07-27 17:24 - 00135168 _____ () C:\Program Files\HoffmannHandel\cversion\expat.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\ProgramData\Temp:CB0AACC9
==================== Safe Mode (whitelisted) ===================
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (10/28/2013 09:13:33 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Ungültige XML-Syntax.
Error: (10/27/2013 08:28:42 PM) (Source: Windows Backup) (User: )
Description: Die Sicherung wurde aufgrund eines Fehlers beim Schreiben am Sicherungsspeicherort "F:\" nicht abgeschlossen. Fehler: "Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)"
Error: (10/27/2013 03:22:07 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Ungültige XML-Syntax.
System errors:
=============
Error: (10/28/2013 08:06:43 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst StarMoney 8.0 OnlineUpdate erreicht.
Error: (10/28/2013 08:06:22 AM) (Source: BugCheck) (User: )
Description: 0x0000007a (0x00000020, 0xc000009d, 0x87668bdc, 0x00000000)C:\Windows\MEMORY.DMP102813-24320-01
Error: (10/28/2013 08:06:12 AM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am 28.10.2013 um 08:03:26 unerwartet heruntergefahren.
Error: (10/28/2013 08:01:10 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst StarMoney 8.0 OnlineUpdate erreicht.
Error: (10/28/2013 08:00:45 AM) (Source: BugCheck) (User: )
Description: 0x0000007a (0x00000020, 0xc000009d, 0x8804f594, 0x00000000)C:\Windows\MEMORY.DMP102813-23790-01
Error: (10/28/2013 08:00:36 AM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am 28.10.2013 um 07:57:41 unerwartet heruntergefahren.
Error: (10/28/2013 07:08:49 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Avira Echtzeit-Scanner" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden durchgeführt: Neustart des Diensts.
Error: (10/28/2013 07:08:49 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Avira Browser-Schutz" ist vom Dienst "Avira Echtzeit-Scanner" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%0
Error: (10/28/2013 07:08:49 AM) (Source: Service Control Manager) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen:
%%5
Error: (10/28/2013 07:08:49 AM) (Source: Service Control Manager) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen:
%%5
Microsoft Office Sessions:
=========================
Error: (04/13/2011 07:53:54 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 4152 seconds with 2460 seconds of active time. This session ended with a crash.
Error: (03/31/2011 01:19:06 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 4 seconds with 0 seconds of active time. This session ended with a crash.
==================== Memory info ===========================
Percentage of memory in use: 44%
Total physical RAM: 3326.3 MB
Available physical RAM: 1847.88 MB
Total Pagefile: 6650.9 MB
Available Pagefile: 4795.5 MB
Total Virtual: 2047.88 MB
Available Virtual: 1917.34 MB
==================== Drives ================================
Drive c: (Boot) (Fixed) (Total:575.07 GB) (Free:485.48 GB) NTFS
Drive d: (Recover) (Fixed) (Total:20 GB) (Free:13.09 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 596 GB) (Disk ID: 2BAB359D)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=575 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=20 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=1 GB) - (Type=12)
==================== End Of Log ============================
 |
|
29.10.2013, 09:42
| #20 |
| /// the machine /// TB-Ausbilder | Malwarebytes meldet Trojaner kbdusr32.exe Fertig  Die Reihenfolge ist hier entscheidend.
Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
30.10.2013, 12:55
| #21 |
| | Malwarebytes meldet Trojaner kbdusr32.exe Hallo schrauber, ich habe alles abgearbeitet und werde in Zukunft intensiv die Ratschläge befolgen. Es ist alles in Ordnung, das System läuft und es wird keine Meldung ausgegeben wonach etwas "drauf" ist was nicht hingehört. Schrauber: Abschließend meinen größten Dank speziell an Dich aber auch an die vielen anderen Helfer hier im Board, einen tollen Job macht Ihr!!!  |
|
31.10.2013, 08:21
| #22 |
| /// the machine /// TB-Ausbilder | Malwarebytes meldet Trojaner kbdusr32.exe Gern Geschehen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Malwarebytes meldet Trojaner kbdusr32.exe |
| aufsetzen, betrieb, cleaner, combofix, daten, folge, funktionieren, gefährliche, gelöscht, gestoppt, kleine, kunde, logfiles, malwarebytes, meldung, neu, problem, programme, registry, system, tan, trojaner, verlieren, virus, webseite, zugang |
Linear-Darstellung
