| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Windows 7: Bka-Interpol-Trojaner mit SperrschirmWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
08.11.2013, 11:57
| #1 |
| |  Windows 7: Bka-Interpol-Trojaner mit Sperrschirm Guten Tag, Leider habe ich mir auch so einen Interpol/Bka-Trojaner mit Sperrbildschirm eingefangen. Das betroffene Benutzerkonto ist durch den Sperrbildschirm nicht mehr benutzbar. Hier wird vom Trojaner versucht die Registry zu ändern (ausgehend von 4twl4...). Meinen laienhaften Einschätzung nach ist das auch der Trojaner. Ein anderes Benutzerkonto funktioniert jedoch einwandfrei. Hier habe ich die Scanner FRST und GMER durchlaufen lassen. Mit dem defogger habe ich demon tools abgeschaltet. Ich wäre sehr dankbar wenn ihr mir beim entfernen helfen könntet! Hier die Logfiles: FRST: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 31-10-2013
Ran by fhw21129046 (administrator) on FX-LAPTOP on 08-11-2013 10:59:37
Running from C:\Users\fhw21129046\Downloads
Microsoft Windows 7 Professional Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) ===================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Broadcom Corporation) C:\Program Files\Broadcom\Broadcom 802.11 Network Adapter\WLTRYSVC.EXE
(Broadcom Corporation) C:\Program Files\Broadcom\Broadcom 802.11 Network Adapter\bcmwltry.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Samsung) C:\Program Files\Samsung\AllShare Framework DMS\1.3.06\AllShareFrameworkManagerDMS.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Samsung) C:\Program Files\Samsung\AllShare Framework DMS\1.3.06\AllShareFrameworkDMS.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Atheros Commnucations) C:\Program Files\Bluetooth Suite\adminservice.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
(Deutsche Telekom AG) C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe
(Locktime Software) C:\Program Files\NetLimiter 3\nlsvc.exe
(Realtek) C:\Program Files\REALTEK Wireless LAN Software\RtlService.exe
(Realtek Semiconductor Corp.) C:\Program Files\REALTEK Wireless LAN Software\RtWlan.exe
(Microsoft Corporation) C:\Program Files\Microsoft\BingBar\SeaPort.EXE
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(TOSHIBA CORPORATION) C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\ipoint.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Samsung Electronics) C:\Program Files\Samsung\Samsung Update Plus\SUPBackground.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\ipoint.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Realtek Semiconductor Corp.) C:\Program Files\REALTEK Wireless LAN Software\RtWlan.exe
(Microsoft Corporation) C:\Windows\system32\wuauclt.exe
(Samsung Electronics) C:\Program Files\Samsung\Samsung Update Plus\SUPBackground.exe
(Opera Software) C:\Program Files\Opera\opera.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [IntelliPoint] - C:\Program Files\Microsoft IntelliPoint\ipoint.exe [1821576 2011-08-01] (Microsoft Corporation)
HKLM\...\Run: [Windows Mobile Device Center] - C:\Windows\WindowsMobile\wmdc.exe [648072 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [10082920 2011-05-18] (Realtek Semiconductor)
HKLM\...\Run: [TQ566808] - "D:\Setup.exe"
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-05] (Avira Operations GmbH & Co. KG)
Lsa: [Notification Packages] scecli C:\Program Files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll
Startup: C:\Users\fx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4twl4rjwl.lnk
ShortcutTarget: 4twl4rjwl.lnk -> C:\PROGRA~2\lwjr4lwt4.dss (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x92B3DF3661DCCE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
SearchScopes: HKLM - DefaultScope value is missing.
BHO: HistoryTriggerBHO Class - {21A88CB9-84D2-4020-A2D1-B25A21034884} - C:\Program Files\LG Electronics\LG PC Suite IV\LinkAir\LinkAirBrowserHelper.dll (LG Electronics)
BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Citavi Picker - {609D670F-B735-4da7-AC6D-F3BD358E325E} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 10 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Winsock: Catalog9 01 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 02 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 03 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 04 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 05 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 06 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 07 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 08 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 20 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
========================== Services (Whitelisted) =================
R2 AllShare Framework DMS; C:\Program Files\Samsung\AllShare Framework DMS\1.3.06\AllShareFrameworkManagerDMS.exe [406648 2012-10-23] (Samsung)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-05] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-05] (Avira Operations GmbH & Co. KG)
S3 c2wts; C:\Program Files\Windows Identity Foundation\v3.5\c2wtshost.exe [15768 2010-02-03] (Microsoft Corporation)
S4 Freemake Improver; C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [74752 2011-11-24] (Freemake)
S3 fussvc; C:\Program Files\Windows Kits\8.1\App Certification Kit\fussvc.exe [140800 2013-06-15] (Microsoft Corporation)
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 Netzmanager Service; C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe [2635776 2012-07-20] (Deutsche Telekom AG)
R2 nlsvc; C:\Program Files\NetLimiter 3\nlsvc.exe [1126400 2011-03-21] (Locktime Software)
S4 Radio.fx; C:\Program Files\Tobit Radio.fx\Server\rfx-server.exe [3673944 2011-11-18] ()
R2 Realtek9xp; C:\Program Files\REALTEK Wireless LAN Software\RtlService.exe [36864 2009-09-01] (Realtek)
S3 Te.Service; C:\Program Files\Windows Kits\8.1\Testing\Runtimes\TAEF\Wex.Services.exe [91136 2013-06-15] (Microsoft Corporation)
S3 VsEtwService120; C:\Program Files\Microsoft Visual Studio 12.0\Common7\Packages\Debugger\Services\VsEtwService.exe [74848 2013-06-16] (Microsoft Corporation)
R2 wltrysvc; C:\Program Files\Broadcom\Broadcom 802.11 Network Adapter\bcmwltry.exe [4261888 2010-07-07] (Broadcom Corporation)
==================== Drivers (Whitelisted) ====================
S3 Andbus; C:\Windows\System32\DRIVERS\lgandbus.sys [14336 2010-12-07] (LG Electronics Inc.)
S3 AndDiag; C:\Windows\System32\DRIVERS\lganddiag.sys [20736 2010-12-07] (LG Electronics Inc.)
S3 AndGps; C:\Windows\System32\DRIVERS\lgandgps.sys [20096 2010-12-07] (LG Electronics Inc.)
S3 ANDModem; C:\Windows\System32\DRIVERS\lgandmodem.sys [25088 2010-12-07] (LG Electronics Inc.)
R3 AthBTPort; C:\Windows\System32\DRIVERS\btath_flt.sys [35488 2011-03-31] (Atheros)
S3 ATHDFU; C:\Windows\System32\Drivers\AthDfu.sys [43680 2011-03-31] (Windows (R) Win 7 DDK provider)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [88840 2013-09-05] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136672 2013-09-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-08-21] (Avira Operations GmbH & Co. KG)
R3 BCM42RLY; C:\Windows\System32\drivers\BCM42RLY.sys [18496 2010-07-07] (Broadcom Corporation)
S3 BTATH_A2DP; C:\Windows\System32\drivers\btath_a2dp.sys [226976 2011-03-31] (Atheros)
S3 btath_avdt; C:\Windows\System32\drivers\btath_avdt.sys [97440 2011-03-31] (Atheros)
R3 BTATH_BUS; C:\Windows\System32\DRIVERS\btath_bus.sys [24736 2011-03-31] (Atheros)
R3 BTATH_HCRP; C:\Windows\System32\DRIVERS\btath_hcrp.sys [147104 2011-03-31] (Atheros)
R3 BTATH_LWFLT; C:\Windows\System32\DRIVERS\btath_lwflt.sys [52384 2011-03-31] (Atheros)
R3 BTATH_RCP; C:\Windows\System32\DRIVERS\btath_rcp.sys [266272 2011-03-31] (Atheros)
S3 BtFilter; C:\Windows\System32\DRIVERS\btfilter.sys [247968 2011-03-31] (Atheros)
R3 btwampfl; C:\Windows\system32\drivers\btwampfl.sys [522280 2012-03-13] (Broadcom Corporation.)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [232512 2011-10-18] (DT Soft Ltd)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
S3 MOSUMAC; C:\Windows\System32\DRIVERS\MOSUMAC.SYS [44032 2009-12-07] (--)
R3 NLNdisMP; C:\Windows\System32\DRIVERS\nlndis.sys [5230088 2011-03-21] (Locktime Software)
S3 NLNdisPT; C:\Windows\System32\DRIVERS\nlndis.sys [5230088 2011-03-21] (Locktime Software)
R1 nltdi; C:\Program Files\NetLimiter 3\nltdi.sys [5281672 2011-03-21] (Locktime Software)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [428088 2011-10-22] ()
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-08-21] (Avira GmbH)
S3 TelekomNM3; C:\Program Files\Netzmanager\NMInfraIS2\Driver\TelekomNM3.sys [35040 2010-09-16] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH)
U3 asc3monr; C:\Windows\System32\Drivers\asc3monr.sys [0 ] (Advanced Micro Devices)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-11-08 10:59 - 2013-11-08 10:59 - 00000701 _____ C:\Users\fhw21129046\Desktop\JRT.txt
2013-11-08 10:59 - 2013-11-08 10:59 - 00000000 ____D C:\FRST
2013-11-08 10:58 - 2013-11-08 10:58 - 01089445 _____ (Farbar) C:\Users\fhw21129046\Downloads\FRST.exe
2013-11-08 10:55 - 2013-11-08 10:55 - 00000000 ____D C:\Windows\ERUNT
2013-11-08 02:37 - 2013-11-08 02:37 - 00009765 _____ C:\Users\fhw21129046\Desktop\AdwCleaner[S0].txt
2013-11-08 02:31 - 2013-11-08 02:33 - 00000000 ____D C:\AdwCleaner
2013-11-08 02:29 - 2013-11-08 02:29 - 01034531 _____ (Thisisu) C:\Users\fhw21129046\Downloads\JRT.exe
2013-11-08 02:29 - 2013-11-08 02:29 - 00000000 ____D C:\Users\fhw21129046\AppData\Roaming\Malwarebytes
2013-11-08 02:28 - 2013-11-08 02:29 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\fhw21129046\Downloads\mbam-setup-1.75.0.1300.exe
2013-11-08 02:28 - 2013-11-08 02:28 - 01073262 _____ C:\Users\fhw21129046\Downloads\adwcleaner.exe
2013-11-08 02:28 - 2013-11-08 02:28 - 00000000 ____D C:\Users\fhw21129046\AppData\Roaming\Avira
2013-11-08 02:25 - 2013-11-08 02:25 - 00000000 ____D C:\Users\fhw21129046\AppData\Roaming\Opera
2013-11-08 02:25 - 2013-11-08 02:25 - 00000000 ____D C:\Users\fhw21129046\AppData\Local\Opera
2013-11-08 02:22 - 2013-11-08 02:22 - 00001421 _____ C:\Users\fhw21129046\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-11-08 02:22 - 2013-11-08 02:22 - 00000020 ___SH C:\Users\fhw21129046\ntuser.ini
2013-11-08 02:22 - 2013-11-08 02:22 - 00000000 _SHDL C:\Users\fhw21129046\Startmenü
2013-11-08 02:22 - 2013-11-08 02:22 - 00000000 _SHDL C:\Users\fhw21129046\Netzwerkumgebung
2013-11-08 02:22 - 2013-11-08 02:22 - 00000000 _SHDL C:\Users\fhw21129046\Druckumgebung
2013-11-08 02:22 - 2013-11-08 02:22 - 00000000 _SHDL C:\Users\fhw21129046\Documents\Eigene Musik
2013-11-08 02:22 - 2013-11-08 02:22 - 00000000 _SHDL C:\Users\fhw21129046\Documents\Eigene Bilder
2013-11-08 02:22 - 2013-11-08 02:22 - 00000000 _SHDL C:\Users\fhw21129046\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-11-08 02:22 - 2013-11-08 02:22 - 00000000 _SHDL C:\Users\fhw21129046\AppData\Local\Verlauf
2013-11-08 02:22 - 2013-11-08 02:22 - 00000000 ____D C:\Users\fhw21129046\AppData\Roaming\Adobe
2013-11-08 02:22 - 2013-11-08 02:22 - 00000000 ____D C:\Users\fhw21129046\AppData\Local\VirtualStore
2013-11-08 02:22 - 2013-11-08 02:22 - 00000000 ____D C:\Users\fhw21129046
2013-11-08 02:22 - 2013-05-01 01:57 - 00000000 ____D C:\Users\fhw21129046\Documents\Visual Studio 2010
2013-11-08 02:22 - 2011-11-10 03:02 - 00000000 ____D C:\Users\fhw21129046\AppData\Local\Microsoft Help
2013-11-08 02:22 - 2011-09-19 12:32 - 00000000 ____D C:\Users\fhw21129046\AppData\Roaming\Macromedia
2013-11-08 02:22 - 2009-07-14 05:42 - 00000000 ___RD C:\Users\fhw21129046\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-11-08 02:22 - 2009-07-14 05:37 - 00000000 ___RD C:\Users\fhw21129046\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2013-11-08 02:15 - 2013-11-08 02:16 - 00000000 ____D C:\Users\fx\Desktop\mbar
2013-11-08 02:15 - 2013-11-08 02:15 - 00075992 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-11-08 02:15 - 2013-11-08 02:15 - 00000000 ____D C:\Users\fx\AppData\Roaming\Malwarebytes
2013-11-08 02:15 - 2013-11-08 02:15 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-11-08 02:14 - 2013-11-08 02:29 - 00001067 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-11-08 02:14 - 2013-11-08 02:29 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-11-08 02:14 - 2013-11-08 02:14 - 12576792 _____ (Malwarebytes Corp.) C:\Users\fx\Desktop\mbar-1.07.0.1007.exe
2013-11-08 02:14 - 2013-11-08 02:14 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-08 02:14 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-11-08 02:13 - 2013-11-08 02:14 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\fx\Desktop\mbam-setup-1.75.0.1300.exe
2013-11-08 02:04 - 2013-11-08 02:04 - 00550371 _____ C:\Users\fx\Desktop\Autoruns.zip
2013-11-08 02:04 - 2013-11-08 02:04 - 00000000 ____D C:\Users\fx\Desktop\Autoruns
2013-11-08 02:00 - 2013-11-08 09:50 - 00000291 _____ C:\ProgramData\4twl4rjwl.reg
2013-11-08 01:51 - 2013-11-08 01:51 - 00227096 _____ C:\Users\fx\Desktop\avira_registry_cleaner_de.exe
2013-11-08 01:28 - 2013-11-08 10:55 - 95025368 ____T C:\ProgramData\4twl4rjwl.bxx
2013-11-08 01:28 - 2013-11-08 09:46 - 00000000 _____ C:\ProgramData\4twl4rjwl.fvv
2013-11-08 01:28 - 2013-11-08 01:28 - 00139264 _____ (Microsoft Corporation) C:\ProgramData\lwjr4lwt4.dss
2013-11-03 19:20 - 2013-11-03 19:20 - 00000000 ____D C:\Users\fx\Documents\routersicherung ED
2013-10-29 13:23 - 2013-10-29 13:23 - 00000000 ____D C:\ProgramData\Gibraltar
2013-10-29 13:22 - 2013-10-29 13:22 - 00000000 ____D C:\Users\fx\AppData\Local\Swiss Academic Software
2013-10-29 13:21 - 2013-11-05 14:36 - 00000000 ____D C:\Users\fx\Documents\Citavi 4
2013-10-29 13:21 - 2013-10-29 13:23 - 00000000 ____D C:\Users\fx\AppData\Roaming\Swiss Academic Software
2013-10-29 13:15 - 2013-10-29 13:15 - 00001919 _____ C:\Users\Public\Desktop\Citavi 4.lnk
2013-10-29 13:15 - 2013-10-29 13:15 - 00000000 ____D C:\ProgramData\Swiss Academic Software
2013-10-29 13:14 - 2013-10-29 13:15 - 00000000 ____D C:\Program Files\Citavi 4
2013-10-29 13:10 - 2013-10-29 13:11 - 86228344 _____ (Swiss Academic Software) C:\Users\fx\Desktop\Citavi4Setup.exe
2013-10-25 16:36 - 2013-09-04 02:15 - 00258560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2013-10-25 16:36 - 2013-09-04 02:14 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2013-10-25 16:36 - 2013-09-04 02:14 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2013-10-25 16:36 - 2013-09-04 02:14 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2013-10-25 16:36 - 2013-09-04 02:14 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2013-10-25 16:36 - 2013-09-04 02:14 - 00020480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2013-10-25 16:36 - 2013-09-04 02:14 - 00006016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2013-10-22 09:54 - 2013-10-22 09:54 - 00000000 ____D C:\Users\fx\Desktop\Neuer Ordner
2013-10-14 21:00 - 2013-10-14 21:00 - 100975419 _____ C:\Windows\system32\䊚꒨b
2013-10-14 09:00 - 2013-11-08 09:43 - 00006142 _____ C:\Windows\PFRO.log
2013-10-11 02:02 - 2013-09-23 00:27 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-10-11 02:02 - 2013-09-21 04:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-10-11 02:01 - 2013-09-23 00:28 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-10-11 02:01 - 2013-09-23 00:28 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-10-11 02:01 - 2013-09-23 00:28 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-10-11 02:01 - 2013-09-23 00:27 - 14335488 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-10-11 02:01 - 2013-09-23 00:27 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-10-11 02:01 - 2013-09-23 00:27 - 02876928 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-10-11 02:01 - 2013-09-23 00:27 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-10-11 02:01 - 2013-09-23 00:27 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-10-11 02:01 - 2013-09-23 00:27 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-10-11 02:01 - 2013-09-23 00:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-10-11 02:01 - 2013-09-23 00:27 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-10-11 02:01 - 2013-09-23 00:27 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-10-11 02:01 - 2013-09-23 00:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-10-11 02:01 - 2013-09-21 03:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-10-11 01:05 - 2013-09-14 01:48 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-10-11 01:05 - 2013-09-08 03:07 - 01294272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-10-11 01:05 - 2013-09-08 03:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2013-10-11 01:05 - 2013-08-29 02:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2013-10-11 01:05 - 2013-08-29 02:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-10-11 01:05 - 2013-08-29 02:50 - 01289096 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-10-11 01:05 - 2013-08-29 02:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2013-10-11 01:05 - 2013-08-29 02:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2013-10-11 01:05 - 2013-08-28 02:04 - 02348544 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-10-11 01:05 - 2013-08-28 01:57 - 00434688 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll
2013-10-11 01:05 - 2013-08-01 12:03 - 00729024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-10-11 01:05 - 2013-07-20 11:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-11 01:05 - 2013-07-12 11:08 - 00146816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys
2013-10-11 01:05 - 2013-07-12 11:07 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
2013-10-11 01:05 - 2013-07-04 12:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2013-10-11 01:05 - 2013-07-04 12:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2013-10-11 01:05 - 2013-07-04 12:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2013-10-11 01:05 - 2013-07-04 10:48 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2013-10-11 01:05 - 2013-07-03 05:02 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys
2013-10-11 01:05 - 2013-07-03 04:36 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2013-10-11 01:05 - 2013-07-03 04:36 - 00025728 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2013-10-11 01:05 - 2013-06-25 23:56 - 00527064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2013-10-11 01:05 - 2013-06-06 05:52 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2013-10-11 01:05 - 2013-06-06 05:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2013-10-11 01:05 - 2013-06-06 05:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2013-10-11 01:05 - 2013-06-06 04:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-10-11 01:05 - 2013-06-06 04:01 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2013-10-10 00:31 - 2013-11-08 10:36 - 00001098 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-10-10 00:31 - 2013-11-08 09:50 - 00001094 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-10-09 09:39 - 2013-10-09 09:39 - 01829093 _____ C:\Users\fx\Desktop\ISOcoated_v2_300_eci.icc
==================== One Month Modified Files and Folders =======
2013-11-08 10:59 - 2013-11-08 10:59 - 00000701 _____ C:\Users\fhw21129046\Desktop\JRT.txt
2013-11-08 10:59 - 2013-11-08 10:59 - 00000000 ____D C:\FRST
2013-11-08 10:58 - 2013-11-08 10:58 - 01089445 _____ (Farbar) C:\Users\fhw21129046\Downloads\FRST.exe
2013-11-08 10:55 - 2013-11-08 10:55 - 00000000 ____D C:\Windows\ERUNT
2013-11-08 10:55 - 2013-11-08 01:28 - 95025368 ____T C:\ProgramData\4twl4rjwl.bxx
2013-11-08 10:54 - 2011-09-14 16:53 - 01264069 _____ C:\Windows\WindowsUpdate.log
2013-11-08 10:36 - 2013-10-10 00:31 - 00001098 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-08 09:52 - 2009-07-14 05:34 - 00019808 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-08 09:52 - 2009-07-14 05:34 - 00019808 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-08 09:50 - 2013-11-08 02:00 - 00000291 _____ C:\ProgramData\4twl4rjwl.reg
2013-11-08 09:50 - 2013-10-10 00:31 - 00001094 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-08 09:49 - 2011-09-14 17:05 - 01629212 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-08 09:46 - 2013-11-08 01:28 - 00000000 _____ C:\ProgramData\4twl4rjwl.fvv
2013-11-08 09:44 - 2013-08-24 10:15 - 00005320 _____ C:\Windows\setupact.log
2013-11-08 09:44 - 2009-07-14 05:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-08 09:43 - 2013-10-14 09:00 - 00006142 _____ C:\Windows\PFRO.log
2013-11-08 09:42 - 2013-01-06 13:31 - 00000000 ____D C:\Program Files\FREE Word and Excel password recovery Wizard
2013-11-08 09:42 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\Resources
2013-11-08 02:37 - 2013-11-08 02:37 - 00009765 _____ C:\Users\fhw21129046\Desktop\AdwCleaner[S0].txt
2013-11-08 02:33 - 2013-11-08 02:31 - 00000000 ____D C:\AdwCleaner
2013-11-08 02:29 - 2013-11-08 02:29 - 01034531 _____ (Thisisu) C:\Users\fhw21129046\Downloads\JRT.exe
2013-11-08 02:29 - 2013-11-08 02:29 - 00000000 ____D C:\Users\fhw21129046\AppData\Roaming\Malwarebytes
2013-11-08 02:29 - 2013-11-08 02:28 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\fhw21129046\Downloads\mbam-setup-1.75.0.1300.exe
2013-11-08 02:29 - 2013-11-08 02:14 - 00001067 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-11-08 02:29 - 2013-11-08 02:14 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-11-08 02:28 - 2013-11-08 02:28 - 01073262 _____ C:\Users\fhw21129046\Downloads\adwcleaner.exe
2013-11-08 02:28 - 2013-11-08 02:28 - 00000000 ____D C:\Users\fhw21129046\AppData\Roaming\Avira
2013-11-08 02:25 - 2013-11-08 02:25 - 00000000 ____D C:\Users\fhw21129046\AppData\Roaming\Opera
2013-11-08 02:25 - 2013-11-08 02:25 - 00000000 ____D C:\Users\fhw21129046\AppData\Local\Opera
2013-11-08 02:22 - 2013-11-08 02:22 - 00001421 _____ C:\Users\fhw21129046\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-11-08 02:22 - 2013-11-08 02:22 - 00000020 ___SH C:\Users\fhw21129046\ntuser.ini
2013-11-08 02:22 - 2013-11-08 02:22 - 00000000 _SHDL C:\Users\fhw21129046\Startmenü
2013-11-08 02:22 - 2013-11-08 02:22 - 00000000 _SHDL C:\Users\fhw21129046\Netzwerkumgebung
2013-11-08 02:22 - 2013-11-08 02:22 - 00000000 _SHDL C:\Users\fhw21129046\Druckumgebung
2013-11-08 02:22 - 2013-11-08 02:22 - 00000000 _SHDL C:\Users\fhw21129046\Documents\Eigene Musik
2013-11-08 02:22 - 2013-11-08 02:22 - 00000000 _SHDL C:\Users\fhw21129046\Documents\Eigene Bilder
2013-11-08 02:22 - 2013-11-08 02:22 - 00000000 _SHDL C:\Users\fhw21129046\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-11-08 02:22 - 2013-11-08 02:22 - 00000000 _SHDL C:\Users\fhw21129046\AppData\Local\Verlauf
2013-11-08 02:22 - 2013-11-08 02:22 - 00000000 ____D C:\Users\fhw21129046\AppData\Roaming\Adobe
2013-11-08 02:22 - 2013-11-08 02:22 - 00000000 ____D C:\Users\fhw21129046\AppData\Local\VirtualStore
2013-11-08 02:22 - 2013-11-08 02:22 - 00000000 ____D C:\Users\fhw21129046
2013-11-08 02:16 - 2013-11-08 02:15 - 00000000 ____D C:\Users\fx\Desktop\mbar
2013-11-08 02:15 - 2013-11-08 02:15 - 00075992 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-11-08 02:15 - 2013-11-08 02:15 - 00000000 ____D C:\Users\fx\AppData\Roaming\Malwarebytes
2013-11-08 02:15 - 2013-11-08 02:15 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-11-08 02:14 - 2013-11-08 02:14 - 12576792 _____ (Malwarebytes Corp.) C:\Users\fx\Desktop\mbar-1.07.0.1007.exe
2013-11-08 02:14 - 2013-11-08 02:14 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-08 02:14 - 2013-11-08 02:13 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\fx\Desktop\mbam-setup-1.75.0.1300.exe
2013-11-08 02:04 - 2013-11-08 02:04 - 00550371 _____ C:\Users\fx\Desktop\Autoruns.zip
2013-11-08 02:04 - 2013-11-08 02:04 - 00000000 ____D C:\Users\fx\Desktop\Autoruns
2013-11-08 02:02 - 2012-03-18 20:16 - 00000000 ____D C:\Users\fx\AppData\Local\CrashDumps
2013-11-08 01:51 - 2013-11-08 01:51 - 00227096 _____ C:\Users\fx\Desktop\avira_registry_cleaner_de.exe
2013-11-08 01:28 - 2013-11-08 01:28 - 00139264 _____ (Microsoft Corporation) C:\ProgramData\lwjr4lwt4.dss
2013-11-08 00:16 - 2011-09-28 15:46 - 00000000 ____D C:\Users\fx\AppData\Local\PMB Files
2013-11-08 00:16 - 2011-09-28 15:46 - 00000000 ____D C:\ProgramData\PMB Files
2013-11-05 14:36 - 2013-10-29 13:21 - 00000000 ____D C:\Users\fx\Documents\Citavi 4
2013-11-04 12:34 - 2012-05-13 08:06 - 00000000 ____D C:\Users\fx\AppData\Roaming\Skype
2013-11-03 19:20 - 2013-11-03 19:20 - 00000000 ____D C:\Users\fx\Documents\routersicherung ED
2013-10-31 10:15 - 2011-10-10 16:05 - 00000000 ____D C:\Users\fx\Documents\Bewerbung
2013-10-29 13:23 - 2013-10-29 13:23 - 00000000 ____D C:\ProgramData\Gibraltar
2013-10-29 13:23 - 2013-10-29 13:21 - 00000000 ____D C:\Users\fx\AppData\Roaming\Swiss Academic Software
2013-10-29 13:22 - 2013-10-29 13:22 - 00000000 ____D C:\Users\fx\AppData\Local\Swiss Academic Software
2013-10-29 13:15 - 2013-10-29 13:15 - 00001919 _____ C:\Users\Public\Desktop\Citavi 4.lnk
2013-10-29 13:15 - 2013-10-29 13:15 - 00000000 ____D C:\ProgramData\Swiss Academic Software
2013-10-29 13:15 - 2013-10-29 13:14 - 00000000 ____D C:\Program Files\Citavi 4
2013-10-29 13:11 - 2013-10-29 13:10 - 86228344 _____ (Swiss Academic Software) C:\Users\fx\Desktop\Citavi4Setup.exe
2013-10-29 13:11 - 2012-01-08 22:58 - 00000000 ____D C:\Users\fx\AppData\Local\Downloaded Installations
2013-10-27 14:24 - 2013-03-23 14:55 - 00000000 ____D C:\Users\fx\AppData\Roaming\vlc
2013-10-22 09:54 - 2013-10-22 09:54 - 00000000 ____D C:\Users\fx\Desktop\Neuer Ordner
2013-10-20 17:11 - 2013-04-27 07:45 - 00000000 ____D C:\Users\fx\Documents\vba
2013-10-19 13:56 - 2012-01-04 20:56 - 00000000 ____D C:\Program Files\Altitude
2013-10-19 02:27 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-10-19 02:20 - 2011-11-09 17:44 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-10-19 02:07 - 2009-07-14 03:04 - 00000478 _____ C:\Windows\win.ini
2013-10-19 02:05 - 2011-10-12 02:01 - 00000000 ____D C:\Program Files\Microsoft.NET
2013-10-18 23:34 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\system32\wfp
2013-10-18 23:34 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\AppCompat
2013-10-18 23:33 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\registration
2013-10-18 23:30 - 2011-11-09 17:44 - 00000000 ____D C:\Program Files\Microsoft Office
2013-10-18 13:47 - 2011-09-14 17:02 - 00000000 ____D C:\Users\fx
2013-10-14 21:00 - 2013-10-14 21:00 - 100975419 _____ C:\Windows\system32\䊚꒨b
2013-10-14 09:17 - 2011-09-14 18:00 - 00118520 _____ C:\Users\fx\AppData\Local\GDIPFONTCACHEV1.DAT
2013-10-14 09:00 - 2009-07-14 05:33 - 03976960 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-14 08:55 - 2009-07-14 03:37 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2013-10-14 08:54 - 2009-07-14 08:48 - 00000000 ____D C:\Windows\ShellNew
2013-10-14 08:48 - 2013-10-02 16:19 - 00000000 ____D C:\Program Files\Common Files\DESIGNER
2013-10-11 03:17 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\rescache
2013-10-11 02:27 - 2011-09-17 17:04 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-10-11 02:25 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\system32\de-DE
2013-10-11 02:07 - 2013-07-15 02:00 - 00000000 ____D C:\Windows\system32\MRT
2013-10-11 02:04 - 2011-09-28 10:15 - 78106760 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-10-10 12:22 - 2013-10-08 13:09 - 00016129 _____ C:\Users\fx\Desktop\Internet 2013_14.xlsx
2013-10-09 09:39 - 2013-10-09 09:39 - 01829093 _____ C:\Users\fx\Desktop\ISOcoated_v2_300_eci.icc
Files to move or delete:
====================
C:\ProgramData\4twl4rjwl.reg
C:\ProgramData\lwjr4lwt4.dss
C:\ProgramData\PKP_DLdu.DAT
C:\ProgramData\PKP_DLes.DAT
C:\ProgramData\PKP_DLet.DAT
C:\ProgramData\PKP_DLev.DAT
Some content of TEMP:
====================
C:\Users\fhw21129046\AppData\Local\Temp\Quarantine.exe
C:\Users\fx\AppData\Local\Temp\ose00000.exe
C:\Users\fx\AppData\Local\Temp\SkypeSetup.exe
C:\Users\fx\AppData\Local\Temp\~tmf1368690987199825631.dll
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-10-31 00:37
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 31-10-2013
Ran by fhw21129046 at 2013-11-08 11:00:50
Running from C:\Users\fhw21129046\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
Tools for .Net 3.5 - DEU Lang Pack (Version: 3.11.50727)
Tools for .Net 3.5 (Version: 3.11.50727)
Update for Microsoft Office 2007 (KB2508958)
Adobe AIR (Version: 2.7.1.19610)
Adobe Community Help (Version: 3.4.980)
Adobe Content Viewer (Version: 1.4.0)
Adobe Download Assistant (Version: 1.0.4)
Adobe Flash Player 10 ActiveX (Version: 10.3.183.7)
Adobe Flash Player 11 Plugin (Version: 11.6.602.180)
Adobe Illustrator CS5.1 (Version: 15.1)
Adobe InDesign CS5.5 (Version: 7.5)
Adobe Photoshop CS5.1 (Version: 12.1)
Adobe Reader X (10.1.7) - Deutsch (Version: 10.1.7)
Advanced PDF Password Recovery (Version: 5.4.48.423)
AllShare Framework DMS (Version: 1.3.06)
AllShare Play 1.3.0.1211061557 (Version: 1.3.0.1211061557)
Altitude (Version: )
ANNO 2070 (Version: 1.0.0.0)
Apple Application Support (Version: 2.1.9)
Apple Mobile Device Support (Version: 5.2.0.6)
Apple Software Update (Version: 2.1.3.127)
Atheros Client Installation Program (Version: 9.0)
Audacity 2.0.3 (Version: 2.0.3)
Avira Free Antivirus (Version: 13.0.0.4052)
Bing Bar (Version: 7.0.619.0)
Blend for Visual Studio 2013 Preview (Version: 12.0.40612.10)
Blend for Visual Studio 2013 Preview DEU resources (Version: 12.0.40612.10)
Blend for Visual Studio SDK for .NET 4.5 (Version: 3.0.40218.0)
Blend for Visual Studio SDK for Silverlight 5 (Version: 3.0.40218.0)
Bluetooth Stack for Windows by Toshiba (Version: v6.00.05)
Bluetooth Win7 Suite (Version: 7.3.0.95)
Bonjour (Version: 3.0.0.10)
Broadcom Wireless Utility (Version: 5.60.48.55)
Build Tools - x86 (Version: 12.0.20617)
Buildtools-Sprachressourcen - x86 (Version: 12.0.20617)
CCleaner (Version: 3.22)
Cisco EAP-FAST Module (Version: 2.2.14)
Cisco LEAP Module (Version: 1.0.19)
Cisco PEAP Module (Version: 1.1.6)
Citavi 4 (Version: 4.2.0.11)
Colossus Addon Mod 1.0 (Version: 1.0)
Command & Conquer Alarmstufe Rot 2
Command && Conquer Alarmstufe Rot 2 - Yuris Rache
Company of Heroes - FAKEMSI (Version: 2.0.0.0)
Company of Heroes - Opposing Fronts (Version: 2.0.0.0)
D3DX10 (Version: 15.4.2368.0902)
DAEMON Tools Lite (Version: 4.41.3.0173)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition
Definition Update for Microsoft Office 2013 (KB2760587) 32-Bit Edition
Devenv-Ressourcen für Microsoft Visual Studio 2013 Preview (Version: 12.0.20617)
Dotfuscator and Analytics Community Edition (Version: 5.5.4798.36142)
Dotfuscator and Analytics Community Edition Language Pack (Version: 5.5.4798.36142)
ElsterFormular (Version: 13.2.0.8623)
Entity Framework Tools for Visual Studio 2013 Preview (Version: 12.0.20515.0)
Erforderliche Komponenten für SSDT (Version: 11.1.3000.0)
Foto-Mosaik-Edda Standard V6.6.12082.1
Free 3GP Video Converter version 5.0.7.403 (Version: 5.0.7.403)
Free Audio CD to MP3 Converter version 1.3.12.1228 (Version: 1.3.12.1228)
Free AVI Video Converter version 5.0.9.412 (Version: 5.0.9.412)
FREE Word and Excel password recovery Wizard version 2.1.12 (Version: 2.1.12)
Free YouTube Download version 3.0.18.1123
Free YouTube to MP3 Converter version 3.11.34.1015 (Version: 3.11.34.1015)
Freemake Video Converter Version 2.4.0 (Version: 2.4.0)
Freeware PDF Unlocker (Version: 1.0.4)
Gemeinsam genutzte Internet-Komponenten von Westwood
GIMP 2.6.11 (Version: 2.6.11)
Google Chrome (Version: 30.0.1599.101)
Google Update Helper (Version: 1.3.21.165)
GPL Ghostscript (Version: 9.04)
GSview 4.9
IBM SPSS Statistics 20 (Version: 20.0.0.0)
IIS 8.0 Express (Version: 8.0.1557)
IIS Express Application Compatibility Database for x86
ImgBurn (Version: 2.5.6.0)
Inkscape 0.48.2 (Version: 0.48.2)
Inkscape Multiple Pages Support
Intel(R) Rapid Storage Technology (Version: 9.6.3.1001)
iTunes (Version: 10.6.3.25)
Java Auto Updater (Version: 2.0.6.1)
Java(TM) 6 Update 30 (Version: 6.0.300)
JavaScript Tooling (Version: 12.0.20617)
JDownloader 0.9 (Version: 0.9)
Junk Mail filter update (Version: 15.4.3502.0922)
kikin Plugin (NO23 Edition) 1.11 (Version: 1.11)
League of Legends (Version: 3.0.1)
Left 4 Dead 2
LG Bluetooth Drivers (Version: 1.1)
LG PC Suite IV (Version: 4.3.46.20111117)
LG United Mobile Driver (Version: 3.6.0.0)
LocalESPC Dev12 (Version: 8.100.9431)
LocalESPCui for de-de Dev12 (Version: 8.100.9431)
Malwarebytes Anti-Malware Version 1.75.0.1300 (Version: 1.75.0.1300)
Marvell Miniport Driver (Version: 11.29.4.3)
Mesh Runtime (Version: 15.4.5722.2)
Messenger Companion (Version: 15.4.3502.0922)
Microsoft .NET Framework 4 Multi-Targeting Pack (Version: 4.0.30319)
Microsoft .NET Framework 4.5 Multi-Targeting Pack (Version: 4.5.50710)
Microsoft .NET Framework 4.5 SDK - DEU Lang Pack (Version: 4.5.50710)
Microsoft .NET Framework 4.5 SDK (Version: 4.5.50710)
Microsoft .NET Framework 4.5.1 Preview (DEU) (Version: 4.5.50743)
Microsoft .NET Framework 4.5.1 Preview (Deutsch) (Version: 4.5.50743)
Microsoft .NET Framework 4.5.1 Preview (Version: 4.5.50743)
Microsoft .NET Framework 4.5.1 Preview Multi-Targeting Pack (Version: 4.5.50741)
Microsoft .NET Framework 4.5.1 Preview Multi-Targeting Pack for Windows Store Apps (ENU) (Version: 4.5.20617)
Microsoft .NET Framework 4.5.1 Preview Multi-Targeting Pack for Windows Store Apps (Version: 4.5.20617)
Microsoft .NET Framework 4.5.1 Preview SDK (Version: 4.5.50760)
Microsoft .NET Framework 4.5.1 Preview-SDK (Deutsch) (Version: 4.5.50760)
Microsoft Access 2010 (Version: 14.0.6029.1000)
Microsoft Access MUI (German) 2013 (Version: 15.0.4420.1017)
Microsoft Advertising SDK for Windows 8.1 - ENU (Version: 8.1.30418.0)
Microsoft Advertising Service Extension for Visual Studio (Version: 1.0.30402.0)
Microsoft Application Error Reporting (Version: 12.0.6012.5000)
Microsoft ASP.NET MVC 4 - Visual Studio 2013 Preview - DEU (Version: 4.1.20530.0)
Microsoft ASP.NET MVC 4 - Visual Studio 2013 Preview - ENU (Version: 4.1.20530.0)
Microsoft ASP.NET MVC 4 Runtime - DEU (Version: 4.0.20710.0)
Microsoft ASP.NET MVC 4 Runtime (Version: 4.0.20710.0)
Microsoft ASP.NET Web Frameworks and Tools - Visual Studio 2013 Preview - DEU (Version: 5.0.10530.0)
Microsoft ASP.NET Web Frameworks and Tools - Visual Studio 2013 Preview - ENU (Version: 5.0.10530.0)
Microsoft ASP.NET Web Pages 2 - Visual Studio 2013 Preview - DEU (Version: 4.1.20530.0)
Microsoft ASP.NET Web Pages 2 - Visual Studio 2013 Preview - ENU (Version: 4.1.20530.0)
Microsoft ASP.NET Web Pages 2 Runtime - DEU (Version: 2.0.20710.0)
Microsoft ASP.NET Web Pages 2 Runtime (Version: 2.0.20715.0)
Microsoft C++ Azure Mobile SDK for Visual Studio 2013 Preview (Version: 1.0)
Microsoft C++ REST SDK for Visual Studio 2013 Preview (Version: 1.0)
Microsoft DCF MUI (German) 2013 (Version: 15.0.4420.1017)
Microsoft Excel MUI (German) 2013 (Version: 15.0.4420.1017)
Microsoft Exchange Web Services Managed API 2.0 (Version: 15.0.516.14)
Microsoft Expression Blend SDK for .NET 4 (Version: 2.0.20621.0)
Microsoft Groove MUI (German) 2013 (Version: 15.0.4420.1017)
Microsoft Help Viewer 1.0 (Version: 1.0.30319)
Microsoft Help Viewer 2.1 (Version: 2.1.20617)
Microsoft Help Viewer 2.1 Language Pack - DEU (Version: 2.0.20617)
Microsoft Identity Extensions (Version: 2.0.1459.0)
Microsoft InfoPath MUI (German) 2013 (Version: 15.0.4420.1017)
Microsoft IntelliPoint 8.2 (Version: 8.20.468.0)
Microsoft LightSwitch for Visual Studio 2013 Preview Core (Version: 12.0.20617)
Microsoft LightSwitch for Visual Studio 2013 Preview v4.0 Tools (Version: 12.0.20617)
Microsoft LightSwitch for Visual Studio 2013 Preview v4.0 ToolsRes - DEU (Version: 12.0.20617)
Microsoft LightSwitch für Visual Studio 2013 Preview CoreRes - DEU (Version: 12.0.20617)
Microsoft LightSwitch v4.0 SDK (Version: 12.0.20617)
Microsoft Lync MUI (German) 2013 (Version: 15.0.4420.1017)
Microsoft NuGet - Visual Studio 2013 Preview (Version: 2.6.40529.71)
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office 2010 Service Pack 1 (SP1)
Microsoft Office 2013 Developer Tools for Microsoft Visual Studio (x86) (Version: 12.0.20617)
Microsoft Office 2013 Developer Tools für Microsoft Visual Studio (x86) - DEU Language Pack (Version: 12.0.20617)
Microsoft Office Access 2010 (Version: 14.0.6029.1000)
Microsoft Office Access MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Excel 2007 (Version: 12.0.6612.1000)
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Korrekturhilfen 2013 - Deutsch (Version: 15.0.4420.1017)
Microsoft Office OSM MUI (German) 2013 (Version: 15.0.4420.1017)
Microsoft Office OSM UX MUI (German) 2013 (Version: 15.0.4420.1017)
Microsoft Office Outlook Connector (Version: 14.0.5118.5000)
Microsoft Office PowerPoint 2007 (Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Professional Plus 2013 (Version: 15.0.4420.1017)
Microsoft Office Project MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Project Professional 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (Italian) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proofing (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proofing (German) 2013 (Version: 15.0.4420.1017)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Proofing Tools 2013 - English (Version: 15.0.4420.1017)
Microsoft Office Proofing Tools 2013 - Italiano (Version: 15.0.4420.1017)
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Shared MUI (German) 2013 (Version: 15.0.4420.1017)
Microsoft Office Word 2007 (Version: 12.0.6612.1000)
Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft OneNote MUI (German) 2013 (Version: 15.0.4420.1017)
Microsoft Outlook MUI (German) 2013 (Version: 15.0.4420.1017)
Microsoft Portable Library Multi-Targeting Pack (Version: 12.0.20617.01)
Microsoft Portable Library Multi-Targeting Pack Language Pack - deu (Version: 12.0.20617.01)
Microsoft PowerPoint MUI (German) 2013 (Version: 15.0.4420.1017)
Microsoft Project 2010 Service Pack 1 (SP1)
Microsoft Project Professional 2010 (Version: 14.0.6029.1000)
Microsoft Publisher MUI (German) 2013 (Version: 15.0.4420.1017)
Microsoft Report Viewer Add-On for Visual Studio 2013 Preview (Version: 11.1.3360.24)
Microsoft Report Viewer-Add-On für Visual Studio 2013 Preview (Version: 11.1.3360.24)
Microsoft SharePoint 2013 Developer Tools for Visual Studio (Version: 12.0.20617)
Microsoft SharePoint 2013 Developer Tools for Visual Studio 2012 Nuget Package (Version: 12.0.20617)
Microsoft SharePoint 2013 Developer Tools für Visual Studio DEU Language Pack (Version: 12.0.20617)
Microsoft Silverlight (Version: 5.1.20913.0)
Microsoft Silverlight 5 SDK - DEU (Version: 5.0.61118.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000)
Microsoft SQL Server 2008 R2 Management Objects (Version: 10.50.1447.4)
Microsoft SQL Server 2012 Command Line Utilities (Version: 11.1.3000.0)
Microsoft SQL Server 2012 Data-Tier App Framework (Version: 11.1.2856.0)
Microsoft SQL Server 2012 Express LocalDB (Version: 11.1.3000.0)
Microsoft SQL Server 2012 Management Objects (Version: 11.1.3000.0)
Microsoft SQL Server 2012 Native Client (Version: 11.1.3000.0)
Microsoft SQL Server 2012 Transact-SQL Compiler Service (Version: 11.1.3000.0)
Microsoft SQL Server 2012 Transact-SQL ScriptDom (Version: 11.1.3000.0)
Microsoft SQL Server 2012 T-SQL-Sprachdienst (Version: 11.1.3000.0)
Microsoft SQL Server Compact 4.0 SP1 DEU (Version: 4.0.8876.1)
Microsoft SQL Server Data Tools - DEU (12.0.30529.0) (Version: 12.0.30529.0)
Microsoft SQL Server Data Tools Build Utilities - DEU (12.0.30529.0) (Version: 12.0.30529.0)
Microsoft SQL Server System CLR Types (Version: 10.50.1600.1)
Microsoft Team Foundation Server 2013 Preview Object Model (x86) (Version: 12.0.20617)
Microsoft Team Foundation Server 2013 Preview-Objektmodell Language Pack (x86) - DEU (Version: 12.0.20617)
Microsoft Visual C++ ARM Libraries (Version: 12.0.20617)
Microsoft Visual C++ x64 Libraries (Version: 12.0.20617)
Microsoft Visual C++ x86 Libraries (Version: 12.0.20617)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010 x86 Runtime - 10.0.30319 (Version: 10.0.30319)
Microsoft Visual C++ 2012 32bit Compilers - DEU Resources (Version: 11.0.60315)
Microsoft Visual C++ 2012 Compilers - DEU Resources (Version: 11.0.60315)
Microsoft Visual C++ 2012 Compilers (Version: 11.0.60315)
Microsoft Visual C++ 2012 Core Libraries (Version: 11.0.51106)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 (Version: 11.0.51106.1)
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.51106 (Version: 11.0.51106)
Microsoft Visual C++ 2012 x86 Debug Runtime - 11.0.51106 (Version: 11.0.51106)
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.51106 (Version: 11.0.51106)
Microsoft Visual C++ 2012 x86-x64 Compilers (Version: 11.0.60315)
Microsoft Visual C++ 2013 32bit Compilers - DEU Resources (Version: 12.0.20617)
Microsoft Visual C++ 2013 Compilers - DEU Resources (Version: 12.0.20617)
Microsoft Visual C++ 2013 Compilers (Version: 12.0.20617)
Microsoft Visual C++ 2013 Core Libraries (Version: 12.0.20617)
Microsoft Visual C++ 2013 Extended Libraries (Version: 12.0.20617)
Microsoft Visual C++ 2013 Microsoft Foundation Class Libraries (Version: 12.0.20617)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.20617 (Version: 12.0.20617)
Microsoft Visual C++ 2013 x86 Debug Runtime - 12.0.20617 (Version: 12.0.20617)
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.20617 (Version: 12.0.20617)
Microsoft Visual C++ 2013 x86-x64 Compilers (Version: 12.0.20617)
Microsoft Visual Studio 2010 Shell (Isolated) - ENU (Version: 10.0.30319)
Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (Version: 10.0.40309)
Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (Version: 10.0.40314)
Microsoft Visual Studio 2010 Tools for Office Runtime (x86) Language Pack - DEU (Version: 10.0.40309)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x86) Language Pack - DEU (Version: 10.0.40309)
Microsoft Visual Studio 2013 Devenv (Version: 12.0.20617)
Microsoft Visual Studio 2013 Preview Shell-(Mindest)-Ressourcen (Version: 12.0.20617)
Microsoft Visual Studio 2013 Preview Team Explorer Language Pack - DEU (Version: 12.0.20617)
Microsoft Visual Studio 2013 Preview-Leistungserfassungstools - DEU (Version: 12.0.20617)
Microsoft Visual Studio 2013 Preview-Leistungserfassungstools (Version: 12.0.20617)
Microsoft Visual Studio 2013 Preview-Vorbereitung (Version: 12.0.20617)
Microsoft Visual Studio 2013 Profiling Tools (Version: 12.0.20617)
Microsoft Visual Studio 2013 Shell (Minimum) (Version: 12.0.20617)
Microsoft Visual Studio 2013 Shell (Minimum) Interop Assemblies (Version: 12.0.20617)
Microsoft Visual Studio Professional 2013 Preview - DEU (Version: 12.0.20617)
Microsoft Visual Studio Professional 2013 Preview (Version: 12.0.20617)
Microsoft Visual Studio Professional 2013 Preview (Version: 12.0.20617.1)
Microsoft Visual Studio Ultimate 2013 Preview XAML UI Designer Core (Version: 12.0.20617)
Microsoft Visual Studio Ultimate 2013 Preview XAML UI Designer deu Resources (Version: 12.0.20617)
Microsoft Web Deploy 3.0 (Version: 3.1236.1631)
Microsoft Web Developer Tools - Visual Studio 2013 Preview - deu (Version: 2.0.40530.0)
Microsoft Web Developer Tools - Visual Studio 2013 Preview (Version: 2.0.40530.0)
Microsoft Web Platform Installer 4.0 (Version: 4.0.1622)
Microsoft Word MUI (German) 2013 (Version: 15.0.4420.1017)
Microsoft WSE 3.0 Runtime (Version: 3.0.5305.0)
Microsoft_VC80_ATL_x86 (Version: 8.0.50727.4053)
Microsoft_VC80_CRT_x86 (Version: 8.0.50727.4053)
Microsoft_VC80_MFC_x86 (Version: 8.0.50727.4053)
Microsoft_VC80_MFCLOC_x86 (Version: 8.0.50727.4053)
Microsoft_VC90_ATL_x86 (Version: 1.00.0000)
Microsoft_VC90_CRT_x86 (Version: 1.00.0000)
Microsoft_VC90_MFC_x86 (Version: 1.00.0000)
Microsoft_VC90_MFCLOC_x86 (Version: 1.00.0000)
Microsoft-System-CLR-Typen für SQL Server 2012 (Version: 11.1.3000.0)
Mozilla Firefox 20.0.1 (x86 de) (Version: 20.0.1)
Mozilla Maintenance Service (Version: 20.0.1)
MSVCRT (Version: 15.4.2862.0708)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
MSXML 4.0 SP2 Parser and SDK (Version: 4.20.9818.0)
MSXML4 Parser (Version: 1.0.0)
MZ-Tools 3.0 für VBA
NetLimiter 3 (Version: 3.0.0.11)
Netzmanager (Version: 1.071)
No23 Recorder (Version: 2.1.0.3)
NVIDIA Grafiktreiber 306.23 (Version: 306.23)
NVIDIA HD-Audiotreiber 1.3.18.0 (Version: 1.3.18.0)
NVIDIA Install Application (Version: 2.1002.85.551)
NVIDIA PhysX (Version: 9.12.0604)
NVIDIA PhysX-Systemsoftware 9.12.0604 (Version: 9.12.0604)
NVIDIA Systemsteuerung 306.23 (Version: 306.23)
NVIDIA Update 1.10.8 (Version: 1.10.8)
NVIDIA Update Components (Version: 1.10.8)
Open XML SDK 2.5 for Microsoft Office (Version: 2.5.5631)
OpenOffice.org 3.3 (Version: 3.3.9567)
OpenTTD 1.3.2-RC2 (Version: 1.3.2-RC2)
Opera 12.16 (Version: 12.16.1860)
Outils de vérification linguistique 2013 de Microsoft Office*- Français (Version: 15.0.4420.1017)
Paket zur Festlegung von Zielversionen für Microsoft .NET Framework 4.5.1 Preview (Deutsch) (Version: 4.5.50741)
Pando Media Booster (Version: 2.3.6.0)
PDF Settings CS5 (Version: 10.0)
PDF24 Creator 3.8.0
PDFill PDF Editor with FREE Writer and FREE Tools (Version: 9.0)
PreEmptive Analytics Client German Language Pack (Version: 1.2.3134.1)
PreEmptive Analytics Visual Studio Components (Version: 1.2.3134.1)
Project64 1.6 (Version: 1.6)
Python 2.4.2 (Version: 2.4.2150)
Python Tools - Umleitungsvorlage (Version: 1.0)
QuickTime (Version: 7.71.80.42)
Radio.fx
Realtek High Definition Audio Driver (Version: 6.0.1.6378)
REALTEK Wireless LAN Software (Version: 0133.09.1202)
Recuva (Version: 1.41)
Remote Mouse version 2.02 (Version: 2.02)
Rise of Nations (Version: 1.0)
Rise of Venice
Samsung Kies (Version: 2.5.0.12094_28)
Samsung Update Plus (Version: 3.0.1.17)
SAMSUNG USB Driver for Mobile Phones (Version: 1.5.16.0)
Scribus 1.4.0rc5 (Version: 1.4.0rc5)
Secure Download Manager (Version: 3.1.10)
SharePoint Client Components (Version: 15.0.4481.1505)
Sid Meier's Civilization V SDK
SimCity 4 Deluxe
simfy (Version: 1.5.0)
Skype™ 6.6 (Version: 6.6.106)
StarTopia (Version: 2.0.0.17)
Steam (Version: 1.0.0.0)
Team Explorer for Microsoft Visual Studio 2013 Preview (Version: 12.0.20617)
TeamSpeak 3 Client (Version: 3.0.10)
T-Eumex 628 (Version: 1.00.0000)
Trine
Trine 2
Ubisoft Game Launcher (Version: 1.0.0.0)
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition
Update for Microsoft Access 2013 (KB2768008) 32-Bit Edition
Update for Microsoft InfoPath 2013 (KB2752078) 32-Bit Edition
Update for Microsoft Lync 2013 (KB2817621) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
Update for Microsoft Office 2010 (KB2494150)
Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553270) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition
Update for Microsoft Office 2010 (KB2566458)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition
Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition
Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition
Update for Microsoft Office 2010 (KB2687503) 32-Bit Edition
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition
Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition
Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition
Update for Microsoft Office 2013 (KB2726954) 32-Bit Edition
Update for Microsoft Office 2013 (KB2726996) 32-Bit Edition
Update for Microsoft Office 2013 (KB2737954) 32-Bit Edition
Update for Microsoft Office 2013 (KB2738038) 32-Bit Edition
Update for Microsoft Office 2013 (KB2760224) 32-Bit Edition
Update for Microsoft Office 2013 (KB2760242) 32-Bit Edition
Update for Microsoft Office 2013 (KB2760257) 32-Bit Edition
Update for Microsoft Office 2013 (KB2760267) 32-Bit Edition
Update for Microsoft Office 2013 (KB2760539) 32-Bit Edition
Update for Microsoft Office 2013 (KB2760553) 32-Bit Edition
Update for Microsoft Office 2013 (KB2760610) 32-Bit Edition
Update for Microsoft Office 2013 (KB2767845) 32-Bit Edition
Update for Microsoft Office 2013 (KB2768016) 32-Bit Edition
Update for Microsoft Office 2013 (KB2817309) 32-Bit Edition
Update for Microsoft Office 2013 (KB2817311) 32-Bit Edition
Update for Microsoft Office 2013 (KB2817314) 32-Bit Edition
Update for Microsoft Office 2013 (KB2817316) 32-Bit Edition
Update for Microsoft Office 2013 (KB2817490) 32-Bit Edition
Update for Microsoft Office 2013 (KB2817493) 32-Bit Edition
Update for Microsoft Office 2013 (KB2817626) 32-Bit Edition
Update for Microsoft Office 2013 (KB2817640) 32-Bit Edition
Update for Microsoft Office 2013 (KB2827225) 32-Bit Edition
Update for Microsoft Office 2013 (KB2827228) 32-Bit Edition
Update for Microsoft Office 2013 (KB2827230) 32-Bit Edition
Update for Microsoft Office 2013 (KB2827235) 32-Bit Edition
Update for Microsoft OneNote 2013 (KB2810016) 32-Bit Edition
Update for Microsoft Outlook 2013 (KB2825632) 32-Bit Edition
Update for Microsoft PowerPoint 2013 (KB2726947) 32-Bit Edition
Update for Microsoft PowerPoint 2013 (KB2817625) 32-Bit Edition
Update for Microsoft Publisher 2013 (KB2752097) 32-Bit Edition
Update for Microsoft SkyDrive Pro (KB2825633) 32-Bit Edition
Update for Microsoft Visio 2013 (KB2752018) 32-Bit Edition
Update for Microsoft Visio Viewer 2013 (KB2768338) 32-Bit Edition
Update for Microsoft Word 2013 (KB2817631) 32-Bit Edition
Update for Microsoft Word 2013 (KB2827218) 32-Bit Edition
Update für Microsoft Office Excel 2007 Help (KB963678)
Update für Microsoft Office Powerpoint 2007 Help (KB963669)
Update für Microsoft Office Word 2007 Help (KB963665)
USB-Ethernet Adapter Device
Visual F# 3.1 SDK (Version: 12.0.20617)
Visual F# 3.1 SDK Language Pack - DEU (Version: 12.0.20617)
Visual F# 3.1 VS (Version: 12.0.20617)
Visual F# 3.1 VS Language Pack - DEU (Version: 12.0.20617)
Visual Studio Extensions for Windows Library for JavaScript (Version: 1.0.9431.0)
VLC media player 2.0.5 (Version: 2.0.5)
vLite (Version: 1.2)
Vs2012 Verification SDK (Version: 12.0.20617)
Vs2012 Verification SDK Coreres (Version: 12.0.20617)
WCF RIA Services V1.0 SP2 (Version: 4.1.62812.0)
WIDCOMM Bluetooth Software (Version: 6.5.1.2300)
Windows 8 Development Essentials (Version: 12.0.20617)
Windows App Certification Kit Native Components (Version: 8.100.9431)
Windows App Certification Kit x86 (Version: 8.100.9431)
Windows Automated Installation Kit (Version: 1.1.0.0)
Windows Azure Mobile Services SDK (Version: 1.0.10520.0)
Windows Azure Mobile Services Tools for Visual Studio 2013 Preview - v1.0 (Version: 1.0.60531.1601)
Windows Azure Mobile Services Tools für Visual Studio 2013 Preview Language Pack - v1.0 (Version: 1.0.60531.1601)
Windows Azure Tools for LightSwitch for Visual Studio 2013 Preview - v2.0 (Version: 2.0.60517.1602)
Windows Azure Tools für Microsoft LightSwitch für Visual Studio 2013 Preview - $(var.OOBPublishVersion) (DEU) (Version: 2.0.60517.1602)
Windows Live Communications Platform (Version: 15.4.3502.0922)
Windows Live Essentials (Version: 15.4.3502.0922)
Windows Live Essentials (Version: 15.4.3555.0308)
Windows Live Family Safety (Version: 15.4.3555.0308)
Windows Live Fotogalerie (Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0)
Windows Live Installer (Version: 15.4.3502.0922)
Windows Live Mail (Version: 15.4.3502.0922)
Windows Live Mesh (Version: 15.4.3502.0922)
Windows Live Mesh ActiveX control for remote connections (Version: 15.4.5722.2)
Windows Live Messenger (Version: 15.4.3538.0513)
Windows Live Messenger Companion Core (Version: 15.4.3502.0922)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (Version: 15.4.3502.0922)
Windows Live Photo Common (Version: 15.4.3502.0922)
Windows Live Photo Gallery (Version: 15.4.3502.0922)
Windows Live PIMT Platform (Version: 15.4.3508.1109)
Windows Live Remote Client (Version: 15.4.5722.2)
Windows Live Remote Client Resources (Version: 15.4.5722.2)
Windows Live Remote Service (Version: 15.4.5722.2)
Windows Live Remote Service Resources (Version: 15.4.5722.2)
Windows Live SOXE (Version: 15.4.3502.0922)
Windows Live SOXE Definitions (Version: 15.4.3502.0922)
Windows Live UX Platform (Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (Version: 15.4.3508.1109)
Windows Live Writer (Version: 15.4.3502.0922)
Windows Live Writer Resources (Version: 15.4.3502.0922)
Windows Media Player Firefox Plugin (Version: 1.0.0.8)
Windows Mobile-Gerätecenter (Version: 6.1.6965.0)
Windows Runtime Intellisense Content - de-de (Version: 8.100.9431)
Windows Software Development Kit (Version: 8.100.9431)
Windows Software Development Kit (Version: 8.59.29914)
Windows Software Development Kit DirectX x86 Remote (Version: 8.100.9431)
Windows Software Development Kit DirectX x86 Remote (Version: 8.59.29914)
Windows Software Development Kit for Windows Store Apps (Version: 8.100.9431)
Windows Software Development Kit for Windows Store Apps DirectX x86 Remote (Version: 8.100.9431)
Windows Software Development Kit for Windows Store Apps DirectX x86 Remote (Version: 8.59.29914)
Windows XP Targeting with C++ (Version: 11.0.51106)
WinRAR 4.01 (32-Bit) (Version: 4.01.0)
Wondershare PDF Password Remover (Build 1.3.0)
Workflow Manager Client 1.0 (Version: 2.0.20922.0)
Workflow Manager Tools 1.0 for Visual Studio (Version: 2.0.30412.0)
XMedia Recode 3.0.9.0 (Version: 3.0.9.0)
==================== Restore Points =========================
08-11-2013 09:33:11 Geplanter Prüfpunkt
==================== Hosts content: ==========================
2009-07-14 03:04 - 2011-11-09 16:15 - 00001355 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 activate.adobe.com
127.0.0.1 adobe.activate.com
127.0.0.1 practivate.adobe.com
127.0.0.1 ereg.adobe.com
127.0.0.1 adobeereg.com
127.0.0.1 activate.wip3.adobe.com
127.0.0.1 wip3.adobe.com
127.0.0.1 3dns-3.adobe.com
127.0.0.1 3dns-2.adobe.com
127.0.0.1 adobe-dns.adobe.com
127.0.0.1 adobe-dns-2.adobe.com
127.0.0.1 adobe-dns-3.adobe.com
127.0.0.1 ereg.wip3.adobe.com
127.0.0.1 activate-sea.adobe.com
127.0.0.1 wwis-dubc1-vip60.adobe.com
127.0.0.1 activate-sjc0.adobe.com
127.0.0.1 wwis-dubc1-vip60.adobe.com
==================== Scheduled Tasks (whitelisted) =============
Task: {1F9181CB-521E-41B4-8C58-4E601DAD069E} - System32\Tasks\SUPBackground => C:\Program Files\Samsung\Samsung Update Plus\SUPBackground.exe [2011-12-20] (Samsung Electronics)
Task: {422C8E32-BA9A-46B8-ADC7-7A64A7F2069D} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2012-10-01] (Microsoft Corporation)
Task: {752EE423-2BAB-46B4-8301-F3FE88E5872E} - System32\Tasks\Microsoft Office 15 Sync Maintenance for fx-Laptop-fx fx-Laptop => C:\Program Files\Microsoft Office\Office15\MSOSYNC.EXE [2012-10-01] (Microsoft Corporation)
Task: {77A765D3-57F8-46C8-BBBA-6F3688DB9FC7} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {7C770E43-B4B8-4F4B-AB8A-CD3C0DA713D0} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\microsoft shared\OFFICE15\OLicenseHeartbeat.exe [2012-10-01] (Microsoft Corporation)
Task: {8CC90A54-AC96-4176-B460-5EB92F5A5627} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2010-11-20] (Microsoft Corporation)
Task: {8FF33477-E7E6-4051-A0FC-215FCD80B9E4} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2012-10-01] (Microsoft Corporation)
Task: {9D253E7E-9EC6-4CCB-8EF5-6AAF6DBA4AF9} - System32\Tasks\AdobeAAMUpdater-1.0-fx-Laptop-fx => C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [2011-03-15] (Adobe Systems Incorporated)
Task: {B5C99145-DE4A-4901-B399-142A737665DE} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2011-11-19] (Google Inc.)
Task: {D97EC2D3-B11A-4828-A487-B963B2F4906E} - System32\Tasks\Microsoft_Hardware_Launch_IPoint_exe => C:\Program Files\Microsoft IntelliPoint\ipoint.exe [2011-08-01] (Microsoft Corporation)
Task: {E3AE5A66-8F01-4963-A008-252724363172} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2011-11-19] (Google Inc.)
Task: {F67AB589-E128-4A2B-A497-2923956ADA4A} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2012-08-22] (Piriform Ltd)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\ProgramData\TEMP:9FF7C773
==================== Safe Mode (whitelisted) ===================
==================== Faulty Device Manager Devices =============
Name: Microsoft-Adapter für Miniports virtueller WiFis
Description: Microsoft-Adapter für Miniports virtueller WiFis
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: vwifimp
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
System errors:
=============
Microsoft Office Sessions:
=========================
Error: (03/22/2012 01:52:42 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6607.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 1813 seconds with 0 seconds of active time. This session ended with a crash.
==================== Memory info ===========================
Percentage of memory in use: 48%
Total physical RAM: 3444.55 MB
Available physical RAM: 1768.45 MB
Total Pagefile: 6887.39 MB
Available Pagefile: 4839.36 MB
Total Virtual: 2047.88 MB
Available Virtual: 1893.16 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:297.99 GB) (Free:81.59 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: E4014CE4)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=298 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-11-08 11:46:24
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST320LT0 rev.0001 298,09GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\FHW211~1\AppData\Local\Temp\uxrdypod.sys
---- System - GMER 2.1 ----
SSDT 9A173B86 ZwCreateSection
SSDT 9A173B90 ZwRequestWaitReplyPort
SSDT 9A173B8B ZwSetContextThread
SSDT 9A173B95 ZwSetSecurityObject
SSDT 9A173B9A ZwSystemDebugControl
SSDT 9A173B27 ZwTerminateProcess
---- Kernel code sections - GMER 2.1 ----
.text ntkrnlpa.exe!ZwRollbackEnlistment + 142D 83859A15 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 83893212 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text ntkrnlpa.exe!KeRemoveQueueEx + 11F7 8389A58C 4 Bytes [86, 3B, 17, 9A]
.text ntkrnlpa.exe!KeRemoveQueueEx + 1553 8389A8E8 4 Bytes [90, 3B, 17, 9A]
.text ntkrnlpa.exe!KeRemoveQueueEx + 1597 8389A92C 4 Bytes [8B, 3B, 17, 9A]
.text ntkrnlpa.exe!KeRemoveQueueEx + 1613 8389A9A8 4 Bytes [95, 3B, 17, 9A]
.text ntkrnlpa.exe!KeRemoveQueueEx + 1667 8389A9FC 4 Bytes [9A, 3B, 17, 9A]
.text ...
---- Devices - GMER 2.1 ----
AttachedDevice \Driver\tdx \Device\Tcp nltdi.sys
Device \Driver\BTHUSB \Device\00000090 bthport.sys
Device \Driver\BTHUSB \Device\00000092 bthport.sys
AttachedDevice \Driver\tdx \Device\Udp nltdi.sys
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\000272b305f0
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\2c8158cb39e9
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\2c8158cb39e9@0014beaf2395 0x16 0x82 0x59 0xCB ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0x1B 0x80 0xB7 0xAC ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x90 0x20 0xC1 0xF1 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0xA0 0x02 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x37 0xCE 0x50 0x70 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x3C 0x8A 0x88 0xF7 ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\000272b305f0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\2c8158cb39e9 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\2c8158cb39e9@0014beaf2395 0x16 0x82 0x59 0xCB ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 1
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0x1B 0x80 0xB7 0xAC ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x90 0x20 0xC1 0xF1 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0xA0 0x02 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x37 0xCE 0x50 0x70 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x3C 0x8A 0x88 0xF7 ...
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{641E88BD-0936-46B7-B22E-3AC52DC4E0FC}
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{641E88BD-0936-46B7-B22E-3AC52DC4E0FC}
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{641E88BD-0936-46B7-B22E-3AC52DC4E0FC}@Path \Microsoft\Windows Defender\MP Scheduled Scan
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{641E88BD-0936-46B7-B22E-3AC52DC4E0FC}@Hash 0x83 0x11 0x27 0x13 ...
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{641E88BD-0936-46B7-B22E-3AC52DC4E0FC}@Triggers 0x15 0x00 0x00 0x00 ...
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{641E88BD-0936-46B7-B22E-3AC52DC4E0FC}@DynamicInfo 0x03 0x00 0x00 0x00 ...
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows Defender\MP Scheduled Scan@Id {641E88BD-0936-46B7-B22E-3AC52DC4E0FC}
---- EOF - GMER 2.1 ----
Vielen Dank für eure Unterstützung und tolle Arbeit hier! Mfg Fx2ka |
|
08.11.2013, 12:10
| #2 |
| /// the machine /// TB-Ausbilder    | Windows 7: Bka-Interpol-Trojaner mit Sperrschirm hi,
__________________Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter Startup: C:\Users\fx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4twl4rjwl.lnk
ShortcutTarget: 4twl4rjwl.lnk -> C:\PROGRA~2\lwjr4lwt4.dss (Microsoft Corporation)
C:\ProgramData\4twl4rjwl.reg
C:\ProgramData\lwjr4lwt4.dss
C:\ProgramData\PKP_DLdu.DAT
C:\ProgramData\PKP_DLes.DAT
C:\ProgramData\PKP_DLet.DAT
C:\ProgramData\PKP_DLev.DAT
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Das betroffene Konto normal starten.
__________________ |
|
08.11.2013, 12:14
| #3 |
| | Windows 7: Bka-Interpol-Trojaner mit Sperrschirm Hier der Code von FRST:
__________________Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 31-10-2013
Ran by fhw21129046 at 2013-11-08 12:13:06 Run:1
Running from C:\Users\fhw21129046\Desktop
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
Startup: C:\Users\fx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4twl4rjwl.lnk
ShortcutTarget: 4twl4rjwl.lnk -> C:\PROGRA~2\lwjr4lwt4.dss (Microsoft Corporation)
C:\ProgramData\4twl4rjwl.reg
C:\ProgramData\lwjr4lwt4.dss
C:\ProgramData\PKP_DLdu.DAT
C:\ProgramData\PKP_DLes.DAT
C:\ProgramData\PKP_DLet.DAT
C:\ProgramData\PKP_DLev.DAT
*****************
C:\Users\fx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4twl4rjwl.lnk => Moved successfully.
C:\PROGRA~2\lwjr4lwt4.dss => Moved successfully.
C:\ProgramData\4twl4rjwl.reg => Moved successfully.
"C:\ProgramData\lwjr4lwt4.dss" => File/Directory not found.
C:\ProgramData\PKP_DLdu.DAT => Moved successfully.
C:\ProgramData\PKP_DLes.DAT => Moved successfully.
C:\ProgramData\PKP_DLet.DAT => Moved successfully.
C:\ProgramData\PKP_DLev.DAT => Moved successfully.
==== End of Fixlog ====
|
|
08.11.2013, 12:56
| #4 |
| /// the machine /// TB-Ausbilder | Windows 7: Bka-Interpol-Trojaner mit Sperrschirm Startet das Konto normal? 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
08.11.2013, 16:31
| #5 |
| | Windows 7: Bka-Interpol-Trojaner mit Sperrschirm Funktioniert wieder einwandfrei. Top! VG |
|
09.11.2013, 13:23
| #6 |
| /// the machine /// TB-Ausbilder | Windows 7: Bka-Interpol-Trojaner mit Sperrschirm Dann jetzt in diesem Konto im normalen Modus: Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ --> Windows 7: Bka-Interpol-Trojaner mit Sperrschirm |
|
| Themen zu Windows 7: Bka-Interpol-Trojaner mit Sperrschirm |
| 4d36e972-e325-11ce-bfc1-08002be10318, antivir, antivirus, avira, bingbar, bka - trojaner, bonjour, converter, defender, desktop, entfernen, error, excel, farbar, farbar recovery scan tool, firefox, flash player, interpol, mp3, office 2013, outlook 2013, photoshop, plug-in, realtek, registry, scan, security, server, software, svchost.exe, system, temp, udp, windows, windows 8.1, word 2013, ändern |
Linear-Darstellung
