| |
| |||||||
Log-Analyse und Auswertung: Funde nach Routinemäßigem Malwarebytes ScanWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
09.11.2013, 21:04
| #1 |
| |  Funde nach Routinemäßigem Malwarebytes Scan Hallo zusammen, nach meinem Routine Scan mit Anti Malware haben sich Funde ergeben welche ich gelöscht habe. Hier der Bericht: Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Database version: v2013.11.09.05 Windows Vista Service Pack 2 x86 NTFS Internet Explorer 9.0.8112.16421 Annika :: PITTISNOTEBOOK [administrator] 09.11.2013 16:58:06 mbam-log-2013-11-09 (16-58-06).txt Scan type: Full scan (C:\|D:\|E:\|) Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 381407 Time elapsed: 1 hour(s), 48 minute(s), 27 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 1 HKCU\Software\Conduit\FF (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully. Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 3 C:\Users\Annika\AppData\Roaming\OpenCandy (PUP.Optional.OpenCandy) -> Quarantined and deleted successfully. C:\Users\Annika\AppData\Roaming\OpenCandy\87D21A43F7FB494FA08193CF792703BE (PUP.Optional.OpenCandy) -> Quarantined and deleted successfully. C:\Users\Annika\AppData\Roaming\OpenCandy\B4351A1A25B74E229B6E947FAB6030BD (PUP.Optional.OpenCandy) -> Quarantined and deleted successfully. Files Detected: 3 C:\Users\Annika\AppData\Local\Conduit\CT2625848\DVDVideoSoftTB_DEAutoUpdateHelper.exe (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully. C:\Users\Annika\AppData\Roaming\OpenCandy\87D21A43F7FB494FA08193CF792703BE\TuneUpUtilities2013-2200218-p2v1.exe (PUP.Optional.OpenCandy) -> Quarantined and deleted successfully. C:\Users\Annika\AppData\Roaming\OpenCandy\B4351A1A25B74E229B6E947FAB6030BD\TuneUpUtilities2013_2200218_de-DE.exe (PUP.Optional.OpenCandy) -> Quarantined and deleted successfully. (end) Habe mir dann wie in der Anleitung Defogger runtergeladen und ausgeführt wie beschrieben. Dauaf folgeten die Scans mit: GMER: GMER 2.1.19163 - hxxp://www.gmer.net Rootkit scan 2013-11-09 20:36:39 Windows 6.0.6002 Service Pack 2 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-4 WDC_WD3200BEVT-22ZCT0 rev.11.01A11 298,09GB Running: lercues8.exe; Driver: C:\Users\Annika\AppData\Local\Temp\axddraow.sys ---- System - GMER 2.1 ---- SSDT 8D10A746 ZwCreateSection SSDT 8D10A750 ZwRequestWaitReplyPort SSDT 8D10A74B ZwSetContextThread SSDT 8D10A755 ZwSetSecurityObject SSDT 8D10A75A ZwSystemDebugControl SSDT 8D10A6E7 ZwTerminateProcess ---- Kernel code sections - GMER 2.1 ---- .text ntkrnlpa.exe!KeSetEvent + 215 82AE3860 4 Bytes [46, A7, 10, 8D] .text ntkrnlpa.exe!KeSetEvent + 539 82AE3B84 4 Bytes [50, A7, 10, 8D] .text ntkrnlpa.exe!KeSetEvent + 56D 82AE3BB8 4 Bytes [4B, A7, 10, 8D] .text ntkrnlpa.exe!KeSetEvent + 5D1 82AE3C1C 4 Bytes [55, A7, 10, 8D] .text ntkrnlpa.exe!KeSetEvent + 619 82AE3C64 4 Bytes [5A, A7, 10, 8D] .text ... ? System32\drivers\tuqa.sys Das System kann den angegebenen Pfad nicht finden. ! .text C:\Windows\system32\DRIVERS\atksgt.sys section is writeable [0x9EF06300, 0x3B6D8, 0xE8000020] .text C:\Windows\system32\DRIVERS\lirsgt.sys section is writeable [0x9EF6E300, 0x1BEE, 0xE8000020] ---- Devices - GMER 2.1 ---- Device \Driver\BTHUSB \Device\000000ac bthport.sys Device \Driver\BTHUSB \Device\000000ae bthport.sys AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\00197edfb902 Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001e4cd05367 Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\00197edfb902 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\001e4cd05367 (not active ControlSet) Reg HKLM\SOFTWARE\Microsoft\Windows Search\Gather\Windows\SystemIndex@LogName C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.Ntfy274.gthr Reg HKLM\SOFTWARE\Classes\CLSID\{B6A930A0-A4F5-43A5-9B4E-6189A6C2B9E8}@\24!s!y!f!c!`!j!t!f!t!t!e!d!c!s!f! 19583823 ---- EOF - GMER 2.1 ---- Und FRST: Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 31-10-2013 Ran by Annika (administrator) on PITTISNOTEBOOK on 09-11-2013 20:04:13 Running from C:\Users\Annika\Downloads Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: German Standard Internet Explorer Version 9 Boot Mode: Normal ==================== Processes (Whitelisted) =================== (ATI Technologies Inc.) C:\Windows\system32\Ati2evxx.exe (Microsoft Corporation) C:\Windows\system32\SLsvc.exe (ATI Technologies Inc.) C:\Windows\system32\Ati2evxx.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Empolis GmbH) c:\program files\common files\gnab\service\servicecontroller.exe (Hauppauge Computer Works) C:\PROGRA~1\WinTV\TVServer\HAUPPA~1.EXE (Nero AG) C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe (Empolis GmbH) C:\Program Files\Medion\MEDIONbox\Program\GCS.exe () C:\Windows\system32\PnkBstrA.exe (Entriq, Inc.) C:\Program Files\maxdome\DCBin\DCService.exe (Microsoft Corporation) C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe () C:\Program Files\Verbindungsassistent\wtgservice.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE (Asia Vital Components Co.,Ltd.) C:\Program Files\FSP\FspUip.exe (Nero AG) C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe (Empolis GmbH) C:\Program Files\Common Files\Gnab\Service\GnabTray.exe (Google) C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (IDT, Inc.) C:\Windows\sttray.exe (Ask) C:\Program Files\Ask.com\Updater\Updater.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe (Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Nero AG) C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe (Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe () C:\Program Files\maxdome\DCBin\DCTrayApp.exe (Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE (Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe (Nero AG) C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe (Nero AG) C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe (ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Microsoft Corporation) C:\Windows\system32\conime.exe (Mozilla Corporation) C:\Users\Annika\AppData\Local\Mozilla Firefox\firefox.exe (Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Mozilla Corporation) C:\Users\Annika\AppData\Local\Mozilla Firefox\plugin-container.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [StartCCC] - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [90112 2006-11-10] () HKLM\...\Run: [fspuip] - C:\Program Files\FSP\FspUip.exe [352256 2007-09-13] (Asia Vital Components Co.,Ltd.) HKLM\...\Run: [NeroFilterCheck] - C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [153136 2007-03-01] (Nero AG) HKLM\...\Run: [NBKeyScan] - C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [1836328 2007-09-20] (Nero AG) HKLM\...\Run: [GnabTray] - C:\Program Files\Common Files\Gnab\Service\GnabTray.exe [327680 2007-04-13] (Empolis GmbH) HKLM\...\Run: [UCam_Menu] - C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [222504 2007-09-13] (CyberLink Corp.) HKLM\...\Run: [Google Desktop Search] - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [30192 2010-09-02] (Google) HKLM\...\Run: [toolbar_eula_launcher] - C:\Program Files\GoogleEULA\EULALauncher.exe [16896 2007-02-09] ( ) HKLM\...\Run: [WheelMouse] - C:\Advanced Wheel Mouse\wh_exec.exe [86016 2007-03-11] () HKLM\...\Run: [SigmatelSysTrayApp] - C:\Windows\sttray.exe [405504 2007-07-27] (IDT, Inc.) HKLM\...\Run: [BCSSync] - C:\Program Files\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation) HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.) HKLM\...\Run: [] - [x] HKLM\...\Run: [ApnUpdater] - C:\Program Files\Ask.com\Updater\Updater.exe [1644680 2013-03-10] (Ask) HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-05] (Avira Operations GmbH & Co. KG) HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated) HKLM\...\Run: [DivXMediaServer] - C:\Program Files\DivX\DivX Media Server\DivXMediaServer.exe HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation) HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.) HKLM\...\Run: [iTunesHelper] - C:\Program Files\iTunes\iTunesHelper.exe [152392 2013-10-23] (Apple Inc.) Winlogon\Notify\!SASWinLogon: C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL [X] HKCU\...\Run: [L08DXLRD_2509120] - "C:\Program Files\Microsoft Lernen und Wissen\Microsoft Encarta 2008 – Lernen und Wissen DVD\EDICT.EXE" -m HKCU\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] - C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe [202024 2007-10-15] (Nero AG) HKCU\...\Run: [msnmsgr] - "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background HKU\Default\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter HKU\Default User\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter HKU\Peter Reuter\...\Run: [ehTray.exe] - C:\Windows\ehome\ehtray.exe [ 2008-01-21] (Microsoft Corporation) HKU\Peter Reuter\...\Run: [DAEMON Tools Lite] - "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun HKU\Peter Reuter\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] - C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe [ 2007-10-15] (Nero AG) HKU\Peter Reuter\...\Run: [OfficeSyncProcess] - C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE [ 2013-04-22] (Microsoft Corporation) HKU\Peter Reuter\...\Run: [ICQ] - "C:\Program Files\ICQ7.4\ICQ.exe" silent loginmode=4 HKU\Peter Reuter\...\Run: [ISUSPM] - "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL [ 2010-09-02] (Google) Startup: C:\Users\Peter Reuter\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft SharePoint Workspace.lnk ShortcutTarget: Microsoft SharePoint Workspace.lnk -> C:\Program Files\Microsoft Office\Office14\GROOVE.EXE (Microsoft Corporation) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.medion.com/ HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.medion.com/ URLSearchHook: HKLM - DVDVideoSoftTB DE Toolbar - {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - C:\Program Files\DVDVideoSoftTB_DE\prxtbDVDV.dll (Conduit Ltd.) URLSearchHook: HKCU - UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) URLSearchHook: HKCU - DVDVideoSoftTB DE Toolbar - {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - C:\Program Files\DVDVideoSoftTB_DE\prxtbDVDV.dll (Conduit Ltd.) SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKCU - {70D46D94-BF1E-45ED-B567-48701376298E} URL = hxxp://127.0.0.1:4664/search&s=d5hy0NqzrALiTvhnpctH-KdeduQ?q={searchTerms} SearchScopes: HKCU - {824F8606-FF00-47E1-BEBC-29E15AB41094} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2625848 SearchScopes: HKCU - {DB5128A5-AC98-482B-B583-56B50DC4DA67} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=kw&q={searchTerms}&locale=&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=46a68638-bfd9-4629-8d10-1df4d90d02f4&apn_sauid=4753A9D0-6F33-4237-B451-4CD110E16720 BHO: DVDVideoSoftTB DE Toolbar - {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - C:\Program Files\DVDVideoSoftTB_DE\prxtbDVDV.dll (Conduit Ltd.) BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation) BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - DVDVideoSoftTB DE Toolbar - {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - C:\Program Files\DVDVideoSoftTB_DE\prxtbDVDV.dll (Conduit Ltd.) Toolbar: HKLM - Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File Toolbar: HKCU - No Name - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - No File Toolbar: HKCU - DVDVideoSoftTB DE Toolbar - {0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF} - C:\Program Files\DVDVideoSoftTB_DE\prxtbDVDV.dll (Conduit Ltd.) DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - No File Winsock: Catalog5 08 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.) Winsock: Catalog9 01 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 02 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 03 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 04 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 05 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 06 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 07 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 08 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 20 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG) Tcpip\..\Interfaces\{8374E2D9-7FAB-4E10-8FCB-3B6386BC6DCA}: [NameServer]62.220.18.8 89.246.64.8 FireFox: ======== FF ProfilePath: C:\Users\Annika\AppData\Roaming\Mozilla\Firefox\Profiles\in9lq98w.default-1368280471114 FF Homepage: hxxp://www.vip.de/cms/index.php FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_117.dll () FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF Plugin: @videolan.org/vlc,version=0.9.8a - C:\Program Files\VideoLAN\VLC\npvlc.dll (the VideoLAN Team) FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\googledesktop.xml FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ FF StartMenuInternet: FIREFOX.EXE - C:\Users\Peter Reuter\AppData\Local\Mozilla Firefox\firefox.exe ========================== Services (Whitelisted) ================= R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-09-05] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-05] (Avira Operations GmbH & Co. KG) R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-05] (Avira Operations GmbH & Co. KG) R2 GnabService; c:\program files\common files\gnab\service\servicecontroller.exe [36864 2007-04-13] (Empolis GmbH) S3 GoogleDesktopManager-051210-111108; C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [30192 2010-09-02] (Google) R2 HauppaugeTVServer; C:\PROGRA~1\WinTV\TVServer\HAUPPA~1.EXE [434176 2008-10-21] (Hauppauge Computer Works) R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [66872 2009-04-12] () R2 Prosieben; C:\Program Files\maxdome\DCBin\DCService.exe [77032 2009-05-01] (Entriq, Inc.) R2 WTGService; C:\Program Files\Verbindungsassistent\wtgservice.exe [329168 2010-07-18] () ==================== Drivers (Whitelisted) ==================== R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [281760 2010-06-27] () R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [88840 2013-09-05] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136672 2013-09-05] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-03-27] (Avira Operations GmbH & Co. KG) R3 fspad_wlh32; C:\Windows\System32\DRIVERS\fspad_wlh32.sys [24064 2007-09-13] (Asia Vital Components Co.,Ltd.) S3 hcw95bda; C:\Windows\System32\Drivers\hcw95bda.sys [562176 2008-09-09] (Hauppauge Computer Works, Inc.) S3 hcw95rc; C:\Windows\System32\DRIVERS\hcw95rc.sys [15616 2008-09-09] (Hauppauge Computer Works, Inc.) R2 hwpsgt; C:\Windows\System32\DRIVERS\hwpsgt.sys [137344 2009-10-04] () R2 lemsgt; C:\Windows\System32\DRIVERS\lemsgt.sys [9472 2009-10-04] () R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [25888 2010-06-27] () R3 MBAMSwissArmy; C:\Windows\system32\drivers\mbamswissarmy.sys [40776 2013-11-09] (Malwarebytes Corporation) R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-02-17] (Avira GmbH) S3 whfltr2k; C:\Windows\System32\DRIVERS\whfltr2k.sys [6784 2007-01-25] () U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation) S3 catchme; \??\C:\Users\PETERR~1\AppData\Local\Temp\catchme.sys [x] S3 IpInIp; system32\DRIVERS\ipinip.sys [x] S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x] S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x] S3 RimUsb; System32\Drivers\RimUsb.sys [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-11-09 20:04 - 2013-11-09 20:04 - 00000000 ____D C:\FRST 2013-11-09 20:03 - 2013-11-09 20:03 - 01089445 _____ (Farbar) C:\Users\Annika\Downloads\FRST.exe 2013-11-09 20:01 - 2013-11-09 20:01 - 103387443 _____ C:\Windows\system32\팪ᴼ 2013-11-09 19:41 - 2013-11-09 19:41 - 00040776 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamswissarmy.sys 2013-11-09 19:33 - 2013-11-09 19:36 - 00000474 _____ C:\Users\Annika\Downloads\defogger_disable.log 2013-11-09 19:33 - 2013-11-09 19:33 - 00000000 _____ C:\Users\Annika\defogger_reenable 2013-11-09 19:32 - 2013-11-09 19:32 - 00050477 _____ C:\Users\Annika\Downloads\Defogger.exe 2013-11-09 16:56 - 2013-11-09 16:56 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Annika\Downloads\mbam-setup-1.75.0.1300.exe 2013-11-09 16:56 - 2013-11-09 16:56 - 00000906 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2013-11-09 16:56 - 2013-11-09 16:56 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware 2013-11-09 16:56 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2013-11-08 21:50 - 2013-11-08 21:50 - 00000000 ____D C:\Users\Annika\AppData\Local\AskToolbar 2013-11-08 21:47 - 2013-11-08 21:47 - 00000000 ____D C:\Users\Annika\CA81F8F9D5304DB588466B41A76AF692.TMP 2013-11-08 21:29 - 2013-11-08 21:29 - 00000296 _____ C:\Windows\system32\spsys.log 2013-11-08 21:27 - 2013-11-08 21:49 - 00004333 _____ C:\PERF.LOG 2013-11-08 20:19 - 2013-11-09 19:12 - 00002570 _____ C:\Windows\PFRO.log 2013-11-08 20:19 - 2013-11-08 21:28 - 00000000 _____ C:\LongFileName.txt 2013-11-08 20:19 - 2013-11-08 20:20 - 00000000 ____D C:\Virtual 2013-11-08 20:17 - 2013-11-08 21:49 - 00000000 ____D C:\ProgramData\BufferZone 2013-11-08 20:16 - 2013-11-09 16:44 - 00000000 ____D C:\Program Files\BufferZone 2013-11-08 20:14 - 2013-11-08 20:15 - 17242112 _____ C:\Users\Annika\Downloads\BufferZone405Pro.msi 2013-11-03 20:01 - 2013-11-06 20:01 - 102844835 _____ C:\Windows\system32\縍ꈐᴼ 2013-11-02 20:01 - 2013-11-02 20:01 - 104684788 _____ C:\Windows\system32\ᴼ 2013-11-01 20:06 - 2013-11-08 17:10 - 00000000 ____D C:\Users\Annika\AppData\Local\Mozilla Firefox 2013-10-31 15:10 - 2013-10-31 15:10 - 104348737 _____ C:\Windows\system32\馋諳ᴼš 2013-10-29 16:22 - 2013-10-29 16:22 - 00001664 _____ C:\Users\Public\Desktop\iTunes.lnk 2013-10-29 16:20 - 2013-10-29 16:21 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1 2013-10-29 16:20 - 2013-10-29 16:21 - 00000000 ____D C:\Program Files\iTunes 2013-10-29 16:20 - 2013-10-29 16:20 - 00000000 ____D C:\Program Files\iPod 2013-10-28 20:01 - 2013-10-30 20:01 - 104193179 _____ C:\Windows\system32\䍈ᴼŸ 2013-10-27 21:29 - 2013-10-27 21:29 - 103533600 _____ C:\Windows\system32\�騦ᴼ§ 2013-10-17 19:01 - 2013-10-18 19:01 - 101813202 _____ C:\Windows\system32\푸騸ᴼž 2013-10-15 19:00 - 2013-10-16 19:01 - 101406750 _____ C:\Windows\system32\尔宀ᴼœ 2013-10-14 19:00 - 2013-10-14 19:00 - 100975419 _____ C:\Windows\system32\ꑓﳪᴼš 2013-10-12 14:59 - 2013-10-13 19:01 - 100742045 _____ C:\Windows\system32\撴吇ᴼš 2013-10-11 20:30 - 2013-09-22 11:29 - 12336128 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2013-10-11 20:30 - 2013-09-22 11:22 - 09739264 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2013-10-11 20:30 - 2013-09-22 11:22 - 01800704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2013-10-11 20:30 - 2013-09-22 11:14 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2013-10-11 20:30 - 2013-09-22 11:13 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2013-10-11 20:30 - 2013-09-22 11:13 - 01104896 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2013-10-11 20:30 - 2013-09-22 11:12 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2013-10-11 20:30 - 2013-09-22 11:09 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2013-10-11 20:30 - 2013-09-22 11:08 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2013-10-11 20:30 - 2013-09-22 11:07 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2013-10-11 20:30 - 2013-09-22 11:06 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2013-10-11 20:30 - 2013-09-22 11:05 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2013-10-11 20:30 - 2013-09-22 11:03 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2013-10-11 20:30 - 2013-09-22 11:03 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2013-10-11 20:30 - 2013-09-22 11:03 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2013-10-11 20:30 - 2013-09-22 10:59 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2013-10-11 17:26 - 2013-08-27 03:47 - 01029120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll 2013-10-11 17:26 - 2013-08-27 03:47 - 00219648 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll 2013-10-11 17:26 - 2013-08-27 03:47 - 00189952 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll 2013-10-11 17:26 - 2013-08-27 03:47 - 00160768 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll 2013-10-11 17:26 - 2013-08-27 02:52 - 01172480 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll 2013-10-11 17:26 - 2013-08-27 02:50 - 00486400 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll 2013-10-11 17:26 - 2013-08-27 02:32 - 00683008 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll 2013-10-11 17:26 - 2013-08-27 02:28 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll 2013-10-11 17:26 - 2013-08-27 02:28 - 00798208 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll 2013-10-11 17:26 - 2013-08-01 04:16 - 00638400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys 2013-10-11 17:26 - 2013-08-01 03:49 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll 2013-10-11 17:25 - 2013-08-29 08:36 - 02050048 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2013-10-11 17:25 - 2013-07-20 11:44 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll 2013-10-11 17:25 - 2013-07-12 10:04 - 00134272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys 2013-10-11 17:25 - 2013-07-04 05:21 - 00532480 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll 2013-10-11 17:25 - 2013-07-03 03:10 - 00025472 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys 2013-10-11 17:25 - 2013-06-29 03:07 - 00226304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys 2013-10-11 17:25 - 2013-06-29 03:07 - 00197632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys 2013-10-11 17:25 - 2013-06-29 03:07 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys 2013-10-11 17:25 - 2013-06-29 03:06 - 00006016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys 2013-10-11 17:25 - 2013-06-27 00:01 - 00527064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys 2013-10-11 17:25 - 2013-06-04 05:16 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll 2013-10-11 17:25 - 2013-06-04 02:49 - 00293376 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll 2013-10-11 17:25 - 2011-05-05 14:54 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys 2013-10-11 17:25 - 2011-05-05 14:54 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys ==================== One Month Modified Files and Folders ======= 2013-11-09 20:04 - 2013-11-09 20:04 - 00000000 ____D C:\FRST 2013-11-09 20:03 - 2013-11-09 20:03 - 01089445 _____ (Farbar) C:\Users\Annika\Downloads\FRST.exe 2013-11-09 20:01 - 2013-11-09 20:01 - 103387443 _____ C:\Windows\system32\팪ᴼ 2013-11-09 20:01 - 2006-11-02 13:47 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 2013-11-09 20:01 - 2006-11-02 13:47 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 2013-11-09 19:57 - 2013-03-17 14:30 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-11-09 19:41 - 2013-11-09 19:41 - 00040776 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamswissarmy.sys 2013-11-09 19:36 - 2013-11-09 19:33 - 00000474 _____ C:\Users\Annika\Downloads\defogger_disable.log 2013-11-09 19:33 - 2013-11-09 19:33 - 00000000 _____ C:\Users\Annika\defogger_reenable 2013-11-09 19:33 - 2009-01-16 16:05 - 00000000 ____D C:\Users\Annika 2013-11-09 19:32 - 2013-11-09 19:32 - 00050477 _____ C:\Users\Annika\Downloads\Defogger.exe 2013-11-09 19:19 - 2009-01-13 17:36 - 01817592 _____ C:\Windows\WindowsUpdate.log 2013-11-09 19:12 - 2013-11-08 20:19 - 00002570 _____ C:\Windows\PFRO.log 2013-11-09 19:12 - 2006-11-02 14:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2013-11-09 19:11 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\Globalization 2013-11-09 19:10 - 2008-02-25 13:14 - 00000012 _____ C:\Windows\bthservsdp.dat 2013-11-09 19:10 - 2006-11-02 14:01 - 00032562 _____ C:\Windows\Tasks\SCHEDLGU.TXT 2013-11-09 16:56 - 2013-11-09 16:56 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Annika\Downloads\mbam-setup-1.75.0.1300.exe 2013-11-09 16:56 - 2013-11-09 16:56 - 00000906 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2013-11-09 16:56 - 2013-11-09 16:56 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware 2013-11-09 16:44 - 2013-11-08 20:16 - 00000000 ____D C:\Program Files\BufferZone 2013-11-08 21:50 - 2013-11-08 21:50 - 00000000 ____D C:\Users\Annika\AppData\Local\AskToolbar 2013-11-08 21:49 - 2013-11-08 21:27 - 00004333 _____ C:\PERF.LOG 2013-11-08 21:49 - 2013-11-08 20:17 - 00000000 ____D C:\ProgramData\BufferZone 2013-11-08 21:47 - 2013-11-08 21:47 - 00000000 ____D C:\Users\Annika\CA81F8F9D5304DB588466B41A76AF692.TMP 2013-11-08 21:37 - 2008-01-21 08:16 - 01568592 _____ C:\Windows\system32\PerfStringBackup.INI 2013-11-08 21:29 - 2013-11-08 21:29 - 00000296 _____ C:\Windows\system32\spsys.log 2013-11-08 21:28 - 2013-11-08 20:19 - 00000000 _____ C:\LongFileName.txt 2013-11-08 20:20 - 2013-11-08 20:19 - 00000000 ____D C:\Virtual 2013-11-08 20:15 - 2013-11-08 20:14 - 17242112 _____ C:\Users\Annika\Downloads\BufferZone405Pro.msi 2013-11-08 17:10 - 2013-11-01 20:06 - 00000000 ____D C:\Users\Annika\AppData\Local\Mozilla Firefox 2013-11-06 20:01 - 2013-11-03 20:01 - 102844835 _____ C:\Windows\system32\縍ꈐᴼ 2013-11-02 20:01 - 2013-11-02 20:01 - 104684788 _____ C:\Windows\system32\ᴼ 2013-10-31 15:10 - 2013-10-31 15:10 - 104348737 _____ C:\Windows\system32\馋諳ᴼš 2013-10-30 20:01 - 2013-10-28 20:01 - 104193179 _____ C:\Windows\system32\䍈ᴼŸ 2013-10-29 16:22 - 2013-10-29 16:22 - 00001664 _____ C:\Users\Public\Desktop\iTunes.lnk 2013-10-29 16:21 - 2013-10-29 16:20 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1 2013-10-29 16:21 - 2013-10-29 16:20 - 00000000 ____D C:\Program Files\iTunes 2013-10-29 16:20 - 2013-10-29 16:20 - 00000000 ____D C:\Program Files\iPod 2013-10-29 16:20 - 2012-08-27 20:25 - 00000000 ____D C:\Program Files\Common Files\Apple 2013-10-27 21:29 - 2013-10-27 21:29 - 103533600 _____ C:\Windows\system32\�騦ᴼ§ 2013-10-18 20:02 - 2012-08-27 20:30 - 00000000 ____D C:\Users\Annika\AppData\Local\Apple Computer 2013-10-18 19:01 - 2013-10-17 19:01 - 101813202 _____ C:\Windows\system32\푸騸ᴼž 2013-10-16 19:01 - 2013-10-15 19:00 - 101406750 _____ C:\Windows\system32\尔宀ᴼœ 2013-10-14 19:00 - 2013-10-14 19:00 - 100975419 _____ C:\Windows\system32\ꑓﳪᴼš 2013-10-13 19:01 - 2013-10-12 14:59 - 100742045 _____ C:\Windows\system32\撴吇ᴼš 2013-10-12 09:15 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\Microsoft.NET 2013-10-12 08:58 - 2006-11-02 13:47 - 00404136 _____ C:\Windows\system32\FNTCACHE.DAT 2013-10-11 20:44 - 2008-02-26 11:17 - 00000000 ____D C:\ProgramData\Microsoft Help 2013-10-11 20:38 - 2013-07-15 20:05 - 00000000 ____D C:\Windows\system32\MRT 2013-10-11 20:35 - 2006-11-02 11:24 - 78106760 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe 2013-10-11 20:34 - 2009-04-24 19:31 - 00000000 ____D C:\Program Files\Microsoft Silverlight 2013-10-10 14:40 - 2011-04-23 00:43 - 00000680 _____ C:\Users\Annika\AppData\Local\d3d9caps.dat Files to move or delete: ==================== C:\Users\Annika\AppData\Roaming\desktop.ini C:\Users\Peter Reuter\AppData\Roaming\desktop.ini Some content of TEMP: ==================== C:\Users\Annika\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe ==================== Bamital & volsnap Check ================= C:\Windows\explorer.exe => MD5 is legit C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-11-09 19:21 ==================== End Of Log ============================ Meine Frage nun ob ich noch irgendwas tun muss oder ob durch das Löschen alles bereinigt ist. Liebe Grüße Annika |
| Themen zu Funde nach Routinemäßigem Malwarebytes Scan |
| adobe, antivir, avira, avira searchfree toolbar, bonjour, browser, computer, desktop, farbar, farbar recovery scan tool, firefox, flash player, frage, google, home, homepage, malware, mozilla, plug-in, registry, rundll, scan, services.exe, software, superantispyware, svchost.exe, system, temp, vista |
Baum-Darstellung