| |
| |||||||
Log-Analyse und Auswertung: Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser!Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
09.11.2013, 22:34
| #1 | ||
| |  Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser! Hallo! Ich werde nuns chon seit mehreren Wochen durch extrem nervende Werbung in meinem Browser (Firefox aber auch IE und google chrome) geplagt. Es werden automatisch irgendwelche Links in den Webseitentext generiert die vortäuschen sollen sie seien "richtige Links". Überall poppt WErbung auf, wenn ich eine Webseite eingebe, wird oft zusätzlich eine weitere/andere Webseite geöffnet. Alles sehr nervig, ein Arbeiten im browser ist nicht mehr möglich. Habe gestern versucht mit "Spybot Search and Destroy 2" der Lage Herr zuw erden. Das tool aht auch ne Menge gefunden. Hab zwar auf "Probleme lösen" geklickt und das Tool hat wohl auch, oder zumidnest angezeigt, dass die Probleme behoben wurden. Hier erstmal das log-file von "Spybot search and destroy" von gestern: Zitat:
Avira Antivirus Premium hat am 9 Sept. 2013 schonmal 10 Viren gefunden und entfernt. Hier der Log Zitat:
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 31-10-2013
Ran by Viktoria (administrator) on SOKRATES on 09-11-2013 22:00:33
Running from C:\Users\Viktoria\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\windows\system32\nvvsvc.exe
(IDT, Inc.) C:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_c06efa65923f756e\STacSV64.exe
(Hewlett-Packard) C:\windows\system32\Hpservice.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe
(NVIDIA Corporation) C:\windows\system32\nvvsvc.exe
(DigitalPersona, Inc.) c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_c06efa65923f756e\AESTSr64.exe
(LSI Corporation) C:\Program Files\LSI SoftModem\agr64svc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Hewlett-Packard Development Company, L.P) c:\Program Files (x86)\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe
(DigitalPersona, Inc.) c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe
(Dropbox, Inc.) C:\Users\Viktoria\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\Hp.Skyroom.Windows.Service.exe
( Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
( Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\VolCtrl.exe
(Hewlett-Packard Company) c:\Program Files\Hewlett-Packard\HP QuickLook\32-bit\HPDayStarterService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
( ) C:\windows\system32\lxdxcoms.exe
() C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
(Hewlett-Packard, Inc.) c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\rgsendersvc.exe
(Hewlett-Packard) c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\rgsender.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Hewlett-Packard) c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\rgsender_gui.exe
(Hewlett-Packard) c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Authentication\Hp.SkyRoom.Windows.RgsPlugin.Authentication.exe
(Hewlett-Packard) c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Lens\Hp.SkyRoom.Windows.RgsPlugin.Lens.exe
(Hewlett-Packard) c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Licensing\Hp.SkyRoom.Windows.RgsPlugin.Licensing.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(DigitalPersona, Inc.) c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
(Microsoft Corporation) C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Hewlett-Packard Development Company L.P.) C:\Program Files (x86)\Hewlett-Packard\Shared\hpCaslNotification.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe
() C:\Program Files (x86)\Hewlett-Packard\Shared\hpqToaster.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe
(Adobe Systems, Inc.) C:\windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
() C:\Users\Viktoria\Desktop\Defogger.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [IAAnotif] - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe [186904 2010-04-05] (Intel Corporation)
HKLM\...\Run: [HPPowerAssistant] - C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe [1690680 2009-11-19] (Hewlett-Packard)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1861416 2009-10-10] (Synaptics Incorporated)
HKLM\...\Run: [HPWirelessAssistant] - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2009-11-19] (Hewlett-Packard)
HKLM\...\Run: [nwiz] - nwiz.exe /installquiet
HKLM\...\Run: [NvCplDaemon] - RUNDLL32.EXE C:\windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [487424 2009-11-18] (IDT, Inc.)
HKLM\...\Run: [SpywareTerminatorShield] - C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe
HKLM\...\Run: [SpywareTerminatorUpdater] - C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe,
Winlogon\Notify\ScCertProp: C:\Windows\SysWOW64\explorer.exe (Microsoft Corporation)
HKCU\...\Run: [AutoStartNPSAgent] - C:\Program Files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe [95576 2010-07-29] (Samsung Electronics Co., Ltd.)
HKCU\...\CurrentVersion\Windows: [Load] C:\Users\Viktoria\AppData\Local\Temp\{57926~1.EXE <===== ATTENTION
MountPoints2: {1bfe2d8c-0d2d-11e2-a318-70f395957183} - E:\Startme.exe
MountPoints2: {1bfe2dd1-0d2d-11e2-a318-70f395957183} - E:\Startme.exe
MountPoints2: {315e6ab0-3acb-11e1-af40-70f395957183} - D:\Startme.exe
HKLM-x32\...\Run: [QlbCtrl.exe] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe [287800 2009-11-11] ( Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [IMSS] - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [111640 2009-11-04] ()
HKLM-x32\...\Run: [NPSStartup] - [x]
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [421160 2011-04-14] (Apple Inc.)
HKLM-x32\...\Run: [BCSSync] - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe [49208 2010-06-09] (Hewlett-Packard)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [681032 2013-10-01] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2012-10-25] (Apple Inc.)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-10-11] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [TkBellExe] - C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe [295512 2013-09-14] (RealNetworks, Inc.)
HKLM-x32\...\Run: [SDTray] - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)
AppInit_DLLs-x32: c:\progra~2\magnipic\sprote~1.dll [1046528 2013-01-24] ()
Lsa: [Notification Packages] DPPassFilter scecli
Startup: C:\Users\Viktoria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Viktoria\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://searchou.com/?id=0ac7d9fa0000000000000024d7481b75
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCOM/4
SearchScopes: HKLM - DefaultScope {C6842AF5-081F-4A21-AD5F-53CCFB0B7100} URL = hxxp://www.bing.com/search?q={searchTerms}&form=CMNTDF&pc=CMNTDF&src=IE-SearchBox
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - DefaultScope {C6842AF5-081F-4A21-AD5F-53CCFB0B7100} URL = hxxp://www.bing.com/search?q={searchTerms}&form=CMNTDF&pc=CMNTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - DefaultScope {BA052AC4-62C7-4E47-BC68-5A7ADDCEF266} URL = hxxp://searchou.com/?q={searchTerms}&id=0ac7d9fa0000000000000024d7481b75&r=4
SearchScopes: HKCU - {BA052AC4-62C7-4E47-BC68-5A7ADDCEF266} URL = hxxp://searchou.com/?q={searchTerms}&id=0ac7d9fa0000000000000024d7481b75&r=4
BHO: HP ProtectTools Security Manager Extension - {395610AE-C624-4f58-B89E-23733EA00F9A} - C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpOtsPluginIe8.dll (DigitalPersona, Inc.)
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.130\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
BHO-x32: HP ProtectTools Security Manager Extension - {395610AE-C624-4f58-B89E-23733EA00F9A} - C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpOtsPluginIe8.dll (DigitalPersona, Inc.)
BHO-x32: SwissAcademic.Citavi.Picker.IEPicker - {609D670F-B735-4da7-AC6D-F3BD358E325E} - C:\Windows\\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: MaggnnIIPic - {97CD5F00-0CD2-AF6A-24DB-FD0EB078A4CE} - C:\ProgramData\MaggnnIIPic\51609fcddcc55.dll ()
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF ProfilePath: C:\Users\Viktoria\AppData\Roaming\Mozilla\Firefox\Profiles\whqhf9c7.default
FF user.js: detected! => C:\Users\Viktoria\AppData\Roaming\Mozilla\Firefox\Profiles\whqhf9c7.default\user.js
FF SearchEngineOrder.user_pref("browser.search.order.1", "");: user_pref("browser.search.order.1", "");
FF SearchEngineOrder.user_pref("browser.search.order.1,S", "");: user_pref("browser.search.order.1,S", "");
FF Homepage: www.orf.at
FF Keyword.URL: user_pref("keyword.URL", "");
FF NetworkProxy: "type", 0
FF DefaultSearchEngine: LEO Eng-Deu
FF SelectedSearchEngine: LEO Eng-Deu
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.130\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @real.com/nppl3260;version=16.0.3.51 - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=16.0.3.51 - c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Viktoria\AppData\Roaming\Mozilla\Firefox\Profiles\whqhf9c7.default\searchplugins\privitize.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: MaggnnIIPic - C:\Users\Viktoria\AppData\Roaming\Mozilla\Firefox\Profiles\whqhf9c7.default\Extensions\k_enl@rsbpt.com
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF HKLM-x32\...\Firefox\Extensions: [otis@digitalpersona.com] - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt\
FF Extension: DigitalPersona Extension - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt\
FF HKLM-x32\...\Firefox\Extensions: [{DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\
Chrome:
=======
CHR RestoreOnStartup: ""
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.101\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.101\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.101\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) ) - C:\Program Files (x86)\Mozilla Firefox\plugins\nppl3260.dll (RealNetworks, Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll (Apple Inc.)
CHR Plugin: (RealJukebox NS Plugin) - C:\Program Files (x86)\Mozilla Firefox\plugins\nprjplug.dll No File
CHR Plugin: (RealPlayer Version Plugin) - C:\Program Files (x86)\Mozilla Firefox\plugins\nprpjplug.dll No File
CHR Plugin: (Winamp Application Detector) - C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll (Nullsoft, Inc.)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U5) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (McAfee Security Scanner +) - C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll No File
CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (RealPlayer(tm) HTML5VideoShim Plug-In (32-bit) ) - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll No File
CHR Plugin: (Shockwave Flash) - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll No File
CHR Plugin: (Java Deployment Toolkit 7.0.50.5) - C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll No File
CHR Extension: (RealDownloader) - C:\Users\Viktoria\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji\1.3.3_0
CHR Extension: (Skype Click to Call) - C:\Users\Viktoria\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.6.0.8442_0
CHR Extension: (Chrome In-App Payments service) - C:\Users\Viktoria\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0
CHR HKLM-x32\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx
==================== Services (Whitelisted) =================
R2 AESTFilters; C:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_c06efa65923f756e\AESTSr64.exe [89600 2009-03-03] (Andrea Electronics Corporation)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [948296 2013-10-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440392 2013-10-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440392 2013-10-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1164360 2013-10-01] (Avira Operations GmbH & Co. KG)
R2 DpHost; c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe [462088 2010-01-22] (DigitalPersona, Inc.)
R2 HP ProtectTools Service; c:\Program Files (x86)\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe [36864 2010-01-12] (Hewlett-Packard Development Company, L.P)
R2 Hp.Skyroom.Windows.Service; C:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\Hp.Skyroom.Windows.Service.exe [124984 2009-11-20] (Hewlett-Packard)
R2 lxdx_device; C:\windows\system32\lxdxcoms.exe [1044648 2008-02-28] ( )
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [288776 2013-09-06] (McAfee, Inc.)
R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-08-14] ()
R2 rgsender; c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\rgsendersvc.exe [379904 2009-11-19] (Hewlett-Packard, Inc.)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.)
R2 STacSV; C:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_c06efa65923f756e\STacSV64.exe [244224 2009-11-18] (IDT, Inc.)
S2 AviraUpgradeService; "C:\windows\TEMP\AVSETUP_5072a145\avupgsvc.exe" /TEMPSTART:""C:\windows\TEMP\AVSETUP_5072a145\setup.exe" /NOTEMPCLEANUP /CROSSUPGRADE"
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105856 2013-10-01] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132600 2013-10-01] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-01] (Avira Operations GmbH & Co. KG)
R3 rismcx64; C:\Windows\System32\DRIVERS\rismcx64.sys [59008 2009-07-20] (RICOH Company, Ltd.)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1805104 2009-09-18] ()
U3 ugddypob; \??\C:\Users\Viktoria\AppData\Local\Temp\ugddypob.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-11-09 22:00 - 2013-11-09 22:00 - 00000000 ____D C:\FRST
2013-11-09 21:59 - 2013-11-09 21:59 - 00000478 _____ C:\Users\Viktoria\Desktop\defogger_disable.log
2013-11-09 21:59 - 2013-11-09 21:59 - 00000000 _____ C:\Users\Viktoria\defogger_reenable
2013-11-09 21:57 - 2013-11-09 21:57 - 00050477 _____ C:\Users\Viktoria\Desktop\Defogger.exe
2013-11-09 21:56 - 2013-11-09 21:56 - 00377856 _____ C:\Users\Viktoria\Desktop\gmer_2.1.19163.exe
2013-11-09 21:55 - 2013-11-09 21:55 - 01957098 _____ (Farbar) C:\Users\Viktoria\Desktop\FRST64.exe
2013-11-09 21:53 - 2013-11-09 21:53 - 00050477 _____ C:\Users\Viktoria\Downloads\Defogger.exe
2013-11-09 21:52 - 2013-11-09 21:57 - 00000000 ____D C:\Users\Viktoria\Desktop\trojaner board
2013-11-08 10:46 - 2013-11-08 10:46 - 00000000 ____D C:\Users\Viktoria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
2013-11-08 10:31 - 2013-11-08 11:14 - 00000000 ____D C:\Users\Viktoria\Desktop\Feministisch entwickeln
2013-11-07 22:13 - 2013-11-07 22:44 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-11-07 22:13 - 2013-11-07 22:14 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2013-11-07 22:13 - 2013-11-07 22:13 - 00001383 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2013-11-07 22:13 - 2013-11-07 22:13 - 00000000 ____D C:\windows\System32\Tasks\Safer-Networking
2013-11-07 22:13 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\windows\system32\sdnclean64.exe
2013-11-07 22:11 - 2013-11-07 22:11 - 00618912 _____ C:\Users\Viktoria\Downloads\SpyBot Search Destroy - CHIP-Downloader.exe
2013-11-07 22:07 - 2013-11-07 22:07 - 00000000 ____D C:\ProgramData\Oracle
2013-11-07 22:03 - 2013-11-07 22:03 - 00312744 _____ (Oracle Corporation) C:\windows\system32\javaws.exe
2013-11-07 22:03 - 2013-11-07 22:03 - 00189352 _____ (Oracle Corporation) C:\windows\system32\javaw.exe
2013-11-07 22:03 - 2013-11-07 22:03 - 00189352 _____ (Oracle Corporation) C:\windows\system32\java.exe
2013-11-07 22:03 - 2013-11-07 22:03 - 00108968 _____ (Oracle Corporation) C:\windows\system32\WindowsAccessBridge-64.dll
2013-11-07 22:03 - 2013-11-07 22:03 - 00000000 ____D C:\Program Files\Java
2013-11-07 22:01 - 2013-11-07 22:01 - 30694824 _____ (Oracle Corporation) C:\Users\Viktoria\Downloads\jre-7u45-windows-x64.exe
2013-11-07 21:00 - 2013-11-09 09:55 - 00001035 _____ C:\windows\setupact.log
2013-11-07 21:00 - 2013-11-07 21:00 - 00000000 _____ C:\windows\setuperr.log
2013-11-07 16:26 - 2013-11-07 16:26 - 00002778 _____ C:\windows\System32\Tasks\CCleanerSkipUAC
2013-11-07 16:26 - 2013-11-07 16:26 - 00000822 _____ C:\Users\Public\Desktop\CCleaner.lnk
2013-11-07 16:26 - 2013-11-07 16:26 - 00000000 ____D C:\Program Files\CCleaner
2013-11-07 13:34 - 2013-11-07 13:34 - 00618912 _____ C:\Users\Viktoria\Downloads\CCleaner - CHIP-Downloader.exe
2013-10-30 19:47 - 2013-10-31 08:10 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-10-30 19:12 - 2013-11-07 16:28 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-10-30 18:45 - 2013-10-30 18:47 - 16805158 _____ C:\Users\Viktoria\Downloads\Hochzeitsfotos.zip
2013-10-25 11:50 - 2013-10-25 12:59 - 141025155 _____ C:\Users\Viktoria\Downloads\fotobox (1).zip
2013-10-25 11:31 - 2013-10-25 12:44 - 141025155 _____ C:\Users\Viktoria\Downloads\fotobox(1).zip
2013-10-25 11:11 - 2013-10-25 12:26 - 141025155 _____ C:\Users\Viktoria\Downloads\fotobox.zip
2013-10-23 13:34 - 2013-10-23 13:37 - 104859228 _____ C:\Users\Viktoria\Downloads\Aufnahmen - 14 Dateien.zip
2013-10-22 10:00 - 2013-10-22 10:00 - 00000000 ____D C:\Program Files\McAfee Security Scan
2013-10-10 11:09 - 2013-09-04 13:12 - 00343040 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbhub.sys
2013-10-10 11:09 - 2013-09-04 13:11 - 00325120 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbport.sys
2013-10-10 11:09 - 2013-09-04 13:11 - 00099840 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbccgp.sys
2013-10-10 11:09 - 2013-09-04 13:11 - 00052736 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbehci.sys
2013-10-10 11:09 - 2013-09-04 13:11 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbuhci.sys
2013-10-10 11:09 - 2013-09-04 13:11 - 00025600 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbohci.sys
2013-10-10 11:09 - 2013-09-04 13:11 - 00007808 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbd.sys
2013-10-10 09:38 - 2013-09-23 00:28 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2013-10-10 09:38 - 2013-09-23 00:28 - 01141248 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2013-10-10 09:38 - 2013-09-23 00:27 - 14335488 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2013-10-10 09:38 - 2013-09-23 00:27 - 13761024 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2013-10-10 09:38 - 2013-09-23 00:27 - 02876928 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2013-10-10 09:38 - 2013-09-23 00:27 - 02048512 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2013-10-10 09:38 - 2013-09-23 00:27 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2013-10-10 09:38 - 2013-09-23 00:27 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2013-10-10 09:38 - 2013-09-23 00:27 - 00391168 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2013-10-10 09:38 - 2013-09-23 00:27 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll
2013-10-10 09:38 - 2013-09-23 00:27 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2013-10-10 09:38 - 2013-09-23 00:27 - 00039424 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2013-10-10 09:38 - 2013-09-23 00:27 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2013-10-10 09:38 - 2013-09-22 23:55 - 02241024 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2013-10-10 09:38 - 2013-09-22 23:55 - 01365504 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2013-10-10 09:38 - 2013-09-22 23:55 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2013-10-10 09:38 - 2013-09-22 23:54 - 19252224 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2013-10-10 09:38 - 2013-09-22 23:54 - 15404544 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2013-10-10 09:38 - 2013-09-22 23:54 - 03959296 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2013-10-10 09:38 - 2013-09-22 23:54 - 02647552 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2013-10-10 09:38 - 2013-09-22 23:54 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2013-10-10 09:38 - 2013-09-22 23:54 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2013-10-10 09:38 - 2013-09-22 23:54 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2013-10-10 09:38 - 2013-09-22 23:54 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
2013-10-10 09:38 - 2013-09-22 23:54 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2013-10-10 09:38 - 2013-09-22 23:54 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2013-10-10 09:38 - 2013-09-22 23:54 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2013-10-10 09:38 - 2013-09-21 04:38 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2013-10-10 09:38 - 2013-09-21 04:30 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2013-10-10 09:38 - 2013-09-21 03:48 - 00089600 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe
2013-10-10 09:38 - 2013-09-21 03:39 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe
2013-10-10 09:21 - 2013-09-14 02:10 - 00497152 _____ (Microsoft Corporation) C:\windows\system32\Drivers\afd.sys
2013-10-10 09:21 - 2013-09-08 03:30 - 01903552 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tcpip.sys
2013-10-10 09:21 - 2013-09-08 03:27 - 00327168 _____ (Microsoft Corporation) C:\windows\system32\mswsock.dll
2013-10-10 09:21 - 2013-09-08 03:03 - 00231424 _____ (Microsoft Corporation) C:\windows\SysWOW64\mswsock.dll
2013-10-10 09:21 - 2013-08-29 03:17 - 05549504 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2013-10-10 09:21 - 2013-08-29 03:16 - 01732032 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll
2013-10-10 09:21 - 2013-08-29 03:16 - 00859648 _____ (Microsoft Corporation) C:\windows\system32\tdh.dll
2013-10-10 09:21 - 2013-08-29 03:16 - 00243712 _____ (Microsoft Corporation) C:\windows\system32\wow64.dll
2013-10-10 09:21 - 2013-08-29 03:13 - 00878080 _____ (Microsoft Corporation) C:\windows\system32\advapi32.dll
2013-10-10 09:21 - 2013-08-29 02:51 - 03969472 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe
2013-10-10 09:21 - 2013-08-29 02:51 - 03914176 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe
2013-10-10 09:21 - 2013-08-29 02:50 - 01292192 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll
2013-10-10 09:21 - 2013-08-29 02:50 - 00619520 _____ (Microsoft Corporation) C:\windows\SysWOW64\tdh.dll
2013-10-10 09:21 - 2013-08-29 02:50 - 00005120 _____ (Microsoft Corporation) C:\windows\SysWOW64\wow32.dll
2013-10-10 09:21 - 2013-08-29 02:48 - 00640512 _____ (Microsoft Corporation) C:\windows\SysWOW64\advapi32.dll
2013-10-10 09:21 - 2013-08-29 01:49 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\setup16.exe
2013-10-10 09:21 - 2013-08-29 01:49 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntvdm64.dll
2013-10-10 09:21 - 2013-08-29 01:49 - 00007680 _____ (Microsoft Corporation) C:\windows\SysWOW64\instnm.exe
2013-10-10 09:21 - 2013-08-29 01:49 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\user.exe
2013-10-10 09:21 - 2013-08-28 02:21 - 03155968 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2013-10-10 09:21 - 2013-08-28 02:12 - 00461312 _____ (Microsoft Corporation) C:\windows\system32\scavengeui.dll
2013-10-10 09:21 - 2013-08-01 13:09 - 00983488 _____ (Microsoft Corporation) C:\windows\system32\Drivers\dxgkrnl.sys
2013-10-10 09:21 - 2013-07-20 11:33 - 00124112 _____ (Microsoft Corporation) C:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-10 09:21 - 2013-07-20 11:33 - 00102608 _____ (Microsoft Corporation) C:\windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2013-10-10 09:21 - 2013-07-12 11:41 - 00185344 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbvideo.sys
2013-10-10 09:21 - 2013-07-12 11:41 - 00100864 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbcir.sys
2013-10-10 09:21 - 2013-07-12 11:40 - 00109824 _____ (Microsoft Corporation) C:\windows\system32\Drivers\USBAUDIO.sys
2013-10-10 09:21 - 2013-07-04 13:57 - 00259584 _____ (Microsoft Corporation) C:\windows\system32\WebClnt.dll
2013-10-10 09:21 - 2013-07-04 13:50 - 00633856 _____ (Microsoft Corporation) C:\windows\system32\comctl32.dll
2013-10-10 09:21 - 2013-07-04 13:50 - 00102400 _____ (Microsoft Corporation) C:\windows\system32\davclnt.dll
2013-10-10 09:21 - 2013-07-04 12:57 - 00205824 _____ (Microsoft Corporation) C:\windows\SysWOW64\WebClnt.dll
2013-10-10 09:21 - 2013-07-04 12:51 - 00081920 _____ (Microsoft Corporation) C:\windows\SysWOW64\davclnt.dll
2013-10-10 09:21 - 2013-07-04 12:50 - 00530432 _____ (Microsoft Corporation) C:\windows\SysWOW64\comctl32.dll
2013-10-10 09:21 - 2013-07-04 11:11 - 00140800 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxdav.sys
2013-10-10 09:21 - 2013-07-03 05:05 - 00076800 _____ (Microsoft Corporation) C:\windows\system32\Drivers\hidclass.sys
2013-10-10 09:21 - 2013-07-03 05:05 - 00032896 _____ (Microsoft Corporation) C:\windows\system32\Drivers\hidparse.sys
2013-10-10 09:21 - 2013-06-25 23:55 - 00785624 _____ (Microsoft Corporation) C:\windows\system32\Drivers\Wdf01000.sys
2013-10-10 09:21 - 2013-06-06 06:50 - 00041472 _____ (Microsoft Corporation) C:\windows\system32\lpk.dll
2013-10-10 09:21 - 2013-06-06 06:49 - 00100864 _____ (Microsoft Corporation) C:\windows\system32\fontsub.dll
2013-10-10 09:21 - 2013-06-06 06:49 - 00014336 _____ (Microsoft Corporation) C:\windows\system32\dciman32.dll
2013-10-10 09:21 - 2013-06-06 06:47 - 00046080 _____ (Adobe Systems) C:\windows\system32\atmlib.dll
2013-10-10 09:21 - 2013-06-06 05:57 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\lpk.dll
2013-10-10 09:21 - 2013-06-06 05:51 - 00070656 _____ (Microsoft Corporation) C:\windows\SysWOW64\fontsub.dll
2013-10-10 09:21 - 2013-06-06 05:50 - 00010240 _____ (Microsoft Corporation) C:\windows\SysWOW64\dciman32.dll
2013-10-10 09:21 - 2013-06-06 04:30 - 00368128 _____ (Adobe Systems Incorporated) C:\windows\system32\atmfd.dll
2013-10-10 09:21 - 2013-06-06 04:01 - 00295424 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\atmfd.dll
2013-10-10 09:21 - 2013-06-06 04:01 - 00034304 _____ (Adobe Systems) C:\windows\SysWOW64\atmlib.dll
==================== One Month Modified Files and Folders =======
2013-11-09 22:00 - 2013-11-09 22:00 - 00000000 ____D C:\FRST
2013-11-09 21:59 - 2013-11-09 21:59 - 00000478 _____ C:\Users\Viktoria\Desktop\defogger_disable.log
2013-11-09 21:59 - 2013-11-09 21:59 - 00000000 _____ C:\Users\Viktoria\defogger_reenable
2013-11-09 21:59 - 2010-10-25 18:07 - 00000000 ____D C:\Users\Viktoria
2013-11-09 21:57 - 2013-11-09 21:57 - 00050477 _____ C:\Users\Viktoria\Desktop\Defogger.exe
2013-11-09 21:57 - 2013-11-09 21:52 - 00000000 ____D C:\Users\Viktoria\Desktop\trojaner board
2013-11-09 21:56 - 2013-11-09 21:56 - 00377856 _____ C:\Users\Viktoria\Desktop\gmer_2.1.19163.exe
2013-11-09 21:55 - 2013-11-09 21:55 - 01957098 _____ (Farbar) C:\Users\Viktoria\Desktop\FRST64.exe
2013-11-09 21:53 - 2013-11-09 21:53 - 00050477 _____ C:\Users\Viktoria\Downloads\Defogger.exe
2013-11-09 21:52 - 2012-12-06 15:11 - 00000000 ____D C:\Users\Viktoria\Desktop\VL Räume, Texte, Subjekte
2013-11-09 21:48 - 2010-10-13 19:39 - 01674671 _____ C:\windows\WindowsUpdate.log
2013-11-09 21:28 - 2013-01-03 10:07 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2013-11-09 21:14 - 2010-12-28 20:53 - 00001114 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-09 10:04 - 2009-07-14 05:45 - 00020944 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-09 10:04 - 2009-07-14 05:45 - 00020944 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-09 09:57 - 2012-01-11 23:58 - 00000000 ____D C:\Users\Viktoria\AppData\Roaming\Dropbox
2013-11-09 09:57 - 2010-10-13 18:01 - 00000000 ____D C:\ProgramData\HPQLOG
2013-11-09 09:56 - 2012-01-12 00:04 - 00000000 ___RD C:\Users\Viktoria\Dropbox
2013-11-09 09:55 - 2013-11-07 21:00 - 00001035 _____ C:\windows\setupact.log
2013-11-09 09:55 - 2010-12-28 20:53 - 00001110 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-09 09:55 - 2009-07-14 06:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-11-08 21:32 - 2013-09-14 14:26 - 00003346 _____ C:\windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-2442261950-2499510287-2221387579-1000
2013-11-08 21:32 - 2013-09-14 14:26 - 00003218 _____ C:\windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-2442261950-2499510287-2221387579-1000
2013-11-08 21:25 - 2010-10-25 18:57 - 00000000 ____D C:\Users\Viktoria\AppData\Roaming\Skype
2013-11-08 17:03 - 2010-10-13 18:01 - 00659842 _____ C:\windows\system32\perfh007.dat
2013-11-08 17:03 - 2010-10-13 18:01 - 00131942 _____ C:\windows\system32\perfc007.dat
2013-11-08 17:03 - 2009-07-14 06:13 - 01507502 _____ C:\windows\system32\PerfStringBackup.INI
2013-11-08 11:34 - 2010-10-25 18:57 - 00000000 ____D C:\ProgramData\Skype
2013-11-08 11:14 - 2013-11-08 10:31 - 00000000 ____D C:\Users\Viktoria\Desktop\Feministisch entwickeln
2013-11-08 10:46 - 2013-11-08 10:46 - 00000000 ____D C:\Users\Viktoria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
2013-11-08 10:46 - 2009-07-14 04:20 - 00000000 ____D C:\windows\system32\NDF
2013-11-07 22:44 - 2013-11-07 22:13 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-11-07 22:44 - 2013-04-06 22:44 - 00000000 ____D C:\ProgramData\InstallMate
2013-11-07 22:14 - 2013-11-07 22:13 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2013-11-07 22:13 - 2013-11-07 22:13 - 00001383 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2013-11-07 22:13 - 2013-11-07 22:13 - 00000000 ____D C:\windows\System32\Tasks\Safer-Networking
2013-11-07 22:11 - 2013-11-07 22:11 - 00618912 _____ C:\Users\Viktoria\Downloads\SpyBot Search Destroy - CHIP-Downloader.exe
2013-11-07 22:07 - 2013-11-07 22:07 - 00000000 ____D C:\ProgramData\Oracle
2013-11-07 22:03 - 2013-11-07 22:03 - 00312744 _____ (Oracle Corporation) C:\windows\system32\javaws.exe
2013-11-07 22:03 - 2013-11-07 22:03 - 00189352 _____ (Oracle Corporation) C:\windows\system32\javaw.exe
2013-11-07 22:03 - 2013-11-07 22:03 - 00189352 _____ (Oracle Corporation) C:\windows\system32\java.exe
2013-11-07 22:03 - 2013-11-07 22:03 - 00108968 _____ (Oracle Corporation) C:\windows\system32\WindowsAccessBridge-64.dll
2013-11-07 22:03 - 2013-11-07 22:03 - 00000000 ____D C:\Program Files\Java
2013-11-07 22:01 - 2013-11-07 22:01 - 30694824 _____ (Oracle Corporation) C:\Users\Viktoria\Downloads\jre-7u45-windows-x64.exe
2013-11-07 21:00 - 2013-11-07 21:00 - 00000000 _____ C:\windows\setuperr.log
2013-11-07 16:30 - 2012-05-16 22:00 - 00000000 ____D C:\Users\Viktoria\AppData\Roaming\BitTorrent
2013-11-07 16:30 - 2011-04-09 10:09 - 00000000 ____D C:\Users\Viktoria\AppData\Roaming\Winamp
2013-11-07 16:29 - 2010-12-18 17:25 - 00000000 ____D C:\windows\Minidump
2013-11-07 16:29 - 2009-07-27 16:04 - 00000000 ____D C:\windows\Panther
2013-11-07 16:28 - 2013-10-30 19:12 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-07 16:26 - 2013-11-07 16:26 - 00002778 _____ C:\windows\System32\Tasks\CCleanerSkipUAC
2013-11-07 16:26 - 2013-11-07 16:26 - 00000822 _____ C:\Users\Public\Desktop\CCleaner.lnk
2013-11-07 16:26 - 2013-11-07 16:26 - 00000000 ____D C:\Program Files\CCleaner
2013-11-07 16:25 - 2010-12-28 20:53 - 00002259 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-11-07 13:34 - 2013-11-07 13:34 - 00618912 _____ C:\Users\Viktoria\Downloads\CCleaner - CHIP-Downloader.exe
2013-11-06 13:25 - 2010-11-01 08:20 - 00000000 ____D C:\Users\Viktoria\Desktop\IE
2013-11-04 10:28 - 2010-11-22 21:43 - 00000052 _____ C:\windows\SysWOW64\DOErrors.log
2013-11-02 12:54 - 2012-05-06 16:39 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-10-31 08:10 - 2013-10-30 19:47 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-10-30 18:47 - 2013-10-30 18:45 - 16805158 _____ C:\Users\Viktoria\Downloads\Hochzeitsfotos.zip
2013-10-25 12:59 - 2013-10-25 11:50 - 141025155 _____ C:\Users\Viktoria\Downloads\fotobox (1).zip
2013-10-25 12:44 - 2013-10-25 11:31 - 141025155 _____ C:\Users\Viktoria\Downloads\fotobox(1).zip
2013-10-25 12:26 - 2013-10-25 11:11 - 141025155 _____ C:\Users\Viktoria\Downloads\fotobox.zip
2013-10-23 13:37 - 2013-10-23 13:34 - 104859228 _____ C:\Users\Viktoria\Downloads\Aufnahmen - 14 Dateien.zip
2013-10-22 10:00 - 2013-10-22 10:00 - 00000000 ____D C:\Program Files\McAfee Security Scan
2013-10-22 10:00 - 2010-10-28 09:32 - 00001931 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2013-10-20 16:38 - 2010-10-25 18:57 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-10-19 18:02 - 2013-03-28 14:39 - 00000000 ____D C:\Users\Viktoria\Desktop\Filme
2013-10-17 12:23 - 2009-07-14 06:08 - 00032640 _____ C:\windows\Tasks\SCHEDLGU.TXT
2013-10-16 18:55 - 2010-10-26 02:56 - 00000000 ____D C:\windows\rescache
2013-10-14 22:09 - 2010-12-28 20:53 - 00004110 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-10-14 22:09 - 2010-12-28 20:53 - 00003858 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-10-11 13:54 - 2010-10-25 19:04 - 00000000 ____D C:\Users\Viktoria\AppData\Local\Thunderbird
2013-10-10 10:27 - 2009-07-14 05:45 - 00441264 _____ C:\windows\system32\FNTCACHE.DAT
2013-10-10 10:23 - 2012-05-13 07:26 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-10-10 10:23 - 2012-05-13 07:26 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-10-10 09:42 - 2011-10-22 22:11 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-10-10 09:32 - 2013-07-15 16:35 - 00000000 ____D C:\windows\system32\MRT
2013-10-10 09:29 - 2012-12-04 11:37 - 80541720 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2013-10-10 09:28 - 2013-10-09 20:28 - 17813896 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerInstaller.exe
2013-10-10 09:28 - 2013-01-03 10:07 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2013-10-10 09:28 - 2013-01-03 10:07 - 00003822 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2013-10-10 09:28 - 2011-11-30 00:10 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
Some content of TEMP:
====================
C:\Users\Viktoria\AppData\Local\Temp\avgnt.exe
C:\Users\Viktoria\AppData\Local\Temp\SkypeSetup.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-10-31 08:51
==================== End Of Log ============================
to be continued.... Geändert von viktoria28 (09.11.2013 um 22:40 Uhr) |
|
09.11.2013, 22:40
| #2 | ||
| |  Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser! so, und weiter gehts....
__________________Zitat:
Zitat:
lg Viki |
|
10.11.2013, 02:38
| #3 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser! Hallo und
__________________ Windows Professional und MS-Office Profesional, ist das ein gewerblich genutzter Rechner?
__________________ |
|
10.11.2013, 10:55
| #4 |
| | Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser! Hallo. der computer wird privat genützt. ich bin studentin und habe windows office (studentenangebot), den pc (mit windows 7 prof, elitebook hp ) bei einem angebot der Uni Wien gekauft. Ich hoffe das reicht euch als antwort? lg viki |
|
10.11.2013, 16:39
| #5 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser! Ok, danke für die Erklärung Malwarebytes Anti-Rootkit (MBAR) Downloade dir bitte  Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
11.11.2013, 10:24
| #6 | |
| | Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser! hallo, ich habe alles so gemacht wie beschrieben. 1 Malware wurde gefunden. mir ist noch aufgefallen, dass Avira nach dem cleanup prozess einen registry-zugriff verhindert hat (war wohl von mbar). hab den suchlauf dann nochmal wiederholt, ohne internetverbindung und ohne aktiven virenschutz. mbar hat dann jedoch nichts mehr gefunden. die links im browser und die werbung sind derzeit immer noch da. hier der log: Zitat:
viktoria der anschließende neustart hat etwas länger gedauert, da war ein dos-fenster mit system32 irgendwas. - wurde aber nicht von mbar angefordert. hab selbständig neu gestartet. links und werbung sind immer noch im browser. ich weiß, wir sind noch nciht fertig, wollte euch nur alles dokumentieren. ;-) lg viktoria |
|
11.11.2013, 12:15
| #7 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser! Avira bitte deaktivieren, MBAR erneut starten und scannen lassen
__________________ Logfiles bitte immer in CODE-Tags posten |
|
11.11.2013, 17:35
| #8 |
| | Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser! habe Avira deaktiviert und MBAR erneut scannen lassen. das ergebnis ist dasselbe: Malwarebytes Anti-Rootkit BETA 1.07.0.1007 Malwarebytes : Free Anti-Malware download Database version: v2013.10.02.12 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16721 Viktoria :: SOKRATES [administrator] 11.11.2013 16:32:53 mbar-log-2013-11-11 (16-32-53).txt Scan type: Quick scan Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken Scan options disabled: Objects scanned: 244707 Time elapsed: 17 minute(s), 38 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) Physical Sectors Detected: 0 (No malicious items detected) (end) |
|
11.11.2013, 22:05
| #9 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser! Logs bitte in CODE-Tags posten  Lesestoff:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
Adware/Junkware/Toolbars entfernen 1. Schritt: adwCleaner Downloade Dir bitte  AdwCleaner auf deinen Desktop.
2. Schritt: JRT - Junkware Removal Tool Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
3. Schritt: Frisches Log mit FRST Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ Logfiles bitte immer in CODE-Tags posten |
|
15.11.2013, 11:12
| #10 |
| | Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser! danke. hier mal die log-datei von adwcelaner: AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v3.012 - Bericht erstellt am 15/11/2013 um 10:27:11
# Updated 11/11/2013 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : Viktoria - SOKRATES
# Gestartet von : C:\Users\Viktoria\Desktop\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\clsoft ltd
Ordner Gelöscht : C:\ProgramData\MaggnnIIPic
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MaggnnIIPic
Ordner Gelöscht : C:\Program Files (x86)\Industriya
Ordner Gelöscht : C:\Program Files (x86)\MagniPic
Ordner Gelöscht : C:\Users\Viktoria\AppData\Local\Temp\OCS
Ordner Gelöscht : C:\Users\Viktoria\AppData\Roaming\Industriya
Ordner Gelöscht : C:\Users\Viktoria\AppData\Roaming\Mozilla\Firefox\Profiles\whqhf9c7.default\Extensions\k_enl@rsbpt.com
Datei Gelöscht : C:\Users\Viktoria\AppData\Roaming\Mozilla\Firefox\Profiles\whqhf9c7.default\user.js
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\privitizevpn_1_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\privitizevpn_1_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\privitizevpn_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\privitizevpn_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SP_008a99b9
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_freemind_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_freemind_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{97CD5F00-0CD2-AF6A-24DB-FD0EB078A4CE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{97CD5F00-0CD2-AF6A-24DB-FD0EB078A4CE}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{97CD5F00-0CD2-AF6A-24DB-FD0EB078A4CE}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{97CD5F00-0CD2-AF6A-24DB-FD0EB078A4CE}
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\PrivitizeVPNInstallDates
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\StartSearch
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKLM\Software\DeviceVM
Schlüssel Gelöscht : HKLM\Software\SP Global
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EB03EF39-C655-D560-FA95-79182B837D64}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\DeviceVM
***** [ Browser ] *****
-\\ Internet Explorer v10.0.9200.16736
-\\ Mozilla Firefox v25.0 (de)
[ Datei : C:\Users\Viktoria\AppData\Roaming\Mozilla\Firefox\Profiles\whqhf9c7.default\prefs.js ]
Zeile gelöscht : user_pref("aol_toolbar.default.homepage.check", false);
Zeile gelöscht : user_pref("aol_toolbar.default.search.check", false);
Zeile gelöscht : user_pref("extensions.51609fcddcb57.scode", "(function(){if(window.self.location.hostname.indexOf(\"acebook.co\")>-1){return};(function(){if(window.self==window.top&&!document.getElementById('shk85shs[...]
Zeile gelöscht : user_pref("extensions.BabylonToolbar.prtkDS", 0);
Zeile gelöscht : user_pref("extensions.BabylonToolbar.prtkHmpg", 0);
Zeile gelöscht : user_pref("extensions.privitize.srchPrvdr", "Search The Web (privitize)");
Zeile gelöscht : user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "");
Zeile gelöscht : user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", "");
Zeile gelöscht : user_pref("sweetim.toolbar.previous.browser.startup.homepage", "");
Zeile gelöscht : user_pref("sweetim.toolbar.previous.keyword.URL", "");
Zeile gelöscht : user_pref("sweetim.toolbar.scripts.1.domain-blacklist", "");
Zeile gelöscht : user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_DS", "");
Zeile gelöscht : user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_HP", "");
Zeile gelöscht : user_pref("sweetim.toolbar.searchguard.enable", "");
-\\ Google Chrome v31.0.1650.48
[ Datei : C:\Users\Viktoria\AppData\Local\Google\Chrome\User Data\Default\preferences ]
*************************
AdwCleaner[R0].txt - [5823 octets] - [15/11/2013 10:25:29]
AdwCleaner[S0].txt - [5474 octets] - [15/11/2013 10:27:11]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [5534 octets] ##########
so, nun hier das log von junkware removal tool: Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.8 (11.05.2013:1)
OS: Windows 7 Professional x64
Ran by Viktoria on 15.11.2013 at 10:34:09,54
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-21-2442261950-2499510287-2221387579-1000\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\AboutURLs\\Tabs
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{BA052AC4-62C7-4E47-BC68-5A7ADDCEF266}
~~~ Files
~~~ Folders
~~~ FireFox
Successfully deleted: [File] C:\Users\Viktoria\AppData\Roaming\mozilla\firefox\profiles\whqhf9c7.default\searchplugins\privitize.xml
Successfully deleted the following from C:\Users\Viktoria\AppData\Roaming\mozilla\firefox\profiles\whqhf9c7.default\prefs.js
user_pref("extensions.privitize.admin", false);
user_pref("extensions.privitize.aflt", "orgnl");
user_pref("extensions.privitize.appId", "{301966DF-A84B-4255-AAB9-574B5CE237E4}");
user_pref("extensions.privitize.autoRvrt", "false");
user_pref("extensions.privitize.dfltLng", "");
user_pref("extensions.privitize.dfltSrch", true);
user_pref("extensions.privitize.dnsErr", true);
user_pref("extensions.privitize.excTlbr", true);
user_pref("extensions.privitize.ffxUnstlRst", false);
user_pref("extensions.privitize.hmpg", true);
user_pref("extensions.privitize.hmpgUrl", "hxxp://searchou.com/?id=0ac7d9fa0000000000000024d7481b75");
user_pref("extensions.privitize.hpOld0", "www.orf.at");
user_pref("extensions.privitize.id", "0ac7d9fa0000000000000024d7481b75");
user_pref("extensions.privitize.instlDay", "15801");
user_pref("extensions.privitize.instlRef", "");
user_pref("extensions.privitize.kw_url", "hxxp://searchou.com/?q={searchTerms}&id=0ac7d9fa0000000000000024d7481b75");
user_pref("extensions.privitize.newTab", true);
user_pref("extensions.privitize.newTabUrl", "hxxp://searchou.com/?id=0ac7d9fa0000000000000024d7481b75");
user_pref("extensions.privitize.prdct", "privitize");
user_pref("extensions.privitize.prtnrId", "privitize");
user_pref("extensions.privitize.rvrt", "false");
user_pref("extensions.privitize.smplGrp", "none");
user_pref("extensions.privitize.tlbrId", "base");
user_pref("extensions.privitize.tlbrSrchUrl", "hxxp://searchou.com/?id=0ac7d9fa0000000000000024d7481b75&q=");
user_pref("extensions.privitize.vrsn", "1.8.16.22");
user_pref("extensions.privitize.vrsnTs", "1.8.16.2223:44:40");
user_pref("extensions.privitize.vrsni", "1.8.16.22");
Emptied folder: C:\Users\Viktoria\AppData\Roaming\mozilla\firefox\profiles\whqhf9c7.default\minidumps [197 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 15.11.2013 at 10:39:52,00
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 31-10-2013
Ran by Viktoria (administrator) on SOKRATES on 15-11-2013 10:56:39
Running from C:\Users\Viktoria\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\windows\system32\nvvsvc.exe
(IDT, Inc.) C:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_c06efa65923f756e\STacSV64.exe
(Hewlett-Packard) C:\windows\system32\Hpservice.exe
(NVIDIA Corporation) C:\windows\system32\nvvsvc.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe
(DigitalPersona, Inc.) c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_c06efa65923f756e\AESTSr64.exe
(LSI Corporation) C:\Program Files\LSI SoftModem\agr64svc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Hewlett-Packard Development Company, L.P) c:\Program Files (x86)\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\Hp.Skyroom.Windows.Service.exe
(Hewlett-Packard Company) c:\Program Files\Hewlett-Packard\HP QuickLook\32-bit\HPDayStarterService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
( ) C:\windows\system32\lxdxcoms.exe
() C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
(Hewlett-Packard, Inc.) c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\rgsendersvc.exe
(Hewlett-Packard) c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\rgsender.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Hewlett-Packard) c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Authentication\Hp.SkyRoom.Windows.RgsPlugin.Authentication.exe
(Hewlett-Packard) c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Lens\Hp.SkyRoom.Windows.RgsPlugin.Lens.exe
(Hewlett-Packard) c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Licensing\Hp.SkyRoom.Windows.RgsPlugin.Licensing.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(DigitalPersona, Inc.) c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe
(Hewlett-Packard) c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\rgsender_gui.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(DigitalPersona, Inc.) c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe
(Dropbox, Inc.) C:\Users\Viktoria\AppData\Roaming\Dropbox\bin\Dropbox.exe
( Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
( Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\VolCtrl.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
(Hewlett-Packard Development Company L.P.) C:\Program Files (x86)\Hewlett-Packard\Shared\hpCaslNotification.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
(Microsoft Corporation) C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe
(Microsoft Corporation) C:\windows\SysWOW64\notepad.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [IAAnotif] - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe [186904 2010-04-05] (Intel Corporation)
HKLM\...\Run: [HPPowerAssistant] - C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe [1690680 2009-11-19] (Hewlett-Packard)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1861416 2009-10-10] (Synaptics Incorporated)
HKLM\...\Run: [HPWirelessAssistant] - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2009-11-19] (Hewlett-Packard)
HKLM\...\Run: [nwiz] - nwiz.exe /installquiet
HKLM\...\Run: [NvCplDaemon] - RUNDLL32.EXE C:\windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [487424 2009-11-18] (IDT, Inc.)
HKLM\...\Run: [SpywareTerminatorShield] - C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe
HKLM\...\Run: [SpywareTerminatorUpdater] - C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe,
Winlogon\Notify\ScCertProp: C:\Windows\SysWOW64\explorer.exe (Microsoft Corporation)
HKCU\...\Run: [AutoStartNPSAgent] - C:\Program Files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe [95576 2010-07-29] (Samsung Electronics Co., Ltd.)
MountPoints2: {1bfe2d8c-0d2d-11e2-a318-70f395957183} - E:\Startme.exe
MountPoints2: {1bfe2dd1-0d2d-11e2-a318-70f395957183} - E:\Startme.exe
MountPoints2: {315e6ab0-3acb-11e1-af40-70f395957183} - D:\Startme.exe
HKLM-x32\...\Run: [QlbCtrl.exe] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe [287800 2009-11-11] ( Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [IMSS] - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [111640 2009-11-04] ()
HKLM-x32\...\Run: [NPSStartup] - [x]
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [421160 2011-04-14] (Apple Inc.)
HKLM-x32\...\Run: [BCSSync] - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe [49208 2010-06-09] (Hewlett-Packard)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [683576 2013-11-12] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2012-10-25] (Apple Inc.)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-10-11] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [TkBellExe] - C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe [295512 2013-09-14] (RealNetworks, Inc.)
HKLM-x32\...\Run: [SDTray] - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)
Lsa: [Notification Packages] DPPassFilter scecli
Startup: C:\Users\Viktoria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Viktoria\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN AT: Hotmail, Outlook, Messenger, Skype, Unterhaltung, Nachrichten & Lifestyle
SearchScopes: HKLM - DefaultScope {C6842AF5-081F-4A21-AD5F-53CCFB0B7100} URL = hxxp://www.bing.com/search?q={searchTerms}&form=CMNTDF&pc=CMNTDF&src=IE-SearchBox
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: HP ProtectTools Security Manager Extension - {395610AE-C624-4f58-B89E-23733EA00F9A} - C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpOtsPluginIe8.dll (DigitalPersona, Inc.)
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.130\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
BHO-x32: HP ProtectTools Security Manager Extension - {395610AE-C624-4f58-B89E-23733EA00F9A} - C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpOtsPluginIe8.dll (DigitalPersona, Inc.)
BHO-x32: SwissAcademic.Citavi.Picker.IEPicker - {609D670F-B735-4da7-AC6D-F3BD358E325E} - C:\Windows\\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 195.34.133.21 212.186.211.21
FireFox:
========
FF ProfilePath: C:\Users\Viktoria\AppData\Roaming\Mozilla\Firefox\Profiles\whqhf9c7.default
FF SearchEngineOrder.user_pref("browser.search.order.1", "");: user_pref("browser.search.order.1", "");
FF SearchEngineOrder.user_pref("browser.search.order.1,S", "");: user_pref("browser.search.order.1,S", "");
FF Homepage: news.ORF.at
FF Keyword.URL: user_pref("keyword.URL", "");
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.130\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @real.com/nppl3260;version=16.0.3.51 - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=16.0.3.51 - c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF HKLM-x32\...\Firefox\Extensions: [otis@digitalpersona.com] - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt\
FF Extension: DigitalPersona Extension - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt\
FF HKLM-x32\...\Firefox\Extensions: [{DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\
Chrome:
=======
CHR RestoreOnStartup: ""
CHR DefaultSearchURL: (Search The Web (privitize)) - hxxp://searchou.com/?q={searchTerms}&id=0ac7d9fa0000000000000024d7481b75
CHR DefaultSuggestURL: (Search The Web (privitize)) - "suggest_url": "",
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.101\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.101\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.101\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) ) - C:\Program Files (x86)\Mozilla Firefox\plugins\nppl3260.dll (RealNetworks, Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll (Apple Inc.)
CHR Plugin: (RealJukebox NS Plugin) - C:\Program Files (x86)\Mozilla Firefox\plugins\nprjplug.dll No File
CHR Plugin: (RealPlayer Version Plugin) - C:\Program Files (x86)\Mozilla Firefox\plugins\nprpjplug.dll No File
CHR Plugin: (Winamp Application Detector) - C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll (Nullsoft, Inc.)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U5) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (McAfee Security Scanner +) - C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll No File
CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (RealPlayer(tm) HTML5VideoShim Plug-In (32-bit) ) - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll No File
CHR Plugin: (Shockwave Flash) - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll No File
CHR Plugin: (Java Deployment Toolkit 7.0.50.5) - C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll No File
CHR Extension: (RealDownloader) - C:\Users\Viktoria\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji\1.3.3_0
CHR Extension: (Skype Click to Call) - C:\Users\Viktoria\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.6.0.8442_0
CHR Extension: (Chrome In-App Payments service) - C:\Users\Viktoria\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0
CHR HKLM-x32\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx
==================== Services (Whitelisted) =================
R2 AESTFilters; C:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_c06efa65923f756e\AESTSr64.exe [89600 2009-03-03] (Andrea Electronics Corporation)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [948296 2013-10-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-11-12] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-12] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1164360 2013-10-01] (Avira Operations GmbH & Co. KG)
R2 DpHost; c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe [462088 2010-01-22] (DigitalPersona, Inc.)
R2 HP ProtectTools Service; c:\Program Files (x86)\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe [36864 2010-01-12] (Hewlett-Packard Development Company, L.P)
R2 Hp.Skyroom.Windows.Service; C:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\Hp.Skyroom.Windows.Service.exe [124984 2009-11-20] (Hewlett-Packard)
R2 lxdx_device; C:\windows\system32\lxdxcoms.exe [1044648 2008-02-28] ( )
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [288776 2013-09-06] (McAfee, Inc.)
R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-08-14] ()
R2 rgsender; c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\rgsendersvc.exe [379904 2009-11-19] (Hewlett-Packard, Inc.)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.)
R2 STacSV; C:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_c06efa65923f756e\STacSV64.exe [244224 2009-11-18] (IDT, Inc.)
S2 AviraUpgradeService; "C:\windows\TEMP\AVSETUP_5072a145\avupgsvc.exe" /TEMPSTART:""C:\windows\TEMP\AVSETUP_5072a145\setup.exe" /NOTEMPCLEANUP /CROSSUPGRADE"
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [106904 2013-11-12] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132600 2013-11-12] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-01] (Avira Operations GmbH & Co. KG)
R3 rismcx64; C:\Windows\System32\DRIVERS\rismcx64.sys [59008 2009-07-20] (RICOH Company, Ltd.)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1805104 2009-09-18] ()
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-11-15 10:39 - 2013-11-15 10:39 - 00003713 _____ C:\Users\Viktoria\Desktop\JRT.txt
2013-11-15 10:34 - 2013-11-15 10:34 - 00000000 ____D C:\windows\ERUNT
2013-11-15 10:32 - 2013-11-15 10:32 - 01034531 _____ (Thisisu) C:\Users\Viktoria\Desktop\JRT.exe
2013-11-15 10:25 - 2013-11-15 10:27 - 00000000 ____D C:\AdwCleaner
2013-11-15 10:24 - 2013-11-15 10:24 - 01085542 _____ C:\Users\Viktoria\Desktop\adwcleaner.exe
2013-11-14 16:40 - 2013-11-14 16:40 - 00816288 _____ C:\windows\Minidump\111413-30108-01.dmp
2013-11-14 13:30 - 2013-11-14 13:30 - 00000000 ____D C:\Users\Viktoria\Desktop\Blumfeld Media
2013-11-14 00:32 - 2013-10-12 09:45 - 02241536 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2013-11-14 00:32 - 2013-10-12 09:45 - 01364992 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2013-11-14 00:32 - 2013-10-12 09:45 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2013-11-14 00:32 - 2013-10-12 09:43 - 19269632 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2013-11-14 00:32 - 2013-10-12 09:43 - 15404544 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2013-11-14 00:32 - 2013-10-12 09:43 - 03959808 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2013-11-14 00:32 - 2013-10-12 09:43 - 02648576 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2013-11-14 00:32 - 2013-10-12 09:43 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2013-11-14 00:32 - 2013-10-12 09:43 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2013-11-14 00:32 - 2013-10-12 09:43 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2013-11-14 00:32 - 2013-10-12 09:43 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
2013-11-14 00:32 - 2013-10-12 09:43 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2013-11-14 00:32 - 2013-10-12 09:43 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2013-11-14 00:32 - 2013-10-12 09:43 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2013-11-14 00:32 - 2013-10-12 08:03 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2013-11-14 00:32 - 2013-10-12 08:03 - 01138176 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2013-11-14 00:32 - 2013-10-12 08:02 - 14355968 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2013-11-14 00:32 - 2013-10-12 08:02 - 13761024 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2013-11-14 00:32 - 2013-10-12 08:02 - 02877952 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2013-11-14 00:32 - 2013-10-12 08:02 - 02049024 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2013-11-14 00:32 - 2013-10-12 08:02 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2013-11-14 00:32 - 2013-10-12 08:02 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2013-11-14 00:32 - 2013-10-12 08:02 - 00391168 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2013-11-14 00:32 - 2013-10-12 08:02 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll
2013-11-14 00:32 - 2013-10-12 08:02 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2013-11-14 00:32 - 2013-10-12 08:02 - 00039424 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2013-11-14 00:32 - 2013-10-12 08:02 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2013-11-14 00:32 - 2013-10-12 07:35 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2013-11-14 00:32 - 2013-10-12 07:08 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2013-11-14 00:32 - 2013-10-12 06:44 - 00089600 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe
2013-11-14 00:32 - 2013-10-12 06:15 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe
2013-11-13 18:16 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\windows\system32\nshwfp.dll
2013-11-13 18:16 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\windows\system32\IKEEXT.DLL
2013-11-13 18:16 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\windows\system32\FWPUCLNT.DLL
2013-11-13 18:16 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\windows\SysWOW64\nshwfp.dll
2013-11-13 18:16 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\windows\SysWOW64\FWPUCLNT.DLL
2013-11-13 18:16 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll
2013-11-13 18:16 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\windows\SysWOW64\crypt32.dll
2013-11-13 18:16 - 2013-10-04 03:28 - 00190464 _____ (Microsoft Corporation) C:\windows\system32\SmartcardCredentialProvider.dll
2013-11-13 18:16 - 2013-10-04 03:25 - 00197120 _____ (Microsoft Corporation) C:\windows\system32\credui.dll
2013-11-13 18:16 - 2013-10-04 03:24 - 01930752 _____ (Microsoft Corporation) C:\windows\system32\authui.dll
2013-11-13 18:16 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\windows\SysWOW64\SmartcardCredentialProvider.dll
2013-11-13 18:16 - 2013-10-04 02:56 - 01796096 _____ (Microsoft Corporation) C:\windows\SysWOW64\authui.dll
2013-11-13 18:16 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\credui.dll
2013-11-13 18:16 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\windows\system32\gdi32.dll
2013-11-13 18:16 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\windows\SysWOW64\gdi32.dll
2013-11-13 18:16 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\windows\system32\Drivers\afd.sys
2013-11-13 18:16 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
2013-11-13 18:16 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys
2013-11-13 18:16 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll
2013-11-13 18:16 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll
2013-11-13 18:16 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll
2013-11-13 18:16 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2013-11-13 18:16 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
2013-11-13 18:16 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll
2013-11-13 18:16 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\sspicli.dll
2013-11-13 18:16 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
2013-11-13 18:16 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\windows\SysWOW64\secur32.dll
2013-11-13 18:16 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncrypt.dll
2013-11-13 18:16 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe
2013-11-13 18:16 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\windows\system32\Drivers\cng.sys
2013-11-11 17:31 - 2013-11-11 17:31 - 00000000 ____D C:\Users\Viktoria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
2013-11-11 16:23 - 2013-11-14 16:40 - 526569088 _____ C:\windows\MEMORY.DMP
2013-11-11 16:23 - 2013-11-11 16:23 - 00294232 _____ C:\windows\Minidump\111113-25428-01.dmp
2013-11-11 09:26 - 2013-11-11 17:29 - 00116440 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2013-11-11 09:26 - 2013-11-11 17:29 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-11-11 09:26 - 2013-11-11 09:26 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-11 09:25 - 2013-11-11 17:29 - 00091352 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2013-11-11 09:24 - 2013-11-11 17:30 - 00000000 ____D C:\Users\Viktoria\Desktop\mbar
2013-11-11 09:22 - 2013-11-11 09:22 - 12576792 _____ (Malwarebytes Corp.) C:\Users\Viktoria\Desktop\mbar-1.07.0.1007.exe
2013-11-09 22:16 - 2013-11-07 22:43 - 00020185 _____ C:\Users\Viktoria\Desktop\Checks.131107-2243.txt
2013-11-09 22:13 - 2013-11-09 22:13 - 00006821 _____ C:\Users\Viktoria\Desktop\Gmer.log
2013-11-09 22:02 - 2013-11-09 22:03 - 00031225 _____ C:\Users\Viktoria\Desktop\Addition.txt
2013-11-09 22:00 - 2013-11-09 22:00 - 00000000 ____D C:\FRST
2013-11-09 21:59 - 2013-11-09 21:59 - 00000478 _____ C:\Users\Viktoria\Desktop\defogger_disable.log
2013-11-09 21:59 - 2013-11-09 21:59 - 00000000 _____ C:\Users\Viktoria\defogger_reenable
2013-11-09 21:57 - 2013-11-09 21:57 - 00050477 _____ C:\Users\Viktoria\Desktop\Defogger.exe
2013-11-09 21:56 - 2013-11-09 21:56 - 00377856 _____ C:\Users\Viktoria\Desktop\gmer_2.1.19163.exe
2013-11-09 21:55 - 2013-11-09 21:55 - 01957098 _____ (Farbar) C:\Users\Viktoria\Desktop\FRST64.exe
2013-11-09 21:53 - 2013-11-09 21:53 - 00050477 _____ C:\Users\Viktoria\Downloads\Defogger.exe
2013-11-09 21:52 - 2013-11-11 09:23 - 00000000 ____D C:\Users\Viktoria\Desktop\trojaner board
2013-11-08 10:31 - 2013-11-08 11:14 - 00000000 ____D C:\Users\Viktoria\Desktop\Feministisch entwickeln
2013-11-07 22:13 - 2013-11-07 22:44 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-11-07 22:13 - 2013-11-07 22:14 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2013-11-07 22:13 - 2013-11-07 22:13 - 00001383 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2013-11-07 22:13 - 2013-11-07 22:13 - 00000000 ____D C:\windows\System32\Tasks\Safer-Networking
2013-11-07 22:13 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\windows\system32\sdnclean64.exe
2013-11-07 22:11 - 2013-11-07 22:11 - 00618912 _____ C:\Users\Viktoria\Downloads\SpyBot Search Destroy - CHIP-Downloader.exe
2013-11-07 22:07 - 2013-11-07 22:07 - 00000000 ____D C:\ProgramData\Oracle
2013-11-07 22:03 - 2013-11-07 22:03 - 00312744 _____ (Oracle Corporation) C:\windows\system32\javaws.exe
2013-11-07 22:03 - 2013-11-07 22:03 - 00189352 _____ (Oracle Corporation) C:\windows\system32\javaw.exe
2013-11-07 22:03 - 2013-11-07 22:03 - 00189352 _____ (Oracle Corporation) C:\windows\system32\java.exe
2013-11-07 22:03 - 2013-11-07 22:03 - 00108968 _____ (Oracle Corporation) C:\windows\system32\WindowsAccessBridge-64.dll
2013-11-07 22:03 - 2013-11-07 22:03 - 00000000 ____D C:\Program Files\Java
2013-11-07 22:01 - 2013-11-07 22:01 - 30694824 _____ (Oracle Corporation) C:\Users\Viktoria\Downloads\jre-7u45-windows-x64.exe
2013-11-07 21:00 - 2013-11-15 10:28 - 00001819 _____ C:\windows\setupact.log
2013-11-07 21:00 - 2013-11-07 21:00 - 00000000 _____ C:\windows\setuperr.log
2013-11-07 16:26 - 2013-11-07 16:26 - 00002778 _____ C:\windows\System32\Tasks\CCleanerSkipUAC
2013-11-07 16:26 - 2013-11-07 16:26 - 00000822 _____ C:\Users\Public\Desktop\CCleaner.lnk
2013-11-07 16:26 - 2013-11-07 16:26 - 00000000 ____D C:\Program Files\CCleaner
2013-11-07 13:34 - 2013-11-07 13:34 - 00618912 _____ C:\Users\Viktoria\Downloads\CCleaner - CHIP-Downloader.exe
2013-10-30 19:47 - 2013-10-31 08:10 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-10-30 19:12 - 2013-11-07 16:28 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-10-30 18:45 - 2013-10-30 18:47 - 16805158 _____ C:\Users\Viktoria\Downloads\Hochzeitsfotos.zip
2013-10-25 11:50 - 2013-10-25 12:59 - 141025155 _____ C:\Users\Viktoria\Downloads\fotobox (1).zip
2013-10-25 11:31 - 2013-10-25 12:44 - 141025155 _____ C:\Users\Viktoria\Downloads\fotobox(1).zip
2013-10-25 11:11 - 2013-10-25 12:26 - 141025155 _____ C:\Users\Viktoria\Downloads\fotobox.zip
2013-10-23 13:34 - 2013-10-23 13:37 - 104859228 _____ C:\Users\Viktoria\Downloads\Aufnahmen - 14 Dateien.zip
2013-10-22 10:00 - 2013-10-22 10:00 - 00000000 ____D C:\Program Files\McAfee Security Scan
==================== One Month Modified Files and Folders =======
2013-11-15 10:39 - 2013-11-15 10:39 - 00003713 _____ C:\Users\Viktoria\Desktop\JRT.txt
2013-11-15 10:36 - 2009-07-14 05:45 - 00020944 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-15 10:36 - 2009-07-14 05:45 - 00020944 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-15 10:34 - 2013-11-15 10:34 - 00000000 ____D C:\windows\ERUNT
2013-11-15 10:33 - 2010-10-13 19:39 - 01966749 _____ C:\windows\WindowsUpdate.log
2013-11-15 10:32 - 2013-11-15 10:32 - 01034531 _____ (Thisisu) C:\Users\Viktoria\Desktop\JRT.exe
2013-11-15 10:30 - 2012-01-12 00:04 - 00000000 ___RD C:\Users\Viktoria\Dropbox
2013-11-15 10:30 - 2012-01-11 23:58 - 00000000 ____D C:\Users\Viktoria\AppData\Roaming\Dropbox
2013-11-15 10:29 - 2010-12-28 20:53 - 00001110 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-15 10:29 - 2010-10-13 18:01 - 00000000 ____D C:\ProgramData\HPQLOG
2013-11-15 10:28 - 2013-11-07 21:00 - 00001819 _____ C:\windows\setupact.log
2013-11-15 10:28 - 2013-01-03 10:07 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2013-11-15 10:28 - 2009-07-14 06:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-11-15 10:27 - 2013-11-15 10:25 - 00000000 ____D C:\AdwCleaner
2013-11-15 10:24 - 2013-11-15 10:24 - 01085542 _____ C:\Users\Viktoria\Desktop\adwcleaner.exe
2013-11-14 19:14 - 2010-12-28 20:53 - 00001114 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-14 16:40 - 2013-11-14 16:40 - 00816288 _____ C:\windows\Minidump\111413-30108-01.dmp
2013-11-14 16:40 - 2013-11-11 16:23 - 526569088 _____ C:\windows\MEMORY.DMP
2013-11-14 16:40 - 2010-12-18 17:25 - 00000000 ____D C:\windows\Minidump
2013-11-14 13:30 - 2013-11-14 13:30 - 00000000 ____D C:\Users\Viktoria\Desktop\Blumfeld Media
2013-11-14 09:42 - 2010-10-13 18:01 - 00659842 _____ C:\windows\system32\perfh007.dat
2013-11-14 09:42 - 2010-10-13 18:01 - 00131942 _____ C:\windows\system32\perfc007.dat
2013-11-14 09:42 - 2009-07-14 06:13 - 01507502 _____ C:\windows\system32\PerfStringBackup.INI
2013-11-14 09:36 - 2009-07-27 16:04 - 00000000 ____D C:\windows\Panther
2013-11-14 00:33 - 2011-10-22 22:11 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-11-14 00:31 - 2013-07-15 16:35 - 00000000 ____D C:\windows\system32\MRT
2013-11-14 00:29 - 2012-12-04 11:37 - 82896128 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2013-11-14 00:20 - 2010-10-25 18:57 - 00000000 ____D C:\Users\Viktoria\AppData\Roaming\Skype
2013-11-12 23:40 - 2012-12-06 15:11 - 00000000 ____D C:\Users\Viktoria\Desktop\VL Räume, Texte, Subjekte
2013-11-12 20:28 - 2010-12-28 20:53 - 00002175 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-11-12 11:54 - 2013-03-25 13:51 - 00132600 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys
2013-11-12 11:54 - 2013-03-25 13:51 - 00106904 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys
2013-11-11 17:31 - 2013-11-11 17:31 - 00000000 ____D C:\Users\Viktoria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
2013-11-11 17:30 - 2013-11-11 09:24 - 00000000 ____D C:\Users\Viktoria\Desktop\mbar
2013-11-11 17:29 - 2013-11-11 09:26 - 00116440 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2013-11-11 17:29 - 2013-11-11 09:26 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-11-11 17:29 - 2013-11-11 09:25 - 00091352 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2013-11-11 16:23 - 2013-11-11 16:23 - 00294232 _____ C:\windows\Minidump\111113-25428-01.dmp
2013-11-11 10:08 - 2010-11-22 21:43 - 00000052 _____ C:\windows\SysWOW64\DOErrors.log
2013-11-11 09:26 - 2013-11-11 09:26 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-11 09:23 - 2013-11-09 21:52 - 00000000 ____D C:\Users\Viktoria\Desktop\trojaner board
2013-11-11 09:22 - 2013-11-11 09:22 - 12576792 _____ (Malwarebytes Corp.) C:\Users\Viktoria\Desktop\mbar-1.07.0.1007.exe
2013-11-09 22:13 - 2013-11-09 22:13 - 00006821 _____ C:\Users\Viktoria\Desktop\Gmer.log
2013-11-09 22:03 - 2013-11-09 22:02 - 00031225 _____ C:\Users\Viktoria\Desktop\Addition.txt
2013-11-09 22:00 - 2013-11-09 22:00 - 00000000 ____D C:\FRST
2013-11-09 21:59 - 2013-11-09 21:59 - 00000478 _____ C:\Users\Viktoria\Desktop\defogger_disable.log
2013-11-09 21:59 - 2013-11-09 21:59 - 00000000 _____ C:\Users\Viktoria\defogger_reenable
2013-11-09 21:59 - 2010-10-25 18:07 - 00000000 ____D C:\Users\Viktoria
2013-11-09 21:57 - 2013-11-09 21:57 - 00050477 _____ C:\Users\Viktoria\Desktop\Defogger.exe
2013-11-09 21:56 - 2013-11-09 21:56 - 00377856 _____ C:\Users\Viktoria\Desktop\gmer_2.1.19163.exe
2013-11-09 21:55 - 2013-11-09 21:55 - 01957098 _____ (Farbar) C:\Users\Viktoria\Desktop\FRST64.exe
2013-11-09 21:53 - 2013-11-09 21:53 - 00050477 _____ C:\Users\Viktoria\Downloads\Defogger.exe
2013-11-08 21:32 - 2013-09-14 14:26 - 00003346 _____ C:\windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-2442261950-2499510287-2221387579-1000
2013-11-08 21:32 - 2013-09-14 14:26 - 00003218 _____ C:\windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-2442261950-2499510287-2221387579-1000
2013-11-08 11:34 - 2010-10-25 18:57 - 00000000 ____D C:\ProgramData\Skype
2013-11-08 11:14 - 2013-11-08 10:31 - 00000000 ____D C:\Users\Viktoria\Desktop\Feministisch entwickeln
2013-11-08 10:46 - 2009-07-14 04:20 - 00000000 ____D C:\windows\system32\NDF
2013-11-07 22:44 - 2013-11-07 22:13 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-11-07 22:44 - 2013-04-06 22:44 - 00000000 ____D C:\ProgramData\InstallMate
2013-11-07 22:43 - 2013-11-09 22:16 - 00020185 _____ C:\Users\Viktoria\Desktop\Checks.131107-2243.txt
2013-11-07 22:14 - 2013-11-07 22:13 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2013-11-07 22:13 - 2013-11-07 22:13 - 00001383 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2013-11-07 22:13 - 2013-11-07 22:13 - 00000000 ____D C:\windows\System32\Tasks\Safer-Networking
2013-11-07 22:11 - 2013-11-07 22:11 - 00618912 _____ C:\Users\Viktoria\Downloads\SpyBot Search Destroy - CHIP-Downloader.exe
2013-11-07 22:07 - 2013-11-07 22:07 - 00000000 ____D C:\ProgramData\Oracle
2013-11-07 22:03 - 2013-11-07 22:03 - 00312744 _____ (Oracle Corporation) C:\windows\system32\javaws.exe
2013-11-07 22:03 - 2013-11-07 22:03 - 00189352 _____ (Oracle Corporation) C:\windows\system32\javaw.exe
2013-11-07 22:03 - 2013-11-07 22:03 - 00189352 _____ (Oracle Corporation) C:\windows\system32\java.exe
2013-11-07 22:03 - 2013-11-07 22:03 - 00108968 _____ (Oracle Corporation) C:\windows\system32\WindowsAccessBridge-64.dll
2013-11-07 22:03 - 2013-11-07 22:03 - 00000000 ____D C:\Program Files\Java
2013-11-07 22:01 - 2013-11-07 22:01 - 30694824 _____ (Oracle Corporation) C:\Users\Viktoria\Downloads\jre-7u45-windows-x64.exe
2013-11-07 21:00 - 2013-11-07 21:00 - 00000000 _____ C:\windows\setuperr.log
2013-11-07 16:30 - 2012-05-16 22:00 - 00000000 ____D C:\Users\Viktoria\AppData\Roaming\BitTorrent
2013-11-07 16:30 - 2011-04-09 10:09 - 00000000 ____D C:\Users\Viktoria\AppData\Roaming\Winamp
2013-11-07 16:28 - 2013-10-30 19:12 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-07 16:26 - 2013-11-07 16:26 - 00002778 _____ C:\windows\System32\Tasks\CCleanerSkipUAC
2013-11-07 16:26 - 2013-11-07 16:26 - 00000822 _____ C:\Users\Public\Desktop\CCleaner.lnk
2013-11-07 16:26 - 2013-11-07 16:26 - 00000000 ____D C:\Program Files\CCleaner
2013-11-07 13:34 - 2013-11-07 13:34 - 00618912 _____ C:\Users\Viktoria\Downloads\CCleaner - CHIP-Downloader.exe
2013-11-06 13:25 - 2010-11-01 08:20 - 00000000 ____D C:\Users\Viktoria\Desktop\IE
2013-11-02 12:54 - 2012-05-06 16:39 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-10-31 08:10 - 2013-10-30 19:47 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-10-30 18:47 - 2013-10-30 18:45 - 16805158 _____ C:\Users\Viktoria\Downloads\Hochzeitsfotos.zip
2013-10-25 12:59 - 2013-10-25 11:50 - 141025155 _____ C:\Users\Viktoria\Downloads\fotobox (1).zip
2013-10-25 12:44 - 2013-10-25 11:31 - 141025155 _____ C:\Users\Viktoria\Downloads\fotobox(1).zip
2013-10-25 12:26 - 2013-10-25 11:11 - 141025155 _____ C:\Users\Viktoria\Downloads\fotobox.zip
2013-10-23 13:37 - 2013-10-23 13:34 - 104859228 _____ C:\Users\Viktoria\Downloads\Aufnahmen - 14 Dateien.zip
2013-10-22 10:00 - 2013-10-22 10:00 - 00000000 ____D C:\Program Files\McAfee Security Scan
2013-10-22 10:00 - 2010-10-28 09:32 - 00001931 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2013-10-20 16:38 - 2010-10-25 18:57 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-10-19 18:02 - 2013-03-28 14:39 - 00000000 ____D C:\Users\Viktoria\Desktop\Filme
2013-10-17 12:23 - 2009-07-14 06:08 - 00032640 _____ C:\windows\Tasks\SCHEDLGU.TXT
2013-10-16 18:55 - 2010-10-26 02:56 - 00000000 ____D C:\windows\rescache
Some content of TEMP:
====================
C:\Users\Viktoria\AppData\Local\Temp\avgnt.exe
C:\Users\Viktoria\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\Viktoria\AppData\Local\Temp\Quarantine.exe
C:\Users\Viktoria\AppData\Local\Temp\SkypeSetup.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-11-10 15:45
==================== End Of Log ============================
--- --- --- --- --- --- --- --- --- --- --- --- und hier noch zu guter letzt die addition.txt: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 31-10-2013
Ran by Viktoria at 2013-11-15 11:10:16
Running from C:\Users\Viktoria\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
==================== Installed Programs ======================
toolbar on IE and Chrome (x32 Version: 1.8.16.22)
ABBYY FineReader 6.0 Sprint (x32 Version: 6.00.2201.41622)
ActiveCheck component for HP Active Support Library (x32 Version: 3.0.0.3)
Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.117)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.117)
Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03)
AIMP2 (x32)
Apple Application Support (x32 Version: 2.3)
Apple Mobile Device Support (Version: 3.4.0.25)
Apple Software Update (x32 Version: 2.1.3.127)
Audacity 1.2.6 (x32)
Audacity Recovery Utility (x32)
Avira Antivirus Premium (x32 Version: 14.0.1.719)
BitTorrent (x32 Version: 7.8.0.29463)
Bonjour (Version: 2.0.5.0)
CCleaner (Version: 4.07)
Cisco AnyConnect VPN Client (x32 Version: 2.5.0217)
Citavi (x32 Version: 3.3.0.0)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32)
Dropbox (HKCU Version: 2.0.22)
EasyBits GO (HKCU)
FreeMind (x32 Version: 0.9.0)
GIMP 2.6.11 (x32 Version: 2.6.11)
Google Chrome (x32 Version: 31.0.1650.48)
Google Drive (x32 Version: 1.12.5329.1887)
Google Update Helper (x32 Version: 1.3.21.165)
HP 3D DriveGuard (Version: 4.0.4.1)
HP Business Card Reader (x32 Version: 0.6.3.0)
HP Customer Experience Enhancements (x32 Version: 6.0.1.3)
HP Documentation (x32 Version: 1.1.0.0)
HP ESU for Microsoft Windows 7 (x32 Version: 1.0.5.1)
HP Integrated Module with Bluetooth wireless technology (Version: 6.2.1.500)
HP Officejet Pro 8500 A910 - Grundlegende Software für das Gerät (Version: 22.50.231.0)
HP Officejet Pro 8500 A910 Hilfe (x32 Version: 140.0.2.2)
HP Power Assistant (Version: 1.0.2.4)
HP Power Data (Version: 1.0.5.74)
HP ProtectTools Security Manager (Version: 5.04.669)
HP Quick Launch Buttons (x32 Version: 6.50.12.1)
HP QuickLook (Version: 3.3.1.4)
HP QuickWeb (x32 Version: 1.0.1.48)
HP Setup (x32 Version: 1.2.3557.3169)
HP SkyRoom (x32 Version: 1.1.4.4794.)
HP SoftPaq Download Manager (x32 Version: 3.0.5.0)
HP Software Framework (x32 Version: 4.0.112.1)
HP Software Setup (x32 Version: 7.0.1.5)
HP Support Assistant (x32 Version: 4.4.6.3)
HP Update (x32 Version: 5.002.006.003)
HP Wallpaper (x32 Version: 1.0.1.3)
HP Web Camera (Version: 1.0.0)
HP Webcam (x32 Version: 1.0)
HP Webcam Driver (x32 Version: 5.8.50009.1)
HP Wireless Assistant (Version: 4.0.2.4)
HPAsset component for HP Active Support Library (x32 Version: 3.0.2.2)
I.R.I.S. OCR (x32 Version: 12.3.4.0)
IDT Audio (x32 Version: 1.0.6257.0)
Intel(R) Management Engine Components (x32 Version: 6.0.0.1179)
Intel(R) Network Connections Drivers (Version: 14.8)
Intel(R) Turbo Boost Technology Driver (x32 Version: 01.02.00.1002)
Intel® Matrix Storage Manager
iTunes (Version: 10.2.2.12)
Java 7 Update 25 (x32 Version: 7.0.250)
Java 7 Update 45 (64-bit) (Version: 7.0.450)
Java Auto Updater (x32 Version: 2.1.9.5)
Java(TM) 6 Update 23 (x32 Version: 6.0.230)
LSI HDA Modem (Version: 2.2.97)
MagniPic (Version: 1.0)
McAfee Security Scan Plus (Version: 3.8.130.8)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft Office 2010 Service Pack 1 (SP1) (x32)
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Groove MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office InfoPath MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.6029.1000)
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Professional Plus 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Silverlight (Version: 5.1.20913.0)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.59192)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Mozilla Firefox 25.0 (x86 de) (x32 Version: 25.0)
Mozilla Maintenance Service (x32 Version: 24.1.0)
Mozilla Thunderbird 24.1.0 (x86 de) (x32 Version: 24.1.0)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
NVIDIA Drivers (Version: 1.10)
NVIDIA nView Desktop Manager (Version: 6.14.10.12133)
Pre-Boot Security for HP ProtectTools (Version: 5.0.7.1)
QLBCASL (x32 Version: 6.40.17.2)
QuickTime (x32 Version: 7.73.80.64)
RealDownloader (x32 Version: 1.3.3)
RealNetworks - Microsoft Visual C++ 2008 Runtime (x32 Version: 9.0)
RealNetworks - Microsoft Visual C++ 2010 Runtime (x32 Version: 10.0)
RealPlayer (x32 Version: 16.0.3)
RealUpgrade 1.1 (x32 Version: 1.1.0)
Remote Graphics Receiver (x32 Version: 5.3.2)
Remote Graphics Sender (x32 Version: 5.3.2)
RICOH Media Driver (x32 Version: 2.13.00.05)
Samsung Mobile phone USB driver Drive Software
Samsung New PC Studio (x32 Version: 1.00.0000)
Samsung New PC Studio USB Driver Installer (x32 Version: 1.00.0000)
SAMSUNG USB Driver for Mobile Phones (Version: 1.3.650.0)
Skype Click to Call (x32 Version: 5.6.8442)
Skype™ 6.10 (x32 Version: 6.10.104)
Sony Ericsson Update Engine (x32 Version: 2.12.15.18)
Sony PC Companion 2.10.165 (x32 Version: 2.10.165)
Spybot - Search & Destroy (x32 Version: 2.2.25)
Synaptics Pointing Device Driver (Version: 14.0.10.0)
Theft Recovery (x32 Version: 5.1.0.18)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (x32)
Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553065) (x32)
Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2566458) (x32)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2687503) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2825640) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition (x32)
Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition (x32)
Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition (x32)
Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition (x32)
Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition (x32)
Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (x32)
Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition (x32)
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (x32)
Update for Microsoft Word 2010 (KB2827323) 32-Bit Edition (x32)
UploadTool is a program which uploads pictures to the well known me-on.net service. (x32 Version: 3.0.7)
Validity Fingerprint Driver (Version: 4.0.8.0)
VLC media player 1.1.10 (x32 Version: 1.1.10)
Winamp (x32 Version: 5.61 )
Winamp Erkennungs-Plug-in (HKCU Version: 1.0.0.1)
Windows 7 Default Setting (x32 Version: 1.0.1.4)
Windows Driver Package - Broadcom Bluetooth (06/15/2009 6.2.0.9000) (Version: 06/15/2009 6.2.0.9000)
Windows Driver Package - Broadcom Bluetooth (07/30/2009 6.2.0.9405) (Version: 07/30/2009 6.2.0.9405)
Windows Driver Package - Broadcom HIDClass (07/28/2009 6.2.0.9800) (Version: 07/28/2009 6.2.0.9800)
Windows Live ID Sign-in Assistant (Version: 6.500.3165.0)
WinRAR 4.20 (32-bit) (x32 Version: 4.20.0)
==================== Restore Points =========================
07-11-2013 21:02:38 Installed Java 7 Update 45 (64-bit)
11-11-2013 08:48:33 Malwarebytes Anti-Rootkit Restore Point
13-11-2013 23:27:33 Windows Update
==================== Hosts content: ==========================
2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {08546823-5010-4705-BD12-7CD55EE37284} - System32\Tasks\{CFF73398-BD5D-4118-8FDC-D9799FD0D35D} => C:\Program Files (x86)\Skype\\Phone\Skype.exe [2013-10-21] (Skype Technologies S.A.)
Task: {0B4B6899-1E3B-461B-8676-B67E7D157F4D} - System32\Tasks\Installation App Launcher => C:\Program Files (x86)\Lexmark 3600-4600 Series\lxdxamon.exe
Task: {34DDB2A7-D033-4A92-9537-A739363B3479} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-2442261950-2499510287-2221387579-1000 => C:\Program Files (x86)\Real\RealUpgrade\realupgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {453839BE-4941-40FA-8471-82C8CE0B43D0} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe
Task: {5DD7F667-C549-4811-B912-FAC95F4F312F} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2010-11-20] (Microsoft Corporation)
Task: {6368D4F2-6790-4FE2-B443-F95CC476E895} - System32\Tasks\{4D7C8BA2-77A4-425D-A715-2F5BAD15A3E5} => Firefox.exe Skype Privacy Policy
Task: {6AAF69DC-AD4E-4BC6-82A2-BFC0689768C6} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-10-22] (Piriform Ltd)
Task: {7053C7C8-415F-4D38-8C03-FEFBBC6F7633} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe
Task: {81CE45E9-AF49-485F-8B63-C28127621D50} - System32\Tasks\Hewlett-Packard\HP Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2010-03-24] (Hewlett-Packard)
Task: {88DD4252-376D-4A86-93B7-379E675753E5} - System32\Tasks\Hewlett-Packard\HP Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2010-03-24] (Hewlett-Packard)
Task: {958777C0-01A2-40CC-B232-43B5A3886EE4} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {9D3BE14E-9682-4787-A889-91211B83B9BC} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-2442261950-2499510287-2221387579-1000 => C:\Program Files (x86)\Real\RealUpgrade\realupgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {9DFAF9E5-73D7-43DD-810D-A4807E21DFD4} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HPSAObjUtilTask => C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\UtilTask.exe [2013-10-22] (Microsoft)
Task: {ABC91409-D6E1-4263-9EF4-1BF29A745499} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-2442261950-2499510287-2221387579-1000 => C:\Program Files (x86)\Real\RealUpgrade\realupgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {B7734EB8-FCA7-4104-B066-F42150056A0D} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {BE4F24DB-2A15-4786-AC8E-ABFA4015AC34} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-12-28] (Google Inc.)
Task: {D72CEFB5-B842-4C79-8DD5-A33895676144} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe
Task: {E093552B-C2B8-4F2B-BEE2-4B3395324995} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-2442261950-2499510287-2221387579-1000 => C:\Program Files (x86)\Real\RealUpgrade\realupgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {EE400641-0326-4954-A1FA-D3CBDAD76537} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-10] (Adobe Systems Incorporated)
Task: {F5950434-834D-4237-B6DA-FCABB1BBAB84} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-12-28] (Google Inc.)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2012-12-05 12:12 - 2008-02-28 02:15 - 00139776 _____ () C:\windows\system32\spool\PRTPROCS\x64\lxdxdrpp.dll
2009-10-29 01:57 - 2009-10-29 01:57 - 00100864 _____ () c:\Program Files\Hewlett-Packard\Pre-Boot Security for HP ProtectTools\BIOSDomainPlugin.dll
2009-11-19 23:14 - 2009-11-19 23:14 - 00052280 _____ () C:\Program Files\Hewlett-Packard\HP Power Assistant\HardwareAccess.dll
2009-11-19 23:14 - 2009-11-19 23:14 - 00055352 _____ () C:\Program Files\Hewlett-Packard\HP Power Assistant\Graphs.dll
2009-11-19 23:11 - 2009-11-19 23:11 - 00030264 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_LogicLayer.dll
2009-11-19 23:11 - 2009-11-19 23:11 - 00052280 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HardwareAccess.dll
2009-09-04 21:35 - 2009-09-04 21:35 - 00173344 _____ () C:\Program Files\WIDCOMM\Bluetooth Software\btkeyind.dll
2013-09-05 00:17 - 2013-09-05 00:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2012-12-04 15:31 - 2012-12-04 15:28 - 00397088 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2009-06-19 17:21 - 2009-06-19 17:21 - 01249280 _____ () C:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\ice32.dll
2009-06-19 17:21 - 2009-06-19 17:21 - 00159744 _____ () C:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\iceutil32.dll
2009-06-19 17:21 - 2009-06-19 17:21 - 00065536 _____ () C:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\bzip2.dll
2009-06-19 17:21 - 2009-06-19 17:21 - 00167936 _____ () C:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\IceSSL32.dll
2013-11-07 22:13 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2013-11-07 22:13 - 2013-05-16 10:55 - 00113496 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2013-11-07 22:13 - 2013-05-16 10:55 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2013-11-07 22:13 - 2013-05-16 10:55 - 00161112 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2013-11-07 22:13 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2010-10-13 19:55 - 2009-07-24 20:10 - 02199552 ____R () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\QtCore4.dll
2010-10-13 19:55 - 2009-07-24 20:10 - 08024064 ____R () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\QtGui4.dll
2010-10-13 19:55 - 2008-01-09 19:08 - 01245184 ____R () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\ice32.dll
2010-10-13 19:55 - 2008-01-09 19:10 - 00159744 ____R () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\iceutil32.dll
2010-10-13 19:55 - 2008-01-09 19:06 - 00065536 ____R () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\bzip2.dll
2010-10-13 19:55 - 2008-01-09 19:10 - 00167936 ____R () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\IceSSL32.dll
2010-10-13 19:55 - 2009-06-19 17:21 - 01249280 _____ () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Authentication\ice32.dll
2010-10-13 19:55 - 2009-06-19 17:21 - 00159744 _____ () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Authentication\iceutil32.dll
2010-10-13 19:55 - 2009-06-19 17:21 - 00065536 _____ () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Authentication\bzip2.dll
2010-10-13 19:55 - 2009-06-19 17:21 - 00167936 _____ () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Authentication\IceSSL32.dll
2010-10-13 19:55 - 2009-06-19 17:21 - 01249280 _____ () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Lens\ice32.dll
2010-10-13 19:55 - 2009-06-19 17:21 - 00159744 _____ () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Lens\iceutil32.dll
2010-10-13 19:55 - 2009-06-19 17:21 - 00065536 _____ () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Lens\bzip2.dll
2010-10-13 19:55 - 2009-06-19 17:21 - 00167936 _____ () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Lens\IceSSL32.dll
2010-10-13 19:55 - 2009-06-19 17:21 - 01249280 _____ () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Licensing\ice32.dll
2010-10-13 19:55 - 2009-06-19 17:21 - 00159744 _____ () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Licensing\iceutil32.dll
2010-10-13 19:55 - 2009-06-19 17:21 - 00065536 _____ () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Licensing\bzip2.dll
2010-10-13 19:55 - 2009-06-19 17:21 - 00167936 _____ () c:\Program Files (x86)\Hewlett-Packard\HP SkyRoom\remote graphics sender\plugins\ice\Hp.SkyRoom.Windows.RgsPlugin.Licensing\IceSSL32.dll
2013-03-13 21:48 - 2013-03-13 21:48 - 24978944 _____ () C:\Users\Viktoria\AppData\Roaming\Dropbox\bin\libcef.dll
2012-10-11 20:56 - 2012-10-11 20:56 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2012-10-11 20:56 - 2012-10-11 20:56 - 01242512 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2013-10-30 19:12 - 2013-10-30 19:12 - 03368048 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\Users\Viktoria\Desktop\Bix_das_Gaensebluemchen.wmv:com.dropbox.attributes
==================== Safe Mode (whitelisted) ===================
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"
==================== Faulty Device Manager Devices =============
Name: Cisco AnyConnect VPN Virtual Miniport Adapter for Windows x64
Description: Cisco AnyConnect VPN Virtual Miniport Adapter for Windows x64
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: vpnva
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: Bluetooth-Peripheriegerät
Description: Bluetooth-Peripheriegerät
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (11/15/2013 10:51:45 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig.
System errors:
=============
Microsoft Office Sessions:
=========================
Error: (11/15/2013 10:51:45 AM) (Source: SideBySide)(User: )
Description: C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exeC:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe2
==================== Memory info ===========================
Percentage of memory in use: 48%
Total physical RAM: 3953.8 MB
Available physical RAM: 2035.79 MB
Total Pagefile: 7905.79 MB
Available Pagefile: 5359.28 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:448.46 GB) (Free:80.08 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive f: (HP_TOOLS) (Fixed) (Total:1.99 GB) (Free:1.48 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: F34E6CC3)
Partition 1: (Active) - (Size=300 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=448 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=15 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=2 GB) - (Type=0C)
==================== End Of Log ============================
Geändert von cosinus (15.11.2013 um 11:40 Uhr) Grund: CODE-Tags korrigiert |
|
15.11.2013, 11:42
| #11 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser! Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle einen Quickscan mit Malwarebytes Anti-Malware (MBAM) Hinweis: Denk bitte vorher daran, Malwarebytes Anti-Malware über den Updatebutton zu aktualisieren! Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt: ESET Online Scanner
__________________ Logfiles bitte immer in CODE-Tags posten |
|
16.11.2013, 22:07
| #12 |
| | Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser! malwarebytes hat 3 infizierte objekte gefunden. ich hab sie bereinigt mit dem programm. hoffe mal das war richtig. hier der log gleich nach dem fund: Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.11.16.05 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16736 Viktoria :: SOKRATES [Administrator] Schutz: Aktiviert 16.11.2013 21:57:29 MBAM-log-2013-11-16 (22-05-50).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 222100 Laufzeit: 7 Minute(n), 34 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 3 C:\Users\Viktoria\Downloads\Downton_Abbey_Season_2_downloader_at_205.exe (PUP.Optional.ExpressFiles.A) -> Keine Aktion durchgeführt. C:\Users\Viktoria\Downloads\SoftonicDownloader_fuer_freemind.exe (PUP.OfferBundler.ST) -> Keine Aktion durchgeführt. C:\Users\Viktoria\Downloads\winamp561_full_emusic-7plus_de-de.exe (PUP.Optional.OpenCandy) -> Keine Aktion durchgeführt. (Ende) |
|
17.11.2013, 00:44
| #13 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser! Nur Müll im Ordner downloads Was ist mit ESET?
__________________ Logfiles bitte immer in CODE-Tags posten |
|
17.11.2013, 14:44
| #14 | ||
| | Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser! eset hat 3 bedrohungen gefunden unter: Zitat:
Zitat:
Geändert von viktoria28 (17.11.2013 um 14:56 Uhr) |
|
17.11.2013, 21:27
| #15 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser! Nur Funde in Quarantäne-Ordnern. Zitat:
Sieht soweit ok aus  Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat. Info: Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie ) Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird. Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu Windows 7: Penetrante Werbung und Werbelinks (überall!) im Browser! |
| .com, agent, antivirus, appdatalow, autorun, browser, chromium, computer, explorer, explorer.exe, farbar, farbar recovery scan tool, firefox, flash player, google, helper, helper.exe, installation, launch, links, log-file, logfiles, microsoft, object, plug-in, probleme, registry, registry key, safer networking, software, start, user agent, viren, werbung, wickel, windows |
Linear-Darstellung
