| |
| |||||||
Log-Analyse und Auswertung: Wichtige Sicherheitswarnung zu Ihrem Internetanschluss Abuse T-OnlineWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
12.11.2013, 13:22
| #1 |
 |  Wichtige Sicherheitswarnung zu Ihrem Internetanschluss Abuse T-Online Hallo Leute aus dem Forum. Ich bin neu hier im Forum und habe schon viel gelesen wie Ihr anderen Usern helfen konntet. Nun hat es auch leider mich erwischt. Ich habe Post von der Telekom bekommen, indem steht, das über meinen Internetzugang unerwünschte Zugriffe auf fremde Computer erfolgt sind (Hacking).Die telekom hat mir darufhin den Port 25 für den Versand von E-Mails gesperrt. Ich nutze GMX Mail als E-Mailprogramm. Ich habe schon mehrere Scanns von meinem Virenprogramm (Kaspersky Internetsecurity 2012) durchlaufen lassen, ohne einen Fund. Nun verbleibe ich in der Hoffnung auf Hilfe und schon mal im vorraus vielen Dank. Gruß regro |
|
12.11.2013, 13:41
| #2 |
| /// the machine /// TB-Ausbilder    | Wichtige Sicherheitswarnung zu Ihrem Internetanschluss Abuse T-Online Hi,
__________________Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.  So funktioniert es:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
|
12.11.2013, 13:53
| #3 |
| | Wichtige Sicherheitswarnung zu Ihrem Internetanschluss Abuse T-Online H Schrauber. Ich wurde dazu aufgefordert die Files zu zippen. dann pste ich sie Dir einzeln.
__________________Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-11-12 10:01:54
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD50 rev.18.0 465,76GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Rene\AppData\Local\Temp\pwldrpow.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff80002fa2000 19 bytes [41, 8B, D5, 49, 8B, CC, E8, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 548 fffff80002fa2014 51 bytes {MOV EDX, [RSP+0x28]; XOR R8D, R8D; MOV RCX, R14; CALL 0x4e0f8}
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1508] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077130038 5 bytes JMP 000000016ac91765
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2420] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 00000000758e1465 2 bytes [8E, 75]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2420] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000758e14bb 2 bytes [8E, 75]
.text ... * 2
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[4936] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 00000000758e1465 2 bytes [8E, 75]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[4936] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000758e14bb 2 bytes [8E, 75]
.text ... * 2
.text C:\Program Files (x86)\Hewlett-Packard\HP My Display TouchSmart Edition\OSDManager.exe[5308] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000758e1465 2 bytes [8E, 75]
.text C:\Program Files (x86)\Hewlett-Packard\HP My Display TouchSmart Edition\OSDManager.exe[5308] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000758e14bb 2 bytes [8E, 75]
.text ... * 2
.text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe[5356] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000758e1465 2 bytes [8E, 75]
.text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe[5356] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000758e14bb 2 bytes [8E, 75]
.text ... * 2
.text C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\GCalService.exe[1424] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 00000000758e1465 2 bytes [8E, 75]
.text C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\GCalService.exe[1424] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000758e14bb 2 bytes [8E, 75]
.text ... * 2
? C:\Windows\system32\mssprxy.dll [4068] entry point in ".rdata" section 00000000631071e6
.text C:\Users\Rene\Downloads\Defogger.exe[7936] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000758e1465 2 bytes [8E, 75]
.text C:\Users\Rene\Downloads\Defogger.exe[7936] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000758e14bb 2 bytes [8E, 75]
.text ... * 2
---- Threads - GMER 2.1 ----
Thread C:\Windows\System32\svchost.exe [2720:2756] 000007fef7649688
Thread C:\Windows\system32\svchost.exe [7736:5552] 000007fef904e8c4
---- EOF - GMER 2.1 ----
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 10-11-2013 01
Ran by Rene at 2013-11-12 09:43:52
Running from C:\Users\Rene\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Kaspersky Internet Security (Enabled - Up to date) {2EAA32A5-1EE1-1B22-95DA-337730C6E984}
AS: Kaspersky Internet Security (Enabled - Up to date) {95CBD341-38DB-14AC-AF6A-08054B41A339}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
FW: Kaspersky Internet Security (Enabled) {1691B380-548E-1A7A-BE85-9A42CE15AEFF}
==================== Installed Programs ======================
64 Bit HP CIO Components Installer (Version: 6.2.1)
7-Zip 9.20 (x64 edition) (Version: 9.20.00.0)
Adobe AIR (x32 Version: 2.6.0.19120)
Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.117)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.117)
Adobe Reader X (10.1.8) - Deutsch (x32 Version: 10.1.8)
Agatha Christie - Peril at End House (x32 Version: 2.2.0.95)
Airport Mania (x32 Version: 2.2.0.95)
AuthenTec TrueAPI (Version: 1.3.0.116)
Azteca (x32 Version: 2.2.0.97)
Bejeweled 3 (x32 Version: 2.2.0.97)
Bluetooth Stack for Windows by Toshiba (Version: v7.00.05)
Bounce Symphony (x32 Version: 2.2.0.97)
Build-a-lot (x32 Version: 2.2.0.95)
Cake Mania (x32 Version: 2.2.0.95)
Chuzzle Deluxe (x32 Version: 2.2.0.95)
D3DX10 (x32 Version: 15.4.2368.0902)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32)
devolo dLAN-Konfigurationsassistent (x32 Version: 17.0.0.0)
devolo Informer (x32 Version: 26.0.0.0)
DirectX for Managed Code Update (Summer 2004) (x32 Version: 9.02.2904)
Dropbox (HKCU Version: 2.4.2)
DVD Menu Pack for HP TouchSmart Video (x32 Version: 4.1.4412)
Facebook for HP TouchSmart (x32 Version: 1.1.0004)
Facebook Video Calling 1.2.0.287 (x32 Version: 1.2.287)
Farm Frenzy (x32 Version: 2.2.0.95)
FATE (x32 Version: 2.2.0.97)
FreePDF (Remove only) (x32)
FRITZ!Box-Fernzugang einrichten (x32 Version: 1.0.3)
FRITZ!Fernzugang (Version: 1.2.6)
GMX MailCheck für Mozilla Firefox (x32 Version: 2.1.4.1300)
GMX Softwareaktualisierung (x32 Version: 2.0.1.9)
Google Earth Plug-in (x32 Version: 7.1.1.1888)
Google Update Helper (x32 Version: 1.3.21.165)
Governor of Poker 2 Premium Edition (x32 Version: 2.2.0.95)
GPL Ghostscript (x32 Version: 9.04)
Hewlett-Packard ACLM.NET v1.2.1.1 (x32 Version: 1.00.0000)
HitmanPro 3.7 (Version: 3.7.8.208)
HP Auto (Version: 1.0.12935.3667)
HP Calendar (x32 Version: 5.1.4245.23508)
HP Client Services (Version: 1.1.12938.3539)
HP Clock (x32 Version: 5.1.4281.27332)
HP Customer Experience Enhancements (x32 Version: 6.0.1.7)
HP Games (x32 Version: 1.0.2.5)
HP LinkUp (x32 Version: 2.01.028)
HP Magic Canvas (x32 Version: 5.1.15.0)
HP My Display TouchSmart Edition (x32 Version: 1.04.022)
HP Notes (x32 Version: 5.1.4274.30382)
HP Odometer (x32 Version: 2.10.0000)
HP Photo Canvas (x32 Version: 5.1.4267.27011)
HP Photo Creations (x32 Version: 1.0.0.9452)
HP Photosmart 5510d series - Grundlegende Software für das Gerät (Version: 25.0.607.0)
HP Photosmart 5510d series Hilfe (x32 Version: 140.0.2.2)
HP RSS (x32 Version: 5.1.4301.21494)
HP Setup (x32 Version: 8.7.4747.3786)
HP Setup Manager (x32 Version: 1.1.13880.3792)
HP SimplePass PE 2011 (x32 Version: 5.3.0.194)
HP Support Assistant (x32 Version: 7.0.39.15)
HP Support Information (x32 Version: 10.1.1000)
HP Touch Browser (x32 Version: 5.1.4227.17815)
HP TouchSmart eBay (x32 Version: 1.0.4098.28440)
HP TouchSmart Music (x32 Version: 4.2.5414)
HP TouchSmart Photo (x32 Version: 4.2.5414)
HP TouchSmart RecipeBox (x32 Version: 3.0.3830.27730)
HP TouchSmart Tutorials (x32 Version: 4.0.0.4)
HP TouchSmart Twitter (x32 Version: 3.0.4276.30236)
HP TouchSmart Video (x32 Version: 4.2.5414)
HP TouchSmart Webcam (x32 Version: 4.2.4214)
HP Update (x32 Version: 5.003.000.004)
HP Vision Hardware Diagnostics (Version: 2.9.0.0)
IDT Audio (x32 Version: 1.0.6370.0)
ImgBurn (x32 Version: 2.5.8.0)
InfraRecorder 0.53 (x64 edition) (Version: 0.53.00.00)
Intel(R) Control Center (x32 Version: 1.2.1.1007)
Intel(R) Identity Protection Technology 1.1.2.0 (x32 Version: 1.1.2.0)
Intel(R) Management Engine Components (x32 Version: 7.0.0.1144)
Intel(R) Processor Graphics (x32 Version: 8.15.10.2430)
Jewel Quest: The Sleepless Star - Collector's Edition (x32 Version: 2.2.0.95)
Junk Mail filter update (x32 Version: 15.4.3502.0922)
Kaspersky Internet Security 2012 (x32 Version: 12.0.0.374)
LabelPrint (x32 Version: 2.5.3925)
Magic Desktop (x32 Version: 3.0)
Mah Jong Medley (x32 Version: 2.2.0.95)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
Mesh Runtime (x32 Version: 15.4.5722.2)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Mathematics (x32 Version: 4.0)
Microsoft Office 2010 Service Pack 1 (SP1) (x32)
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Home and Student 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.6029.1000)
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.6029.1000)
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Single Image 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Silverlight (Version: 5.1.20913.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft SQL Server Compact 3.5 SP1 English (x32 Version: 3.5.5692.0)
Microsoft SQL Server Compact 3.5 SP1 x64 English (Version: 3.5.5692.0)
Microsoft Touch Pack for Windows 7 (x32 Version: 1.0.40517.00)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.59192)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (x32 Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022.218 (Version: 9.0.21022.218)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (Version: 10.0.30319)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (x32 Version: 10.0.30319)
Microsoft XNA Framework Redistributable 3.0 (x32 Version: 3.0.11010.0)
Movie Theme Pack for HP TouchSmart Video (x32 Version: 4.1.4412)
Mozilla Firefox 24.0 (x86 de) (x32 Version: 24.0)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT_amd64 (x32 Version: 15.4.2862.0708)
MusicStation (x32 Version: 2.0.2.124)
Mystery of Mortlake Mansion (x32 Version: 2.2.0.97)
Namco All-Stars: PAC-MAN (x32 Version: 2.2.0.95)
NAVIGON Fresh 3.4.1 (x32 Version: 3.4.1)
PDF Complete Special Edition (x32 Version: 4.0.54)
Penguins! (x32 Version: 2.2.0.95)
PhotoMania (x32 Version: 1)
Pivot Pro Plugin (x32 Version: 9.50.110)
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.95)
PlayReady PC Runtime amd64 (Version: 1.3.0)
Polar Bowler (x32 Version: 2.2.0.97)
Polar Golfer (x32 Version: 2.2.0.95)
Ralink 802.11n Wireless LAN Card (x32 Version: 4.0.3.0)
Realtek PCIE Card Reader (x32 Version: 6.1.7601.82)
Recovery Manager (x32 Version: 5.5.0.4222)
RedMon - Redirection Port Monitor
Remote Graphics Receiver (x32 Version: 5.4.5)
SDK (x32 Version: 2.28.007)
Skype™ 5.10 (x32 Version: 5.10.116)
Slingo Deluxe (x32 Version: 2.2.0.95)
Spybot - Search & Destroy (x32 Version: 2.1.19)
Studie zur Verbesserung von HP Photosmart 5510d series Produkten (Version: 25.0.607.0)
TSHostedAppLauncher (x32 Version: 5.1.15.0)
TubeBox (x32 Version: 3.6.1)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2836939) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2836939v3) (x32 Version: 3)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (x32)
Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553065) (x32)
Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553270) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2566458) (x32)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2687503) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition (x32)
Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition (x32)
Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition (x32)
Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition (x32)
Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition (x32)
Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (x32)
Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition (x32)
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (x32)
Update for Microsoft Word 2010 (KB2827323) 32-Bit Edition (x32)
Update Installer for WildTangent Games App (x32)
Vacation Quest - The Hawaiian Islands (x32 Version: 2.2.0.97)
VIP Access SDK (1.0.1.4) (x32 Version: 1.0.1.4)
Virtual Villagers 5 - New Believers (x32 Version: 2.2.0.97)
WildTangent Games App (HP Games) (x32 Version: 4.0.5.2)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3508.1109)
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0)
Windows Live Installer (x32 Version: 15.4.3502.0922)
Windows Live Language Selector (Version: 15.4.3508.1109)
Windows Live Mail (x32 Version: 15.4.3502.0922)
Windows Live Mesh (x32 Version: 15.4.3502.0922)
Windows Live Mesh ActiveX control for remote connections (x32 Version: 15.4.5722.2)
Windows Live Mesh ActiveX Control for Remote Connections (x32 Version: 15.4.5722.2)
Windows Live Messenger (x32 Version: 15.4.3502.0922)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (x32 Version: 15.4.3502.0922)
Windows Live Photo Common (x32 Version: 15.4.3502.0922)
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922)
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109)
Windows Live Remote Client (Version: 15.4.5722.2)
Windows Live Remote Client Resources (Version: 15.4.5722.2)
Windows Live Remote Service (Version: 15.4.5722.2)
Windows Live Remote Service Resources (Version: 15.4.5722.2)
Windows Live SOXE (x32 Version: 15.4.3502.0922)
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922)
Windows Live UX Platform (x32 Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109)
Windows Live Writer (x32 Version: 15.4.3502.0922)
Windows Live Writer Resources (x32 Version: 15.4.3502.0922)
Zinio Reader 4 (x32 Version: 4.2.4164)
Zuma Deluxe (x32 Version: 2.2.0.95)
==================== Restore Points =========================
15-10-2013 08:03:06 Windows Update
16-10-2013 01:00:33 Windows Update
16-10-2013 01:10:46 Windows-Sicherung
20-10-2013 16:04:28 Windows Update
26-10-2013 08:39:50 Windows Update
26-10-2013 08:44:12 Windows-Sicherung
03-11-2013 16:33:35 Windows Update
03-11-2013 18:00:13 Windows-Sicherung
11-11-2013 18:02:36 Windows Update
11-11-2013 18:06:28 HPSF Applying updates
11-11-2013 18:40:43 Installed Ralink Wireless LAN
11-11-2013 18:44:27 HPSF Applying updates
11-11-2013 18:51:25 Konfiguriert IDT Audio
12-11-2013 07:54:19 Windows-Sicherung
==================== Hosts content: ==========================
2009-07-14 03:34 - 2013-10-10 14:49 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
Task: {10B4D2E0-5F4F-453A-8486-804CF5E201E5} - System32\Tasks\RMCreator => C:\Program Files (x86)\Hewlett-Packard\Recovery\Reminder.exe [2011-06-23] (CyberLink)
Task: {1F024B2B-5581-415F-8F6F-6C3089A080CB} - System32\Tasks\HP Photo Creations Communicator => C:\ProgramData\HP Photo Creations\Communicator.exe [2012-06-10] ()
Task: {22079A34-9E60-4FD6-9C55-1D04B60C9A04} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-603513771-2939990097-2127156883-1001Core => C:\Users\Sophie\AppData\Local\Google\Update\GoogleUpdate.exe [2012-05-22] (Google Inc.)
Task: {2B33896F-A016-4D3F-9B08-CD012BCE7146} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-603513771-2939990097-2127156883-1001UA => C:\Users\Sophie\AppData\Local\Google\Update\GoogleUpdate.exe [2012-05-22] (Google Inc.)
Task: {2BB574A9-E30C-418D-AB29-F357A606292E} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe
Task: {37C3EDEB-9DB0-41F7-930C-ED121DD9CCF5} - System32\Tasks\HPCustParticipation HP Photosmart 5510d series => C:\Program Files\hp\HP Photosmart 5510d series\Bin\HPCustPartic.exe [2011-08-16] (Hewlett-Packard Co.)
Task: {451BDAC5-6ACE-4869-9CFA-449120D7C288} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2013-10-15] (Hewlett-Packard)
Task: {49F883F2-34B4-4702-98E0-DA5258899BED} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company)
Task: {4DAC7D85-DB22-43C3-829D-5F0B0CCE92EB} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-10-31] (Google Inc.)
Task: {54820D26-727F-45FE-AB1C-B2D7AE8F935A} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe
Task: {5A8EB9A2-AD8E-4A92-85BA-4CF256395506} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-603513771-2939990097-2127156883-1001Core => C:\Users\Sophie\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-15] (Facebook Inc.)
Task: {5C5C2FB7-A44D-4739-B2CA-C6C773348531} - System32\Tasks\HPCeeScheduleForRene => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14] (Hewlett-Packard)
Task: {5D9D57F3-8E94-4329-ABCB-556321BA20E7} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe
Task: {66DAB245-F958-4761-BA2B-4A2AFFE588F9} - System32\Tasks\Google Updater and Installer => C:\Users\Rene\AppData\Local\Google\Update\GoogleUpdate.exe
Task: {6C63A52C-8236-4108-B259-85931A034D2E} - System32\Tasks\HPCeeScheduleForRENE-HP$ => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14] (Hewlett-Packard)
Task: {6CCFBDBC-4ADB-4730-8DAA-EDF11FE3DE0C} - System32\Tasks\HP-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe [2011-03-24] (Hewlett-Packard)
Task: {6DAB756F-E3B0-480D-8D89-9A019721F81F} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2013-10-15] (Hewlett-Packard)
Task: {8556504B-7B4E-40DE-AC35-67F6DE5E11D1} - System32\Tasks\{7A35DF1D-FA05-4C47-A58B-350292D18D20} => Firefox.exe hxxp://ui.skype.com/ui/0/6.7.0.102/de/abandoninstall?page=tsProgressBar
Task: {8FDE9DEE-23AA-403C-9A20-33EC0106B08A} - System32\Tasks\Microsoft\Windows\TabletPC\InputPersonalization => C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe [2009-07-14] (Microsoft Corporation)
Task: {90F8D157-5D3D-4188-B1A7-9E4553A6BA96} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-04-04] (Adobe Systems Incorporated)
Task: {9188AE52-FF6A-4F0A-89FA-5706EEA8008B} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2013-04-01] (Hewlett-Packard Company)
Task: {A2572266-45A0-492F-8D06-09FA8070D442} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-09] (Adobe Systems Incorporated)
Task: {A50F3665-D53F-4458-9E91-FFFC2BBC2800} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company)
Task: {A8C2D101-037E-4E75-A173-11BAA0F718AF} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-603513771-2939990097-2127156883-1001UA => C:\Users\Sophie\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-15] (Facebook Inc.)
Task: {BE51C738-9C40-43EB-970E-53AA57384E56} - System32\Tasks\MirageAgent => C:\Program Files (x86)\Hewlett-Packard\Media\Webcam\YCMMirage.exe [2011-05-30] (CyberLink)
Task: {C83D9BE4-31B0-40AD-B74F-D92DE2A7A8B3} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {C8456169-40BC-498F-A672-F2A5AA7DBD3B} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-10-31] (Google Inc.)
Task: {C845C7D0-C5A7-42CA-A10B-37F14C3D352E} - System32\Tasks\Registration 1und1 Task => C:\Program Files (x86)\1und1Softwareaktualisierung\cdsupdclient.exe [2011-07-28] (1&1 Mail & Media GmbH)
Task: {DDBBCBAF-D6EE-4EE7-9341-8527183BA189} - System32\Tasks\ServicePlan => C:\Program Files (x86)\Hewlett-Packard\HP Setup\RemEngine.exe [2011-06-15] ()
Task: {E2578095-2895-4F56-A0AB-19C94D28F689} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2010-11-21] (Microsoft Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-603513771-2939990097-2127156883-1001Core.job => C:\Users\Sophie\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-603513771-2939990097-2127156883-1001UA.job => C:\Users\Sophie\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-603513771-2939990097-2127156883-1001Core.job => C:\Users\Sophie\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-603513771-2939990097-2127156883-1001UA.job => C:\Users\Sophie\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\HP Photo Creations Communicator.job => C:\ProgramData\HP Photo Creations\Communicator.exe
Task: C:\Windows\Tasks\HPCeeScheduleForRENE-HP$.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
Task: C:\Windows\Tasks\HPCeeScheduleForRene.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
==================== Loaded Modules (whitelisted) =============
2012-11-24 14:38 - 2012-08-16 17:12 - 00268880 _____ () C:\Program Files (x86)\Common Files\Portrait Displays\Shared\dthook.dll
2011-12-20 01:18 - 2011-06-27 03:16 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2013-10-09 19:24 - 2013-05-16 09:55 - 00113496 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2013-10-09 19:24 - 2013-05-16 09:55 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2013-10-09 19:24 - 2013-05-16 09:55 - 00161112 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2013-10-09 19:24 - 2012-08-23 09:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2013-10-09 19:24 - 2012-04-03 16:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2011-04-24 22:13 - 2011-04-24 22:13 - 02118032 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\QtCore4.dll
2011-04-24 22:13 - 2011-04-24 22:13 - 07008656 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\QtGui4.dll
2011-04-24 22:13 - 2011-04-24 22:13 - 02089360 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\QtDeclarative4.dll
2011-04-24 22:13 - 2011-04-24 22:13 - 01270160 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\QtScript4.dll
2011-04-24 22:13 - 2011-04-24 22:13 - 00192912 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\QtSql4.dll
2011-04-24 22:13 - 2011-04-24 22:13 - 00758160 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\QtNetwork4.dll
2011-04-20 18:56 - 2011-04-20 18:56 - 00025088 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\imageformats\qgif4.dll
2011-12-20 01:42 - 2012-01-17 16:21 - 00068104 _____ () C:\Program Files (x86)\Hewlett-Packard\HP My Display TouchSmart Edition\PEGAACPIDLL.dll
2011-12-20 01:42 - 2011-02-15 20:59 - 00015624 _____ () C:\Program Files (x86)\Hewlett-Packard\HP My Display TouchSmart Edition\ACPIDll.dll
2011-12-20 01:42 - 2012-08-16 16:53 - 00180224 _____ () C:\Program Files (x86)\Common Files\Portrait Displays\Shared\PresetsCOM.dll
2013-09-05 19:01 - 2013-09-11 03:26 - 03279768 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (11/12/2013 08:44:20 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: TrueSuiteService.exe, Version: 5.3.0.194, Zeitstempel: 0x4df09290
Name des fehlerhaften Moduls: TrueSuiteService.exe, Version: 5.3.0.194, Zeitstempel: 0x4df09290
Ausnahmecode: 0xc0000417
Fehleroffset: 0x0001280a
ID des fehlerhaften Prozesses: 0x1c0
Startzeit der fehlerhaften Anwendung: 0xTrueSuiteService.exe0
Pfad der fehlerhaften Anwendung: TrueSuiteService.exe1
Pfad des fehlerhaften Moduls: TrueSuiteService.exe2
Berichtskennung: TrueSuiteService.exe3
Error: (11/11/2013 08:53:58 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: TrueSuiteService.exe, Version: 5.3.0.194, Zeitstempel: 0x4df09290
Name des fehlerhaften Moduls: TrueSuiteService.exe, Version: 5.3.0.194, Zeitstempel: 0x4df09290
Ausnahmecode: 0xc0000417
Fehleroffset: 0x0001280a
ID des fehlerhaften Prozesses: 0x1f0
Startzeit der fehlerhaften Anwendung: 0xTrueSuiteService.exe0
Pfad der fehlerhaften Anwendung: TrueSuiteService.exe1
Pfad des fehlerhaften Moduls: TrueSuiteService.exe2
Berichtskennung: TrueSuiteService.exe3
Error: (11/11/2013 08:49:33 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: SDUpdate.exe, Version: 2.1.18.91, Zeitstempel: 0x51949fc0
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18229, Zeitstempel: 0x51fb1116
Ausnahmecode: 0x0eedfade
Fehleroffset: 0x0000c41f
ID des fehlerhaften Prozesses: 0x3304
Startzeit der fehlerhaften Anwendung: 0xSDUpdate.exe0
Pfad der fehlerhaften Anwendung: SDUpdate.exe1
Pfad des fehlerhaften Moduls: SDUpdate.exe2
Berichtskennung: SDUpdate.exe3
Error: (11/11/2013 08:45:44 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: SDUpdate.exe, Version: 2.1.18.91, Zeitstempel: 0x51949fc0
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18229, Zeitstempel: 0x51fb1116
Ausnahmecode: 0x0eedfade
Fehleroffset: 0x0000c41f
ID des fehlerhaften Prozesses: 0x2f24
Startzeit der fehlerhaften Anwendung: 0xSDUpdate.exe0
Pfad der fehlerhaften Anwendung: SDUpdate.exe1
Pfad des fehlerhaften Moduls: SDUpdate.exe2
Berichtskennung: SDUpdate.exe3
Error: (11/11/2013 08:41:08 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: SDUpdate.exe, Version: 2.1.18.91, Zeitstempel: 0x51949fc0
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18229, Zeitstempel: 0x51fb1116
Ausnahmecode: 0x0eedfade
Fehleroffset: 0x0000c41f
ID des fehlerhaften Prozesses: 0x2c24
Startzeit der fehlerhaften Anwendung: 0xSDUpdate.exe0
Pfad der fehlerhaften Anwendung: SDUpdate.exe1
Pfad des fehlerhaften Moduls: SDUpdate.exe2
Berichtskennung: SDUpdate.exe3
Error: (11/11/2013 08:35:44 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: SDUpdate.exe, Version: 2.1.18.91, Zeitstempel: 0x51949fc0
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18229, Zeitstempel: 0x51fb1116
Ausnahmecode: 0x0eedfade
Fehleroffset: 0x0000c41f
ID des fehlerhaften Prozesses: 0x2e58
Startzeit der fehlerhaften Anwendung: 0xSDUpdate.exe0
Pfad der fehlerhaften Anwendung: SDUpdate.exe1
Pfad des fehlerhaften Moduls: SDUpdate.exe2
Berichtskennung: SDUpdate.exe3
Error: (11/11/2013 08:30:59 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: SDUpdate.exe, Version: 2.1.18.91, Zeitstempel: 0x51949fc0
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18229, Zeitstempel: 0x51fb1116
Ausnahmecode: 0x0eedfade
Fehleroffset: 0x0000c41f
ID des fehlerhaften Prozesses: 0x2d14
Startzeit der fehlerhaften Anwendung: 0xSDUpdate.exe0
Pfad der fehlerhaften Anwendung: SDUpdate.exe1
Pfad des fehlerhaften Moduls: SDUpdate.exe2
Berichtskennung: SDUpdate.exe3
Error: (11/11/2013 08:26:16 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: SDUpdate.exe, Version: 2.1.18.91, Zeitstempel: 0x51949fc0
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18229, Zeitstempel: 0x51fb1116
Ausnahmecode: 0x0eedfade
Fehleroffset: 0x0000c41f
ID des fehlerhaften Prozesses: 0x2a68
Startzeit der fehlerhaften Anwendung: 0xSDUpdate.exe0
Pfad der fehlerhaften Anwendung: SDUpdate.exe1
Pfad des fehlerhaften Moduls: SDUpdate.exe2
Berichtskennung: SDUpdate.exe3
Error: (11/11/2013 06:54:26 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: TrueSuiteService.exe, Version: 5.3.0.194, Zeitstempel: 0x4df09290
Name des fehlerhaften Moduls: TrueSuiteService.exe, Version: 5.3.0.194, Zeitstempel: 0x4df09290
Ausnahmecode: 0xc0000417
Fehleroffset: 0x0001280a
ID des fehlerhaften Prozesses: 0x218
Startzeit der fehlerhaften Anwendung: 0xTrueSuiteService.exe0
Pfad der fehlerhaften Anwendung: TrueSuiteService.exe1
Pfad des fehlerhaften Moduls: TrueSuiteService.exe2
Berichtskennung: TrueSuiteService.exe3
Error: (11/04/2013 03:38:25 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: TrueSuiteService.exe, Version: 5.3.0.194, Zeitstempel: 0x4df09290
Name des fehlerhaften Moduls: TrueSuiteService.exe, Version: 5.3.0.194, Zeitstempel: 0x4df09290
Ausnahmecode: 0xc0000417
Fehleroffset: 0x0001280a
ID des fehlerhaften Prozesses: 0x74
Startzeit der fehlerhaften Anwendung: 0xTrueSuiteService.exe0
Pfad der fehlerhaften Anwendung: TrueSuiteService.exe1
Pfad des fehlerhaften Moduls: TrueSuiteService.exe2
Berichtskennung: TrueSuiteService.exe3
System errors:
=============
Error: (11/12/2013 08:44:25 AM) (Source: Service Control Manager) (User: )
Description: Dienst "TrueSuiteService" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (11/11/2013 08:53:59 PM) (Source: Service Control Manager) (User: )
Description: Dienst "TrueSuiteService" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (11/11/2013 08:53:58 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "HitmanPro 3.7 Crusader (Boot)" wurde mit folgendem dienstspezifischem Fehler beendet: %%0.
Error: (11/11/2013 08:53:49 PM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am 11.11.2013 um 20:52:09 unerwartet heruntergefahren.
Error: (11/11/2013 08:51:52 PM) (Source: DCOM) (User: )
Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}
Error: (11/11/2013 06:54:43 PM) (Source: Service Control Manager) (User: )
Description: Dienst "TrueSuiteService" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (11/04/2013 03:38:37 PM) (Source: Service Control Manager) (User: )
Description: Dienst "TrueSuiteService" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (11/03/2013 05:29:06 PM) (Source: Service Control Manager) (User: )
Description: Dienst "TrueSuiteService" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (11/03/2013 05:28:44 PM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am 26.10.2013 um 10:58:47 unerwartet heruntergefahren.
Error: (10/26/2013 09:34:24 AM) (Source: Service Control Manager) (User: )
Description: Dienst "TrueSuiteService" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Microsoft Office Sessions:
=========================
Error: (11/12/2013 08:44:20 AM) (Source: Application Error)(User: )
Description: TrueSuiteService.exe5.3.0.1944df09290TrueSuiteService.exe5.3.0.1944df09290c00004170001280a1c001cedf7af7bd1998C:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exeC:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exe3cdd6421-4b6e-11e3-b0a0-3860776fda87
Error: (11/11/2013 08:53:58 PM) (Source: Application Error)(User: )
Description: TrueSuiteService.exe5.3.0.1944df09290TrueSuiteService.exe5.3.0.1944df09290c00004170001280a1f001cedf17bd573f31C:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exeC:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exe0091f102-4b0b-11e3-be6f-3860776fda87
Error: (11/11/2013 08:49:33 PM) (Source: Application Error)(User: )
Description: SDUpdate.exe2.1.18.9151949fc0KERNELBASE.dll6.1.7601.1822951fb11160eedfade0000c41f330401cedf1723410932C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exeC:\Windows\syswow64\KERNELBASE.dll628f9a0a-4b0a-11e3-8e21-3860776fda87
Error: (11/11/2013 08:45:44 PM) (Source: Application Error)(User: )
Description: SDUpdate.exe2.1.18.9151949fc0KERNELBASE.dll6.1.7601.1822951fb11160eedfade0000c41f2f2401cedf167070a4fbC:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exeC:\Windows\syswow64\KERNELBASE.dllda2b82f9-4b09-11e3-8e21-3860776fda87
Error: (11/11/2013 08:41:08 PM) (Source: Application Error)(User: )
Description: SDUpdate.exe2.1.18.9151949fc0KERNELBASE.dll6.1.7601.1822951fb11160eedfade0000c41f2c2401cedf15bda019b5C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exeC:\Windows\syswow64\KERNELBASE.dll35819c7d-4b09-11e3-8e21-3860776fda87
Error: (11/11/2013 08:35:44 PM) (Source: Application Error)(User: )
Description: SDUpdate.exe2.1.18.9151949fc0KERNELBASE.dll6.1.7601.1822951fb11160eedfade0000c41f2e5801cedf150ad02ab0C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exeC:\Windows\syswow64\KERNELBASE.dll749a9947-4b08-11e3-8e21-3860776fda87
Error: (11/11/2013 08:30:59 PM) (Source: Application Error)(User: )
Description: SDUpdate.exe2.1.18.9151949fc0KERNELBASE.dll6.1.7601.1822951fb11160eedfade0000c41f2d1401cedf1457ff7859C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exeC:\Windows\syswow64\KERNELBASE.dllca3db8df-4b07-11e3-8e21-3860776fda87
Error: (11/11/2013 08:26:16 PM) (Source: Application Error)(User: )
Description: SDUpdate.exe2.1.18.9151949fc0KERNELBASE.dll6.1.7601.1822951fb11160eedfade0000c41f2a6801cedf13a530e8e9C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exeC:\Windows\syswow64\KERNELBASE.dll21fe9045-4b07-11e3-8e21-3860776fda87
Error: (11/11/2013 06:54:26 PM) (Source: Application Error)(User: )
Description: TrueSuiteService.exe5.3.0.1944df09290TrueSuiteService.exe5.3.0.1944df09290c00004170001280a21801cedf0706c4e930C:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exeC:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exe4d725bc2-4afa-11e3-8e21-3860776fda87
Error: (11/04/2013 03:38:25 PM) (Source: Application Error)(User: )
Description: TrueSuiteService.exe5.3.0.1944df09290TrueSuiteService.exe5.3.0.1944df09290c00004170001280a7401ced96b7b8ab9dbC:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exeC:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exec2a313a5-455e-11e3-ae54-3860776fda87
CodeIntegrity Errors:
===================================
Date: 2013-10-10 15:44:09.823
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-10-10 15:44:09.792
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Percentage of memory in use: 55%
Total physical RAM: 4000.31 MB
Available physical RAM: 1799.38 MB
Total Pagefile: 7998.8 MB
Available Pagefile: 5350.7 MB
Total Virtual: 8192 MB
Available Virtual: 8191.79 MB
==================== Drives ================================
Drive c: (OS) (Fixed) (Total:450.28 GB) (Free:357.1 GB) NTFS
Drive d: (HP_RECOVERY) (Fixed) (Total:15.38 GB) (Free:1.88 GB) NTFS ==>[System with boot components (obtained from reading drive)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 41821A2E)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=450 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=15 GB) - (Type=07 NTFS)
==================== End Of Log ============================
FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-11-2013 01
Ran by Rene (administrator) on RENE-HP on 12-11-2013 09:43:06
Running from C:\Users\Rene\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe
(Microsoft Corporation) C:\Windows\SYSTEM32\WISPTIS.EXE
(SurfRight B.V.) C:\Program Files\HitmanPro\hmpsched.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\avmike.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\certsrv.exe
(Portrait Displays, Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Shared\dtsrvc.exe
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe
(PDF Complete Inc) C:\Program Files (x86)\PDF Complete\pdfsvc.exe
(Portrait Displays, Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Microsoft Corporation) C:\Windows\SYSTEM32\WISPTIS.EXE
(Hewlett-Packard ) C:\Program Files\IDT\WDM\beats64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Hewlett-Packard Co.) C:\Program Files\hp\HP Photosmart 5510d series\Bin\ScanToPCActivationApp.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
(shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Portrait Displays, Inc) C:\Program Files (x86)\Hewlett-Packard\HP My Display TouchSmart Edition\OSDManager.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosHdpProc.exe
(Portrait Displays, Inc) C:\Program Files (x86)\Hewlett-Packard\HP My Display TouchSmart Edition\DTHtml.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
(Portrait Displays Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Shared\HookManager.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\tosBtProc.exe
(Portrait Displays, Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdiSdkHelperx64.exe
() C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\wpctrl.exe
(Intel Corporation) C:\Windows\system32\igfxext.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
() C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\DP\DPHelper.exe
() C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\DP\DPHelper64.exe
(CyberLink) C:\Program Files (x86)\Hewlett-Packard\Media\Webcam\YCMMirage.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\GCalService.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\HPTouchSmartSyncCalReminderApp.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
() C:\Users\Rene\Downloads\Defogger.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [BeatsOSDApp] - C:\Program Files\IDT\WDM\beats64.exe [37888 2013-11-11] (Hewlett-Packard )
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [hpsysdrv] - C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe [62768 2008-11-20] (Hewlett-Packard)
HKLM\...\Run: [Logitech Download Assistant] - C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [1424896 2013-11-11] (IDT, Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\klogon: C:\Windows\System32\klogon.dll (Kaspersky Lab ZAO)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKCU\...\Run: [HP Photosmart 5510d series (NET)] - C:\Program Files\hp\HP Photosmart 5510d series\Bin\ScanToPCActivationApp.exe [2676584 2011-08-16] (Hewlett-Packard Co.)
HKCU\...\Policies\system: [DisableLockWorkstation] 0
HKCU\...\Policies\system: [DisableChangePassword] 0
HKLM-x32\...\Run: [Easybits Recovery] - C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [61112 2011-05-17] (EasyBits Software AS)
HKLM-x32\...\Run: [DT HPO] - C:\Program Files (x86)\Common Files\Portrait Displays\Shared\DT_Startup.exe [120400 2012-08-16] (Portrait Displays, Inc.)
HKLM-x32\...\Run: [PDF Complete] - C:\Program Files (x86)\PDF Complete\pdfsty.exe [658424 2011-05-06] (PDF Complete Inc)
HKLM-x32\...\Run: [FreePDF Assistant] - C:\Program Files (x86)\FreePDF_XP\fpassist.exe [371200 2011-02-23] (shbox.de)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [ITSecMng] - C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\ItSecMng.exe [83336 2009-07-22] (TOSHIBA CORPORATION)
HKLM-x32\...\Run: [AVP] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe [206448 2012-10-31] (Kaspersky Lab ZAO)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [PivotSoftware] - C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\pivot_Startup.exe [110192 2010-05-13] ()
HKLM-x32\...\Run: [SDTray] - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [3830224 2013-05-16] (Safer-Networking Ltd.)
HKU\Sophie\...\Run: [Google Update] - C:\Users\Sophie\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2012-05-22] (Google Inc.)
HKU\Sophie\...\Run: [ICQ] - C:\Users\Sophie\AppData\Roaming\ICQ\Application\ICQ7M\ICQ.exe [127040 2012-05-22] (ICQ, LLC.)
HKU\Sophie\...\Run: [Facebook Update] - C:\Users\Sophie\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-07-15] (Facebook Inc.)
HKU\Sophie\...\Run: [Spotify] - C:\Users\Sophie\AppData\Roaming\Spotify\spotify.exe [4640768 2013-07-25] (Spotify Ltd)
HKU\Sophie\...\Policies\system: [DisableLockWorkstation] 0
HKU\Sophie\...\Policies\system: [DisableChangePassword] 0
Startup: C:\Users\Rene\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Photosmart 5510d series (Netzwerk).lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Photosmart 5510d series (Netzwerk).lnk -> C:\Program Files\HP\HP Photosmart 5510d series\bin\HPStatusBL.dll (Hewlett-Packard Co.)
Startup: C:\Users\Sophie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Photosmart 5510d series (Netzwerk).lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Photosmart 5510d series (Netzwerk).lnk -> C:\Program Files\HP\HP Photosmart 5510d series\bin\HPStatusBL.dll (Hewlett-Packard Co.)
==================== Internet (Whitelisted) ====================
ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: localhost:21320
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://t-online.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {24FE3852-5D00-43EF-8C8B-FF32F43D11A7} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPDTDF
SearchScopes: HKLM - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPDTDF
SearchScopes: HKLM - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {EEE6C360-6118-11DC-9C72-001320C79847} URL = hxxp://search.sweetim.com/search.asp?src=6&crg=3.50010003&st=12&q={searchTerms}&barid={815B18B5-5756-11E2-9130-3860776FDA87}
SearchScopes: HKLM-x32 - {24FE3852-5D00-43EF-8C8B-FF32F43D11A7} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPDTDF
SearchScopes: HKLM-x32 - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPDTDF
SearchScopes: HKLM-x32 - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 - {EEE6C360-6118-11DC-9C72-001320C79847} URL = hxxp://search.sweetim.com/search.asp?src=6&crg=3.50010003&st=12&q={searchTerms}&barid={815B18B5-5756-11E2-9130-3860776FDA87}
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
SearchScopes: HKCU - {0A96340D-6C40-488D-95AE-9727C2FDAD83} URL = hxxp://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {23EAF3AA-0DF2-4142-BBF0-8BBC4D6ADE77} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {24FE3852-5D00-43EF-8C8B-FF32F43D11A7} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKCU - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPDTDF
SearchScopes: HKCU - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPDTDF
SearchScopes: HKCU - {C0B87CE2-AE1C-4207-A8FE-3DB227F9AE01} URL = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
SearchScopes: HKCU - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKCU - {EEE6C360-6118-11DC-9C72-001320C79847} URL = hxxp://search.sweetim.com/search.asp?src=6&crg=3.50010003&st=12&q={searchTerms}&barid={815B18B5-5756-11E2-9130-3860776FDA87}
SearchScopes: HKCU - {F453F4C8-F208-4B75-98C6-2F61B6F74158} URL = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}
BHO: IEVkbdBHO Class - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\x64\ievkbd.dll (Kaspersky Lab ZAO)
BHO: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\x64\IEBHO.dll (HP)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: FilterBHO Class - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\x64\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: IEVkbdBHO Class - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ievkbd.dll (Kaspersky Lab ZAO)
BHO-x32: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\IEBHO.dll (HP)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: FilterBHO Class - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKLM-x32 - SweetPacks Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll No File
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKCU - No Name - {C424171E-592A-415A-9EB1-DFD6D95D3530} - No File
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWow64\EZUPBH~1.DLL [52920 2011-12-20] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\sfkr8s1x.default
FF user.js: detected! => C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\sfkr8s1x.default\user.js
FF NewTab: chrome://unitedtb/content/newtab/newtab-page.xhtml
FF DefaultSearchEngine: Google
FF SearchEngineOrder.user_pref("browser.search.order.1", "");: user_pref("browser.search.order.1", "");
FF SelectedSearchEngine: Google
FF Homepage: t-online.de
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/VirtualEarth3D,version=4.0 - c:\Program Files (x86)\Virtual Earth 3D\ No File
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5 - C:\ProgramData\Visan\plugins\npRLSecurePluginLayer.dll (RocketLife, LLP)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\sfkr8s1x.default\searchplugins\11-suche.xml
FF SearchPlugin: C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\sfkr8s1x.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\sfkr8s1x.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\sfkr8s1x.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\sfkr8s1x.default\searchplugins\webde-suche.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: FRITZ!Box AddOn - C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\sfkr8s1x.default\Extensions\fb_add_on@avm.de
FF Extension: toolbar - C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\sfkr8s1x.default\Extensions\toolbar@gmx.net.xpi
FF Extension: TrueSuite Website Logon - C:\Program Files (x86)\Mozilla Firefox\extensions\websitelogon@truesuite.com
FF HKLM-x32\...\Firefox\Extensions: [quickprint@hp.com] - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension
FF Extension: SmartPrintButton - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension
FF HKLM-x32\...\Firefox\Extensions: [virtualKeyboard@kaspersky.ru] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\virtualKeyboard@kaspersky.ru
FF Extension: Kaspersky Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\virtualKeyboard@kaspersky.ru
FF HKLM-x32\...\Firefox\Extensions: [linkfilter@kaspersky.ru] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\linkfilter@kaspersky.ru
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\linkfilter@kaspersky.ru
FF HKLM-x32\...\Firefox\Extensions: [KavAntiBanner@Kaspersky.ru] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\KavAntiBanner@Kaspersky.ru
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\KavAntiBanner@Kaspersky.ru
Chrome:
=======
CHR Extension: (Docs) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0
CHR Extension: (Google Drive) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0
CHR Extension: (YouTube) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0
CHR Extension: (Google Search) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0
CHR Extension: (Kaspersky URL Advisor) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.0.477_0
CHR Extension: () - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\gjajpkikblccgefaibcafkfbanllpefi\1.0.0.2
CHR Extension: (Virtual Keyboard) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\12.0.0.477_0
CHR Extension: (Website Logon) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpgfhihjicjofdejkbjgnjlaglaciobe\1.0_0
CHR Extension: () - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk\6.0.2_0
CHR Extension: (Gmail) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
CHR Extension: (Anti-Banner) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\12.0.0.374_0
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ChromeExt\urladvisor.crx
CHR HKLM-x32\...\Chrome\Extension: [gjajpkikblccgefaibcafkfbanllpefi] - C:\Users\Rene\AppData\Roaming\7go\7go.crx
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ChromeExt\virtkbd.crx
CHR HKLM-x32\...\Chrome\Extension: [jpgfhihjicjofdejkbjgnjlaglaciobe] - C:\Program Files (x86)\HP SimplePass 2011\tschrome.crx
CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ChromeExt\ab.crx
==================== Services (Whitelisted) =================
R2 avmike; C:\Program Files\FRITZ!Fernzugang\avmike.exe [336248 2012-02-02] (AVM Berlin)
R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe [206448 2012-10-31] (Kaspersky Lab ZAO)
R2 certsrv; C:\Program Files\FRITZ!Fernzugang\certsrv.exe [143736 2011-10-31] (AVM Berlin)
R2 DTSRVC; C:\Program Files (x86)\Common Files\Portrait Displays\Shared\dtsrvc.exe [136784 2012-08-16] (Portrait Displays, Inc.)
R2 HitmanProScheduler; C:\Program Files\HitmanPro\hmpsched.exe [109352 2013-11-11] (SurfRight B.V.)
R2 nwtsrv; C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe [189304 2011-10-31] (AVM Berlin)
R2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1128952 2011-05-06] (PDF Complete Inc)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1817560 2013-05-16] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1033688 2013-05-16] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2013-05-15] (Safer-Networking Ltd.)
==================== Drivers (Whitelisted) ====================
R0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [460888 2011-03-04] (Kaspersky Lab ZAO)
R1 kl2; C:\Windows\System32\DRIVERS\kl2.sys [11864 2011-03-04] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [637272 2012-10-31] (Kaspersky Lab)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [29488 2011-03-10] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [22544 2009-11-02] (Kaspersky Lab)
R2 NPF_devolo; C:\Windows\sysWOW64\drivers\npf_devolo.sys [34048 2008-11-28] (CACE Technologies)
R3 NWIM; C:\Windows\System32\DRIVERS\avmnwim.sys [412024 2011-07-05] (AVM Berlin)
R3 NWVoltron; C:\Windows\system32\drivers\NWVoltron.sys [28440 2011-06-23] ()
S3 NWWakeFilterV; C:\Windows\system32\drivers\NWWakeFilterV.sys [16152 2011-06-23] (n/a)
S3 pmxdrv; C:\Windows\system32\drivers\pmxdrv.sys [31152 2011-12-20] ()
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-11-12 09:42 - 2013-11-12 09:42 - 00000000 ____D C:\FRST
2013-11-12 09:41 - 2013-11-12 09:41 - 01957590 _____ (Farbar) C:\Users\Rene\Downloads\FRST64.exe
2013-11-12 09:39 - 2013-11-12 09:39 - 00000470 _____ C:\Users\Rene\Downloads\defogger_disable.log
2013-11-12 09:39 - 2013-11-12 09:39 - 00000000 _____ C:\Users\Rene\defogger_reenable
2013-11-12 09:38 - 2013-11-12 09:37 - 00050477 _____ C:\Users\Rene\Downloads\Defogger.exe
2013-11-11 20:23 - 2013-11-11 20:23 - 00005286 _____ C:\Windows\system32\.crusader
2013-11-11 20:06 - 2013-11-11 20:06 - 00001907 _____ C:\Users\Public\Desktop\HitmanPro.lnk
2013-11-11 20:06 - 2013-11-11 20:06 - 00000000 ____D C:\Program Files\HitmanPro
2013-11-11 20:04 - 2013-11-12 08:47 - 00000000 ____D C:\ProgramData\HitmanPro
2013-11-11 20:04 - 2013-11-11 20:05 - 10264904 _____ (SurfRight B.V.) C:\Users\Rene\Downloads\HitmanPro_x64.exe
2013-11-11 20:03 - 2013-11-11 20:03 - 09452704 _____ (SurfRight B.V.) C:\Users\Rene\Downloads\HitmanPro3.7.8.208.exe
2013-11-11 19:50 - 2013-11-11 19:49 - 06141440 _____ (IDT, Inc.) C:\Windows\system32\IDTNGUI.exe
2013-11-11 19:50 - 2013-11-11 19:49 - 05126144 _____ (IDT, Inc.) C:\Windows\system32\IDTNHP.dll
2013-11-11 19:50 - 2013-11-11 19:49 - 01819136 _____ (IDT, Inc.) C:\Windows\system32\IDTNC64.cpl
2013-11-11 19:50 - 2013-11-11 19:49 - 01059328 _____ (IDT, Inc.) C:\Windows\system32\IDTNX.dll
2013-11-11 19:50 - 2013-11-11 19:49 - 00249344 _____ (IDT, Inc.) C:\Windows\system32\IDTNJ.exe
2013-11-11 19:50 - 2013-11-11 19:49 - 00037888 _____ (Hewlett-Packard ) C:\Windows\system32\beats64.exe
2013-11-11 19:49 - 2013-11-11 19:51 - 00000000 ____D C:\Program Files\IDT
2013-11-11 19:49 - 2013-11-11 19:49 - 01986048 _____ (IDT, Inc.) C:\Windows\system32\stapo64.dll
2013-11-11 19:49 - 2013-11-11 19:49 - 00653824 ____N (IDT, Inc.) C:\Windows\system32\stapi64.dll
2013-11-11 19:49 - 2013-11-11 19:49 - 00535040 _____ (IDT, Inc.) C:\Windows\system32\Drivers\stwrt64.sys
2013-11-11 19:41 - 2013-11-11 19:41 - 00000000 ____D C:\Program Files (x86)\Ralink
2013-11-11 19:40 - 2013-11-11 19:40 - 00000000 ____D C:\Users\Rene\AppData\Roaming\InstallShield
2013-11-11 19:39 - 2013-11-11 19:39 - 00000000 ____D C:\Users\Rene\Desktop\Bilder Ebay Kleinanzeigen
2013-10-20 16:53 - 2013-10-20 16:56 - 00003922 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{03891525-6FDC-4836-BAB3-0D1EEB370C56}
2013-10-16 02:17 - 2013-09-23 00:27 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-10-16 02:17 - 2013-09-22 23:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-10-16 02:17 - 2013-09-21 04:38 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-10-16 02:17 - 2013-09-21 04:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-10-16 02:16 - 2013-09-23 00:28 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-10-16 02:16 - 2013-09-23 00:28 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-10-16 02:16 - 2013-09-23 00:27 - 14335488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-10-16 02:16 - 2013-09-23 00:27 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-10-16 02:16 - 2013-09-23 00:27 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-10-16 02:16 - 2013-09-23 00:27 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-10-16 02:16 - 2013-09-23 00:27 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-10-16 02:16 - 2013-09-23 00:27 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-10-16 02:16 - 2013-09-23 00:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-10-16 02:16 - 2013-09-23 00:27 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-10-16 02:16 - 2013-09-23 00:27 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-10-16 02:16 - 2013-09-23 00:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-10-16 02:16 - 2013-09-22 23:55 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-10-16 02:16 - 2013-09-22 23:55 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-10-16 02:16 - 2013-09-22 23:55 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-10-16 02:16 - 2013-09-22 23:54 - 19252224 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-10-16 02:16 - 2013-09-22 23:54 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-10-16 02:16 - 2013-09-22 23:54 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-10-16 02:16 - 2013-09-22 23:54 - 02647552 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-10-16 02:16 - 2013-09-22 23:54 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-10-16 02:16 - 2013-09-22 23:54 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-10-16 02:16 - 2013-09-22 23:54 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-10-16 02:16 - 2013-09-22 23:54 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-10-16 02:16 - 2013-09-22 23:54 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-10-16 02:16 - 2013-09-22 23:54 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-10-16 02:16 - 2013-09-21 03:48 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-10-16 02:16 - 2013-09-21 03:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-10-15 09:20 - 2013-07-12 11:41 - 00185344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys
2013-10-15 09:20 - 2013-07-12 11:41 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
2013-10-15 09:20 - 2013-07-03 05:05 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2013-10-15 09:20 - 2013-07-03 05:05 - 00032896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2013-10-15 09:17 - 2013-07-04 13:50 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2013-10-15 09:16 - 2013-07-04 12:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2013-10-15 09:16 - 2013-06-06 06:50 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2013-10-15 09:16 - 2013-06-06 06:49 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2013-10-15 09:16 - 2013-06-06 06:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2013-10-15 09:16 - 2013-06-06 06:47 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2013-10-15 09:16 - 2013-06-06 05:57 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2013-10-15 09:16 - 2013-06-06 05:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2013-10-15 09:16 - 2013-06-06 05:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2013-10-15 09:16 - 2013-06-06 04:30 - 00368128 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-10-15 09:16 - 2013-06-06 04:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2013-10-15 09:16 - 2013-06-06 04:01 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2013-10-15 09:11 - 2013-06-25 23:55 - 00785624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2013-10-15 09:04 - 2013-09-14 02:10 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-10-15 09:04 - 2013-09-08 03:30 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-10-15 09:04 - 2013-09-08 03:27 - 00327168 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2013-10-15 09:04 - 2013-09-08 03:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswsock.dll
2013-10-15 09:04 - 2013-08-28 02:21 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-10-15 09:04 - 2013-07-04 13:57 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2013-10-15 09:04 - 2013-07-04 13:50 - 00102400 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2013-10-15 09:04 - 2013-07-04 12:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll
2013-10-15 09:04 - 2013-07-04 12:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll
2013-10-15 09:04 - 2013-07-04 11:11 - 00140800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2013-10-15 09:03 - 2013-08-29 03:17 - 05549504 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-10-15 09:03 - 2013-08-29 03:16 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-10-15 09:03 - 2013-08-29 03:16 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2013-10-15 09:03 - 2013-08-29 03:16 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-10-15 09:03 - 2013-08-29 03:13 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2013-10-15 09:03 - 2013-08-29 02:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-10-15 09:03 - 2013-08-29 02:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-10-15 09:03 - 2013-08-29 02:50 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-10-15 09:03 - 2013-08-29 02:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2013-10-15 09:03 - 2013-08-29 02:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-10-15 09:03 - 2013-08-29 02:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2013-10-15 09:03 - 2013-08-29 01:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-10-15 09:03 - 2013-08-29 01:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-10-15 09:03 - 2013-08-29 01:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-10-15 09:03 - 2013-08-29 01:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-10-15 09:03 - 2013-08-28 02:12 - 00461312 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll
2013-10-15 09:03 - 2013-08-01 13:09 - 00983488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-10-15 09:03 - 2013-07-20 11:33 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-15 09:03 - 2013-07-20 11:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
==================== One Month Modified Files and Folders =======
2013-11-12 09:42 - 2013-11-12 09:42 - 00000000 ____D C:\FRST
2013-11-12 09:41 - 2013-11-12 09:41 - 01957590 _____ (Farbar) C:\Users\Rene\Downloads\FRST64.exe
2013-11-12 09:39 - 2013-11-12 09:39 - 00000470 _____ C:\Users\Rene\Downloads\defogger_disable.log
2013-11-12 09:39 - 2013-11-12 09:39 - 00000000 _____ C:\Users\Rene\defogger_reenable
2013-11-12 09:39 - 2012-05-22 15:21 - 00000000 ____D C:\Users\Rene
2013-11-12 09:37 - 2013-11-12 09:38 - 00050477 _____ C:\Users\Rene\Downloads\Defogger.exe
2013-11-12 09:36 - 2012-06-10 22:35 - 00000336 _____ C:\Windows\Tasks\HP Photo Creations Communicator.job
2013-11-12 09:17 - 2012-08-21 10:42 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-12 09:13 - 2012-05-22 18:03 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-603513771-2939990097-2127156883-1001UA.job
2013-11-12 09:02 - 2012-08-21 10:39 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-11-12 09:00 - 2012-11-18 12:46 - 00003180 _____ C:\Windows\System32\Tasks\HPCeeScheduleForRene
2013-11-12 09:00 - 2012-11-18 12:46 - 00000328 _____ C:\Windows\Tasks\HPCeeScheduleForRene.job
2013-11-12 09:00 - 2012-10-31 20:59 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-12 08:52 - 2009-07-14 05:45 - 00024400 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-12 08:52 - 2009-07-14 05:45 - 00024400 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-12 08:51 - 2011-12-20 01:10 - 00696620 _____ C:\Windows\system32\perfh007.dat
2013-11-12 08:51 - 2011-12-20 01:10 - 00147916 _____ C:\Windows\system32\perfc007.dat
2013-11-12 08:51 - 2009-07-14 06:13 - 01612484 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-12 08:48 - 2012-05-22 15:19 - 01138671 _____ C:\Windows\WindowsUpdate.log
2013-11-12 08:47 - 2013-11-11 20:04 - 00000000 ____D C:\ProgramData\HitmanPro
2013-11-12 08:46 - 2013-09-05 19:01 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-12 08:44 - 2012-10-31 20:59 - 00001102 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-12 08:44 - 2011-12-20 01:50 - 00000000 ____D C:\ProgramData\truesuite
2013-11-12 08:44 - 2011-12-20 01:46 - 00000000 ____D C:\ProgramData\PDFC
2013-11-12 08:44 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-12 08:44 - 2009-07-14 05:51 - 00073499 _____ C:\Windows\setupact.log
2013-11-11 20:57 - 2013-10-09 18:50 - 00000000 ____D C:\Users\Rene\AppData\Roaming\Dropbox
2013-11-11 20:57 - 2012-05-22 15:30 - 00000000 ___RD C:\Users\Rene\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-11-11 20:54 - 2013-10-09 18:52 - 00000000 ___RD C:\Users\Rene\Dropbox
2013-11-11 20:53 - 2010-11-21 04:47 - 00783712 _____ C:\Windows\PFRO.log
2013-11-11 20:50 - 2013-08-20 08:29 - 00000000 ____D C:\Users\Geli\AppData\Roaming\PerformerSoft
2013-11-11 20:43 - 2013-01-03 15:30 - 00000000 ____D C:\Users\Rene\Documents\Hausbau
2013-11-11 20:23 - 2013-11-11 20:23 - 00005286 _____ C:\Windows\system32\.crusader
2013-11-11 20:06 - 2013-11-11 20:06 - 00001907 _____ C:\Users\Public\Desktop\HitmanPro.lnk
2013-11-11 20:06 - 2013-11-11 20:06 - 00000000 ____D C:\Program Files\HitmanPro
2013-11-11 20:05 - 2013-11-11 20:04 - 10264904 _____ (SurfRight B.V.) C:\Users\Rene\Downloads\HitmanPro_x64.exe
2013-11-11 20:03 - 2013-11-11 20:03 - 09452704 _____ (SurfRight B.V.) C:\Users\Rene\Downloads\HitmanPro3.7.8.208.exe
2013-11-11 19:57 - 2012-05-22 18:47 - 00001142 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-603513771-2939990097-2127156883-1001UA.job
2013-11-11 19:57 - 2012-05-22 18:47 - 00001120 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-603513771-2939990097-2127156883-1001Core.job
2013-11-11 19:52 - 2012-05-23 16:10 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log
2013-11-11 19:51 - 2013-11-11 19:49 - 00000000 ____D C:\Program Files\IDT
2013-11-11 19:50 - 2011-12-20 01:21 - 00000000 ____D C:\ProgramData\SonicFocus
2013-11-11 19:49 - 2013-11-11 19:50 - 06141440 _____ (IDT, Inc.) C:\Windows\system32\IDTNGUI.exe
2013-11-11 19:49 - 2013-11-11 19:50 - 05126144 _____ (IDT, Inc.) C:\Windows\system32\IDTNHP.dll
2013-11-11 19:49 - 2013-11-11 19:50 - 01819136 _____ (IDT, Inc.) C:\Windows\system32\IDTNC64.cpl
2013-11-11 19:49 - 2013-11-11 19:50 - 01059328 _____ (IDT, Inc.) C:\Windows\system32\IDTNX.dll
2013-11-11 19:49 - 2013-11-11 19:50 - 00249344 _____ (IDT, Inc.) C:\Windows\system32\IDTNJ.exe
2013-11-11 19:49 - 2013-11-11 19:50 - 00037888 _____ (Hewlett-Packard ) C:\Windows\system32\beats64.exe
2013-11-11 19:49 - 2013-11-11 19:49 - 01986048 _____ (IDT, Inc.) C:\Windows\system32\stapo64.dll
2013-11-11 19:49 - 2013-11-11 19:49 - 00653824 ____N (IDT, Inc.) C:\Windows\system32\stapi64.dll
2013-11-11 19:49 - 2013-11-11 19:49 - 00535040 _____ (IDT, Inc.) C:\Windows\system32\Drivers\stwrt64.sys
2013-11-11 19:49 - 2011-12-20 01:21 - 04241408 _____ (IDT, Inc.) C:\Windows\system32\stlang64.dll
2013-11-11 19:49 - 2011-12-20 01:21 - 01424896 _____ (IDT, Inc.) C:\Windows\sttray64.exe
2013-11-11 19:49 - 2011-12-20 01:21 - 00442368 _____ (Andrea Electronics Corporation) C:\Windows\system32\AESTEC64.dll
2013-11-11 19:49 - 2011-12-20 01:21 - 00223744 _____ (IDT, Inc.) C:\Windows\system32\HPToneCtrls64.dll
2013-11-11 19:49 - 2011-12-20 01:21 - 00162304 _____ (Andrea Electronics Corporation) C:\Windows\system32\AESTAC64.dll
2013-11-11 19:49 - 2011-12-20 01:21 - 00090624 _____ (Andrea Electronics Corporation) C:\Windows\system32\AESTCo64.dll
2013-11-11 19:49 - 2011-12-20 01:21 - 00068608 _____ (Andrea Electronics Corporation) C:\Windows\system32\AESTAR64.dll
2013-11-11 19:49 - 2011-12-20 01:18 - 00250880 _____ (IDT, Inc.) C:\Windows\system32\staco64.dll
2013-11-11 19:49 - 2011-02-11 17:32 - 00000000 ____D C:\SWSETUP
2013-11-11 19:48 - 2013-10-09 19:24 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2013-11-11 19:41 - 2013-11-11 19:41 - 00000000 ____D C:\Program Files (x86)\Ralink
2013-11-11 19:41 - 2011-12-20 01:29 - 00005496 _____ C:\Windows\system32\RaCoInst.log
2013-11-11 19:40 - 2013-11-11 19:40 - 00000000 ____D C:\Users\Rene\AppData\Roaming\InstallShield
2013-11-11 19:39 - 2013-11-11 19:39 - 00000000 ____D C:\Users\Rene\Desktop\Bilder Ebay Kleinanzeigen
2013-11-11 19:09 - 2012-05-22 15:30 - 00003922 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{CF4CA5DA-2485-4C39-842E-3908496AFD16}
2013-11-04 15:44 - 2012-05-30 11:17 - 00000000 ____D C:\ProgramData\HP Photo Creations
2013-11-04 15:41 - 2013-03-30 10:25 - 00003922 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{673C6173-064B-48E4-8E60-310E0137200F}
2013-11-03 20:39 - 2012-11-28 21:16 - 00003216 _____ C:\Windows\System32\Tasks\HPCeeScheduleForRENE-HP$
2013-11-03 20:39 - 2012-11-28 21:16 - 00000340 _____ C:\Windows\Tasks\HPCeeScheduleForRENE-HP$.job
2013-11-03 18:42 - 2013-05-15 19:42 - 00000000 _____ C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2013-11-03 18:40 - 2012-05-23 16:06 - 00000000 ____D C:\Users\Rene\AppData\Roaming\HpUpdate
2013-11-03 18:40 - 2012-05-23 16:06 - 00000000 ____D C:\Users\Rene\AppData\Roaming\HP Support Assistant
2013-11-03 18:13 - 2012-05-22 18:03 - 00001072 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-603513771-2939990097-2127156883-1001Core.job
2013-11-03 17:56 - 2013-08-08 21:29 - 00013400 _____ C:\Users\Rene\Documents\Gesamtkosten Haus.xlsx
2013-10-26 09:52 - 2012-11-22 22:03 - 00269312 ___SH C:\Users\Rene\Documents\Thumbs.db
2013-10-20 17:03 - 2013-10-09 18:52 - 00001017 _____ C:\Users\Rene\Desktop\Dropbox.lnk
2013-10-20 17:03 - 2013-10-09 18:51 - 00000000 ____D C:\Users\Rene\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2013-10-20 16:56 - 2013-10-20 16:53 - 00003922 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{03891525-6FDC-4836-BAB3-0D1EEB370C56}
2013-10-20 16:55 - 2012-10-31 20:59 - 00004102 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-10-20 16:55 - 2012-10-31 20:59 - 00003850 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-10-16 03:15 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-10-16 02:37 - 2013-03-14 22:57 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-10-16 02:37 - 2013-03-14 22:57 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-10-16 02:37 - 2009-07-14 05:45 - 00342240 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-16 02:19 - 2012-05-22 15:56 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-10-16 02:12 - 2011-02-11 18:15 - 01589442 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2013-10-16 02:08 - 2013-08-19 08:27 - 00000000 ____D C:\Windows\system32\MRT
2013-10-16 02:05 - 2012-06-01 10:16 - 80541720 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
Some content of TEMP:
====================
C:\Users\Rene\AppData\Local\Temp\Extract.exe
C:\Users\Rene\AppData\Local\Temp\SP57550.exe
C:\Users\Rene\AppData\Local\Temp\SP58084.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-11-03 20:48
==================== End Of Log ============================
--- --- --- --- --- --- --- --- --- Code:
ATTFilter ComboFix 13-10-09.01 - Rene 10.10.2013 15:38:22.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.4000.1922 [GMT 2:00]
ausgeführt von:: c:\users\Rene\Downloads\ComboFix.exe
AV: Kaspersky Internet Security *Disabled/Updated* {2EAA32A5-1EE1-1B22-95DA-337730C6E984}
FW: Kaspersky Internet Security *Disabled* {1691B380-548E-1A7A-BE85-9A42CE15AEFF}
SP: Kaspersky Internet Security *Disabled/Updated* {95CBD341-38DB-14AC-AF6A-08054B41A339}
SP: Spybot - Search and Destroy *Disabled/Outdated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Rene\AppData\Local\Google\Chrome\User Data\Default\bProtector Web Data
c:\users\Rene\AppData\Local\Google\Chrome\User Data\Default\bProtectorPreferences
c:\users\Rene\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_eooncjejnppfjjklapaamhcdmjbilmde_0.localstorage
c:\users\Rene\AppData\Local\Microsoft\Windows\Temporary Internet Files\{1A0B9545-D418-4DAD-9229-502FE54719EC}.xps
c:\users\Rene\AppData\Local\Microsoft\Windows\Temporary Internet Files\{1C48B433-885D-4B90-B46A-C3873C8493DA}.xps
c:\users\Rene\AppData\Local\Microsoft\Windows\Temporary Internet Files\{820ED722-7FA7-4FE6-ABC1-BC2BED50E69E}.xps
c:\users\Rene\AppData\Local\Microsoft\Windows\Temporary Internet Files\{DEF6EB6D-F97A-4DBD-922F-FCCB19950C29}.xps
c:\users\Rene\AppData\Local\Microsoft\Windows\Temporary Internet Files\{F1461741-D798-4622-96BF-7134B15DF6D2}.xps
c:\users\Rene\AppData\Roaming\7go
c:\users\Rene\AppData\Roaming\7go\7go.crx
c:\users\Rene\AppData\Roaming\7go\icon.ico
c:\users\Sophie\AppData\Local\Google\Chrome\User Data\Default\bProtector Web Data
c:\users\Sophie\AppData\Local\Google\Chrome\User Data\Default\bProtectorPreferences
c:\users\Sophie\AppData\Local\Google\Chrome\User Data\Default\Preferences
c:\users\Sophie\AppData\Local\Microsoft\Windows\Temporary Internet Files\{22DCC5A5-D69E-44AC-BFA7-8B18DACE9BA0}.xps
c:\users\Sophie\AppData\Local\Microsoft\Windows\Temporary Internet Files\{C25CF7B5-F7A2-4887-80DA-247051624241}.xps
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-09-10 bis 2013-10-10 ))))))))))))))))))))))))))))))
.
.
2013-10-10 13:49 . 2013-10-10 13:49 -------- d-----w- c:\users\Sophie\AppData\Local\temp
2013-10-10 13:49 . 2013-10-10 13:49 -------- d-----w- c:\users\Geli\AppData\Local\temp
2013-10-10 13:49 . 2013-10-10 13:49 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-10-10 12:34 . 2013-10-10 12:58 -------- d-----w- c:\users\Rene\AppData\Roaming\ImgBurn
2013-10-10 12:28 . 2013-10-10 12:28 76232 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{18D9F85D-78ED-41D0-9096-A7A73C28D198}\offreg.dll
2013-10-10 12:19 . 2013-10-10 12:19 -------- d-----w- c:\program files (x86)\ImgBurn
2013-10-10 11:56 . 2011-06-09 13:32 1658880 ----a-w- c:\program files (x86)\Mozilla Firefox\extensions\websitelogon@truesuite.com\components\FFXPCOM.dll
2013-10-09 18:24 . 2013-10-09 20:54 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2013-10-09 18:24 . 2009-01-25 11:14 17272 ----a-w- c:\windows\system32\sdnclean64.exe
2013-10-09 18:24 . 2013-10-09 18:24 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy 2
2013-10-09 17:52 . 2013-10-10 11:58 -------- d-----r- c:\users\Rene\Dropbox
2013-10-09 17:50 . 2013-10-10 11:58 -------- d-----w- c:\users\Rene\AppData\Roaming\Dropbox
2013-10-09 15:29 . 2013-09-05 05:32 9694160 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{18D9F85D-78ED-41D0-9096-A7A73C28D198}\mpengine.dll
2013-10-07 13:38 . 2013-10-07 13:39 -------- d-----w- c:\users\Rene\AppData\Roaming\InfraRecorder
2013-10-07 13:37 . 2013-10-07 13:37 -------- d-----w- c:\program files\InfraRecorder
2013-10-07 13:08 . 2013-10-07 13:08 -------- d-----w- c:\program files\Enigma Software Group
2013-10-07 13:07 . 2013-10-09 18:26 -------- d-----w- c:\windows\86CA3695A4124BAE92B649A60C2AC663.TMP
2013-10-07 12:11 . 2013-10-07 12:11 -------- d-----w- c:\users\Rene\AppData\Roaming\Malwarebytes
2013-10-07 12:11 . 2013-10-07 12:11 -------- d-----w- c:\programdata\Malwarebytes
2013-10-07 12:11 . 2013-10-07 12:11 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2013-10-07 12:11 . 2013-04-04 12:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-10-07 12:07 . 2013-10-07 12:07 -------- d-----w- c:\users\Rene\AppData\Roaming\IObit
2013-09-30 14:55 . 2013-09-30 14:55 -------- d-----w- c:\program files (x86)\devolo
2013-09-19 17:14 . 2013-09-11 02:28 271256 ----a-w- c:\program files (x86)\Mozilla Firefox\browser\components\browsercomps.dll
2013-09-13 18:52 . 2013-08-05 02:25 155584 ----a-w- c:\windows\system32\drivers\ataport.sys
2013-09-13 18:41 . 2013-07-26 02:24 14172672 ----a-w- c:\windows\system32\shell32.dll
2013-09-13 18:41 . 2013-07-26 02:24 197120 ----a-w- c:\windows\system32\shdocvw.dll
2013-09-12 18:09 . 2013-09-12 20:07 -------- d-----w- c:\users\TEMP
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-10-09 17:19 . 2012-05-29 09:42 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-10-09 17:19 . 2012-05-29 09:42 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-09-01 15:08 . 2012-06-01 09:16 79143768 ----a-w- c:\windows\system32\MRT.exe
2013-08-07 02:22 . 2010-11-21 03:27 278800 ------w- c:\windows\system32\MpSigStub.exe
2013-08-02 01:48 . 2013-09-13 18:44 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2013-07-25 09:25 . 2013-08-19 06:43 1888768 ----a-w- c:\windows\system32\WMVDECOD.DLL
2013-07-25 08:57 . 2013-08-19 06:43 1620992 ----a-w- c:\windows\SysWow64\WMVDECOD.DLL
2013-07-19 01:58 . 2013-08-19 06:42 2048 ----a-w- c:\windows\system32\tzres.dll
2013-07-19 01:41 . 2013-08-19 06:42 2048 ----a-w- c:\windows\SysWow64\tzres.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 131248 ----a-w- c:\users\Rene\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 131248 ----a-w- c:\users\Rene\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 131248 ----a-w- c:\users\Rene\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"HP Photosmart 5510d series (NET)"="c:\program files\hp\HP Photosmart 5510d series\Bin\ScanToPCActivationApp.exe" [2011-08-16 2676584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Easybits Recovery"="c:\program files (x86)\EasyBits For Kids\ezRecover.exe" [2011-05-17 61112]
"DT HPO"="c:\program files (x86)\Common Files\Portrait Displays\Shared\DT_startup.exe" [2012-08-16 120400]
"PDF Complete"="c:\program files (x86)\PDF Complete\pdfsty.exe" [2011-05-06 658424]
"FreePDF Assistant"="c:\program files (x86)\FreePDF_XP\fpassist.exe" [2011-02-23 371200]
"ITSecMng"="c:\program files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2009-07-22 83336]
"AVP"="c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe" [2012-10-31 206448]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"PivotSoftware"="c:\program files (x86)\Portrait Displays\Pivot Pro Plugin\Pivot_startup.exe" [2010-05-13 110192]
"SDTray"="c:\program files (x86)\Spybot - Search & Destroy 2\SDTray.exe" [2013-05-16 3830224]
.
c:\users\Rene\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Rene\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2013-10-4 29767928]
Tintenwarnungen überwachen - HP Photosmart 5510d series (Netzwerk).lnk - c:\windows\system32\RunDll32.exe "c:\program files\HP\HP Photosmart 5510d series\bin\HPStatusBL.dll",RunDLLEntry SERIALNUMBER=CN19U115VQ05RW;CONNECTION=NW;MONITOR=1; [2009-7-14 45568]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth Manager.lnk - c:\program files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2009-7-31 2680160]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"HideFastUserSwitching"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"EnableShellExecuteHooks"= 1 (0x1)
.
[hkey_local_machine\software\Wow6432Node\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean64.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"HP Software Update"=c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 FPLService;TrueSuiteService;c:\program files (x86)\HP SimplePass 2011\TrueSuiteService.exe;c:\program files (x86)\HP SimplePass 2011\TrueSuiteService.exe [x]
R2 SDScannerService;Spybot-S&D 2 Scanner Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [x]
R2 SDUpdateService;Spybot-S&D 2 Updating Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [x]
R2 SDWSCService;Spybot-S&D 2 Security Center Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [x]
R3 hidkmdf;Microsoft HID Class Shim for KMDF;c:\windows\system32\drivers\hidkmdf.sys;c:\windows\SYSNATIVE\drivers\hidkmdf.sys [x]
R3 NWWakeFilterV;NextWindow Remote Wake Blocker (V);c:\windows\system32\drivers\NWWakeFilterV.sys;c:\windows\SYSNATIVE\drivers\NWWakeFilterV.sys [x]
R3 pmxdrv;pmxdrv;c:\windows\system32\drivers\pmxdrv.sys;c:\windows\SYSNATIVE\drivers\pmxdrv.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S1 kl2;kl2;c:\windows\system32\DRIVERS\kl2.sys;c:\windows\SYSNATIVE\DRIVERS\kl2.sys [x]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys;c:\windows\SYSNATIVE\DRIVERS\klim6.sys [x]
S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe;c:\program files\IDT\WDM\AESTSr64.exe [x]
S2 avmike;AVM FRITZ!Fernzugang IKE Service;c:\program files\FRITZ!Fernzugang\avmike.exe;c:\program files\FRITZ!Fernzugang\avmike.exe [x]
S2 CalendarSynchService;CalendarSynchService;c:\program files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\GCalService.exe;c:\program files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\GCalService.exe [x]
S2 certsrv;AVM FRITZ!Fernzugang Cert Service;c:\program files\FRITZ!Fernzugang\certsrv.exe;c:\program files\FRITZ!Fernzugang\certsrv.exe [x]
S2 ezSharedSvc;Easybits Services for Windows;c:\windows\System32\ezSharedSvcHost.exe;c:\windows\SYSNATIVE\ezSharedSvcHost.exe [x]
S2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [x]
S2 HPClientSvc;HP Client Services;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe;c:\program files\Hewlett-Packard\HP Client Services\HPClientServices.exe [x]
S2 IconMan_R;IconMan_R;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [x]
S2 jhi_service;Intel(R) Identity Protection Technology Host Interface Service;c:\program files (x86)\Intel\Services\IPT\jhi_service.exe;c:\program files (x86)\Intel\Services\IPT\jhi_service.exe [x]
S2 NPF_devolo;NetGroup Packet Filter Driver (devolo);c:\windows\sysWOW64\drivers\npf_devolo.sys;c:\windows\sysWOW64\drivers\npf_devolo.sys [x]
S2 nwtsrv;AVM FRITZ!Fernzugang Client;c:\program files\FRITZ!Fernzugang\nwtsrv.exe;c:\program files\FRITZ!Fernzugang\nwtsrv.exe [x]
S2 pdfcDispatcher;PDF Document Manager;c:\program files (x86)\PDF Complete\pdfsvc.exe;c:\program files (x86)\PDF Complete\pdfsvc.exe [x]
S2 PdiService;Portrait Displays SDK Service;c:\program files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe;c:\program files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S3 clwvd;HP Webcam Splitter;c:\windows\system32\DRIVERS\clwvd.sys;c:\windows\SYSNATIVE\DRIVERS\clwvd.sys [x]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys;c:\windows\SYSNATIVE\DRIVERS\klmouflt.sys [x]
S3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys;c:\windows\SYSNATIVE\DRIVERS\netr28x.sys [x]
S3 NWIM;AVM VPN Miniport;c:\windows\system32\DRIVERS\avmnwim.sys;c:\windows\SYSNATIVE\DRIVERS\avmnwim.sys [x]
S3 NWVoltron;NextWindow Voltron Touch Screen;c:\windows\system32\drivers\NWVoltron.sys;c:\windows\SYSNATIVE\drivers\NWVoltron.sys [x]
S3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys;c:\windows\SYSNATIVE\DRIVERS\RtsPStor.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 tihub3;TI USB3 Hub Service;c:\windows\system32\drivers\tihub3.sys;c:\windows\SYSNATIVE\drivers\tihub3.sys [x]
S3 tixhci;TI XHCI Service;c:\windows\system32\drivers\tixhci.sys;c:\windows\SYSNATIVE\drivers\tixhci.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2013-10-10 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-29 17:19]
.
2013-10-09 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-603513771-2939990097-2127156883-1001Core.job
- c:\users\Sophie\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-05-22 17:52]
.
2013-10-10 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-603513771-2939990097-2127156883-1001UA.job
- c:\users\Sophie\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-05-22 17:52]
.
2013-10-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-10-31 19:59]
.
2013-10-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-10-31 19:59]
.
2013-10-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-603513771-2939990097-2127156883-1001Core.job
- c:\users\Sophie\AppData\Local\Google\Update\GoogleUpdate.exe [2012-05-22 17:03]
.
2013-10-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-603513771-2939990097-2127156883-1001UA.job
- c:\users\Sophie\AppData\Local\Google\Update\GoogleUpdate.exe [2012-05-22 17:03]
.
2013-10-10 c:\windows\Tasks\HP Photo Creations Communicator.job
- c:\programdata\HP Photo Creations\Communicator.exe [2012-06-10 14:49]
.
2013-09-30 c:\windows\Tasks\HPCeeScheduleForRENE-HP$.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 06:15]
.
2013-10-10 c:\windows\Tasks\HPCeeScheduleForRene.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 06:15]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 164016 ----a-w- c:\users\Rene\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 164016 ----a-w- c:\users\Rene\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 164016 ----a-w- c:\users\Rene\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 164016 ----a-w- c:\users\Rene\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BeatsOSDApp"="c:\program files\IDT\WDM\beats64.exe" [2010-10-21 37888]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2011-06-24 1128448]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-07-01 167704]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-07-01 392472]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-07-01 416024]
"hpsysdrv"="c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe" [2008-11-20 62768]
"Logitech Download Assistant"="c:\windows\System32\LogiLDA.dll" [2012-09-20 1832760]
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://t-online.de/
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyServer = localhost:21320
IE: An OneNote s&enden - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: Hinzufügen zu Anti-Banner - c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ie_banner_deny.htm
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\sfkr8s1x.default\
FF - prefs.js: browser.search.defaulturl -
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - t-online.de
FF - ExtSQL: 2013-10-01 19:44; fb_add_on@avm.de; c:\users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\sfkr8s1x.default\extensions\fb_add_on@avm.de
FF - user.js: extensions.delta.tlbrSrchUrl -
FF - user.js: extensions.delta.id - a0cb8a0900000000000074de2b3fd784
FF - user.js: extensions.delta.appId - {C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
FF - user.js: extensions.delta.instlDay - 15937
FF - user.js: extensions.delta.vrsn - 1.8.24.5
FF - user.js: extensions.delta.vrsni - 1.8.24.5
FF - user.js: extensions.delta.vrsnTs - 1.8.24.59:25
FF - user.js: extensions.delta.prtnrId - delta
FF - user.js: extensions.delta.prdct - delta
FF - user.js: extensions.delta.aflt - babsst
FF - user.js: extensions.delta.smplGrp - none
FF - user.js: extensions.delta.tlbrId - base
FF - user.js: extensions.delta.instlRef - sst
FF - user.js: extensions.delta.dfltLng - de
FF - user.js: extensions.delta.excTlbr - false
FF - user.js: extensions.delta.ffxUnstlRst - true
FF - user.js: extensions.delta.admin - false
FF - user.js: extensions.delta_i.babTrack - affID=119649&tsp=4980
FF - user.js: extensions.delta_i.babExt -
FF - user.js: extensions.delta_i.srcExt - ss
FF - user.js: extensions.delta.autoRvrt - false
FF - user.js: extensions.delta.rvrt - false
FF - user.js: extensions.delta.newTab - false
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{EEE6C35C-6118-11DC-9C72-001320C79847} - c:\program files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
Toolbar-{EEE6C35B-6118-11DC-9C72-001320C79847} - c:\program files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
Notify-SDWinLogon - SDWinLogon.dll
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
AddRemove-7go - c:\program files (x86)\7go\uninst.exe
AddRemove-EasyBits Magic Desktop - c:\windows\system32\ezMDUninstall.exe
AddRemove-{EE202411-2C26-49E8-9784-1BC1DBF7DE96} - c:\program files (x86)\InstallShield Installation Information\{EE202411-2C26-49E8-9784-1BC1DBF7DE96}\setup.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\pdfcDispatcher]
"ImagePath"="c:\program files (x86)\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_117_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_117_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_117_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_117_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_117.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_117.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_117.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_117.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-10-10 16:07:40
ComboFix-quarantined-files.txt 2013-10-10 14:07
.
Vor Suchlauf: 8 Verzeichnis(se), 383.993.741.312 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 385.352.617.984 Bytes frei
.
- - End Of File - - B7B7E2FE35FAE0D4E6040ACAD4D75ED4
Code:
ATTFilter
|
|
12.11.2013, 13:58
| #4 |
| | Wichtige Sicherheitswarnung zu Ihrem Internetanschluss Abuse T-OnlineCode:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.10.07.07 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16686 Rene :: RENE-HP [limitiert] 07.10.2013 14:16:26 mbam-log-2013-10-07 (14-16-26).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 435937 Laufzeit: 43 Minute(n), 7 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 24 HKCR\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3} (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt. HKCR\CLSID\{DF84E609-C3A4-49CB-A160-61767DAF8899} (PUP.Optional.WebCake.A) -> Keine Aktion durchgeführt. HKCR\Interface\{DF84E609-C3A4-49CB-A160-61767DAF8899} (PUP.Optional.WebCake.A) -> Keine Aktion durchgeführt. HKCR\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847} (PUP.Optional.SweetPacks) -> Keine Aktion durchgeführt. HKCR\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847} (PUP.Optional.SweetPacks) -> Keine Aktion durchgeführt. HKCR\Interface\{EEE6C358-6118-11DC-9C72-001320C79847} (PUP.Optional.SweetPacks) -> Keine Aktion durchgeführt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847} (PUP.Optional.SweetPacks) -> Keine Aktion durchgeführt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35C-6118-11DC-9C72-001320C79847} (PUP.Optional.SweetPacks) -> Keine Aktion durchgeführt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847} (PUP.Optional.SweetPacks) -> Keine Aktion durchgeführt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{18DBB6CE-3148-4FEC-B481-103CB3290427} (PUP.Optional.SpeedAnalysis.A) -> Keine Aktion durchgeführt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{FF103732-4528-4322-AA8B-F7849AB7776B} (PUP.Optional.BestToolbars) -> Keine Aktion durchgeführt. HKCU\SOFTWARE\DataMngr_Toolbar (PUP.Optional.DataMngr.A) -> Keine Aktion durchgeführt. HKCU\SOFTWARE\DELTA\DELTA (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt. HKCU\Software\DataMngr (PUP.Optional.DataMngr.A) -> Keine Aktion durchgeführt. HKCU\Software\BabSolution\Redir (PUP.Optional.Babylon.A) -> Keine Aktion durchgeführt. HKCU\Software\BabSolution\Updater (PUP.Optional.Babylon.A) -> Keine Aktion durchgeführt. HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings (PUP.Optional.BProtector.A) -> Keine Aktion durchgeführt. HKLM\SOFTWARE\Delta\delta\Instl (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt. HKCR\Toolbar3.SWEETIE.1 (PUP.Optional.SweetPacks) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\Toolbar3.SWEETIE (PUP.Optional.SweetPacks) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\SweetIM_URLSearchHook.ToolbarURLSearchHook (PUP.Optional.SweetIM.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\SweetIM_URLSearchHook.ToolbarURLSearchHook.1 (PUP.Optional.SweetIM.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\SWEETIM (PUP.Optional.SweetIM.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\SWEETIM (PUP.Optional.SweetIM.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Registrierungswerte: 5 HKCU\SOFTWARE\Delta\Delta|tlbrSrchUrl (PUP.Optional.Delta.A) -> Daten: -> Keine Aktion durchgeführt. HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|bProtector Start Page (PUP.BProtector) -> Daten: hxxp://www1.delta-search.com/?babsrc=HP_ss&mntrId=A0CB74DE2B3FD784&affID=119649&tsp=4980 -> Keine Aktion durchgeführt. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes|bProtectorDefaultScope (PUP.BProtector) -> Daten: {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} -> Keine Aktion durchgeführt. HKCU\Software\SweetIM|simapp_id (PUP.Optional.SweetIM.A) -> Daten: {815B18B5-5756-11E2-9130-3860776FDA87} -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\Software\SweetIM|simapp_id (PUP.Optional.SweetIM.A) -> Daten: {815B18B5-5756-11E2-9130-3860776FDA87} -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 19 C:\Users\Rene\AppData\Roaming\Babylon (PUP.Optional.Babylon.A) -> Keine Aktion durchgeführt. C:\Users\Geli\AppData\Roaming\PerformerSoft\PC Performer (PUP.Optional.PCPerformer.A) -> Keine Aktion durchgeführt. C:\Users\Rene\AppData\Roaming\SpeedAnalysis2 (PUP.Optional.SpeedAnalysis.A) -> Keine Aktion durchgeführt. C:\Users\Rene\AppData\Roaming\Delta (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt. C:\Users\Rene\AppData\Roaming\7go (PUP.Optional.7Go.A) -> Keine Aktion durchgeführt. C:\ProgramData\Tarma Installer (PUP.Optional.Tarma.A) -> Keine Aktion durchgeführt. C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504} (PUP.Optional.Tarma.A) -> Keine Aktion durchgeführt. C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Cache (PUP.Optional.Tarma.A) -> Keine Aktion durchgeführt. C:\Users\Rene\AppData\Roaming\OpenCandy (PUP.Optional.OpenCandy) -> Keine Aktion durchgeführt. C:\Users\Rene\AppData\Roaming\OpenCandy\E53B3CD5ED274734AECA045FA514DB9F (PUP.Optional.OpenCandy) -> Keine Aktion durchgeführt. C:\Users\Rene\AppData\Roaming\File Scout (PUP.Optional.FileScout.A) -> Keine Aktion durchgeführt. C:\Users\Rene\AppData\Local\Temp\mt_ffx\Delta (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt. C:\Users\Rene\AppData\Local\Temp\mt_ffx\Delta\delta (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt. C:\Users\Rene\AppData\Local\Temp\mt_ffx\Delta\delta\1.8.24.5 (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt. C:\ProgramData\IBUpdaterService (Adware.InstallBrain) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\BrowserDefender\2.6.1562.220 (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\BrowserDefender\2.6.1562.220\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8} (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\BrowserDefender\2.6.1562.220\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\BrowserDefender\2.6.1562.220\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\traking_settings (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateien: 68 C:\$RECYCLE.BIN\S-1-5-21-603513771-2939990097-2127156883-1000\$RK5NA4I\Toolbars\Internet Explorer\ClearHist.exe (PUP.Optional.SweetIM) -> Keine Aktion durchgeführt. C:\$RECYCLE.BIN\S-1-5-21-603513771-2939990097-2127156883-1000\$RK5NA4I\Toolbars\Internet Explorer\mgcommon.dll (PUP.Optional.SweetIM) -> Keine Aktion durchgeführt. C:\$RECYCLE.BIN\S-1-5-21-603513771-2939990097-2127156883-1000\$RK5NA4I\Toolbars\Internet Explorer\mgconfig.dll (PUP.Optional.SweetIM) -> Keine Aktion durchgeführt. C:\$RECYCLE.BIN\S-1-5-21-603513771-2939990097-2127156883-1000\$RK5NA4I\Toolbars\Internet Explorer\mgHelper.dll (PUP.Optional.SweetIM) -> Keine Aktion durchgeführt. C:\$RECYCLE.BIN\S-1-5-21-603513771-2939990097-2127156883-1000\$RK5NA4I\Toolbars\Internet Explorer\mgHelperApp.exe (PUP.Optional.SweetIM) -> Keine Aktion durchgeführt. C:\$RECYCLE.BIN\S-1-5-21-603513771-2939990097-2127156883-1000\$RK5NA4I\Toolbars\Internet Explorer\mghooking.dll (PUP.Optional.SweetIM) -> Keine Aktion durchgeführt. C:\$RECYCLE.BIN\S-1-5-21-603513771-2939990097-2127156883-1000\$RK5NA4I\Toolbars\Internet Explorer\mglogger.dll (PUP.Optional.SweetIM) -> Keine Aktion durchgeführt. C:\$RECYCLE.BIN\S-1-5-21-603513771-2939990097-2127156883-1000\$RK5NA4I\Toolbars\Internet Explorer\mgsimcommon.dll (PUP.Optional.SweetIM) -> Keine Aktion durchgeführt. C:\$RECYCLE.BIN\S-1-5-21-603513771-2939990097-2127156883-1000\$RK5NA4I\Toolbars\Internet Explorer\mgToolbarIE.dll (PUP.Optional.SweetPacks) -> Keine Aktion durchgeführt. C:\$RECYCLE.BIN\S-1-5-21-603513771-2939990097-2127156883-1000\$RK5NA4I\Toolbars\Internet Explorer\mgToolbarProxy.dll (PUP.Optional.SweetIM) -> Keine Aktion durchgeführt. C:\$RECYCLE.BIN\S-1-5-21-603513771-2939990097-2127156883-1000\$RK5NA4I\Toolbars\Internet Explorer\mgxml_wrapper.dll (PUP.Optional.SweetIM) -> Keine Aktion durchgeführt. C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.exe (PUP.Optional.Tarma.A) -> Keine Aktion durchgeführt. C:\Users\Rene\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RU0FS4RJ\WebCakesetup[1].exe (PUP.Optional.Yontoo) -> Keine Aktion durchgeführt. C:\Users\Rene\AppData\Local\Temp\mgsqlite3.7z (PUP.Optional.SweetIM) -> Keine Aktion durchgeführt. C:\Users\Rene\AppData\Local\Temp\Shortcut_PhotoMania.exe (PUP.Optional.SweetIM) -> Keine Aktion durchgeführt. C:\Users\Rene\AppData\Local\Temp\2827278562\chromeupdaterfull.exe (PUP.Optional.SweetIM) -> Keine Aktion durchgeführt. C:\Users\Rene\AppData\Local\Temp\331069C6-BAB0-7891-86BE-E1390E5E837B\Setup.exe (PUP.Optional.Babylon.A) -> Keine Aktion durchgeführt. C:\Users\Rene\AppData\Roaming\File Scout\filescout.exe (PUP.Optional.FileScout.A) -> Keine Aktion durchgeführt. C:\Users\Sophie\AppData\Local\Temp\2827278562\chromeupdaterfull.exe (PUP.Optional.SweetIM) -> Keine Aktion durchgeführt. C:\Users\Sophie\Downloads\etypesetup.exe (PUP.Optional.Somoto) -> Keine Aktion durchgeführt. C:\Users\Sophie\Downloads\iLividSetupV1.exe (PUP.Optional.Bandoo) -> Keine Aktion durchgeführt. C:\Users\Sophie\Downloads\PhotoMania.exe (PUP.Optional.SweetIM) -> Keine Aktion durchgeführt. C:\Users\Sophie\Downloads\TubeBox_Setup_3.6.1.exe (PUP.Optional.OpenCandy) -> Keine Aktion durchgeführt. C:\Users\Rene\AppData\Roaming\Babylon\log_file.txt (PUP.Optional.Babylon.A) -> Keine Aktion durchgeführt. C:\Users\Geli\AppData\Roaming\PerformerSoft\PC Performer\rcpupdate.ini (PUP.Optional.PCPerformer.A) -> Keine Aktion durchgeführt. C:\Users\Geli\AppData\Roaming\PerformerSoft\PC Performer\eng_rcp.dat (PUP.Optional.PCPerformer.A) -> Keine Aktion durchgeführt. C:\Users\Geli\AppData\Roaming\PerformerSoft\PC Performer\ExcludeList.rcp (PUP.Optional.PCPerformer.A) -> Keine Aktion durchgeführt. C:\Users\Geli\AppData\Roaming\PerformerSoft\PC Performer\log_08-20-2013.log (PUP.Optional.PCPerformer.A) -> Keine Aktion durchgeführt. C:\Users\Geli\AppData\Roaming\PerformerSoft\PC Performer\results.rcp (PUP.Optional.PCPerformer.A) -> Keine Aktion durchgeführt. C:\Users\Geli\AppData\Roaming\PerformerSoft\PC Performer\TempHLList.rcp (PUP.Optional.PCPerformer.A) -> Keine Aktion durchgeführt. C:\Users\Rene\AppData\Roaming\SpeedAnalysis2\speedanalysis.crx (PUP.Optional.SpeedAnalysis.A) -> Keine Aktion durchgeführt. C:\Users\Rene\AppData\Roaming\Delta\sqlite3.dll (PUP.Optional.Delta.A) -> Keine Aktion durchgeführt. C:\Users\Rene\AppData\Roaming\speedanalysis.ico (PUP.Optional.SpeedAnalysis2.A) -> Keine Aktion durchgeführt. C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\bProtector Web Data (PUP.Optional.BProtector.A) -> Keine Aktion durchgeführt. C:\Users\Sophie\AppData\Local\Google\Chrome\User Data\Default\bprotector web data (PUP.Optional.BProtector.A) -> Keine Aktion durchgeführt. C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\bProtectorPreferences (PUP.Optional.BProtector.A) -> Keine Aktion durchgeführt. C:\Users\Sophie\AppData\Local\Google\Chrome\User Data\Default\bprotectorpreferences (PUP.Optional.BProtector.A) -> Keine Aktion durchgeführt. C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_eooncjejnppfjjklapaamhcdmjbilmde_0.localstorage (PUP.Optional.BrowserDefender.A) -> Keine Aktion durchgeführt. C:\Users\Rene\AppData\Roaming\7go\7go.crx (PUP.Optional.7Go.A) -> Keine Aktion durchgeführt. C:\Users\Rene\AppData\Roaming\7go\icon.ico (PUP.Optional.7Go.A) -> Keine Aktion durchgeführt. C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.dat (PUP.Optional.Tarma.A) -> Keine Aktion durchgeführt. C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.ico (PUP.Optional.Tarma.A) -> Keine Aktion durchgeführt. C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setup.dll (PUP.Optional.Tarma.A) -> Keine Aktion durchgeführt. C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setupx.dll (PUP.Optional.Tarma.A) -> Keine Aktion durchgeführt. C:\Users\Rene\AppData\Roaming\OpenCandy\E53B3CD5ED274734AECA045FA514DB9F\2787.ico (PUP.Optional.OpenCandy) -> Keine Aktion durchgeführt. C:\Users\Rene\AppData\Roaming\OpenCandy\E53B3CD5ED274734AECA045FA514DB9F\EBB77268-338F-4C6A-8590-AD88FED26F4A (PUP.Optional.OpenCandy) -> Keine Aktion durchgeführt. C:\Users\Rene\AppData\Roaming\OpenCandy\E53B3CD5ED274734AECA045FA514DB9F\LinkuryInstaller.msi (PUP.Optional.OpenCandy) -> Keine Aktion durchgeführt. C:\Users\Rene\AppData\Roaming\OpenCandy\E53B3CD5ED274734AECA045FA514DB9F\LinkuryInstaller_p1v16.exe (PUP.Optional.OpenCandy) -> Keine Aktion durchgeführt. C:\Users\Rene\AppData\Roaming\OpenCandy\E53B3CD5ED274734AECA045FA514DB9F\OCBrowserHelper_1.0.3.85.dll (PUP.Optional.OpenCandy) -> Keine Aktion durchgeführt. C:\Users\Rene\AppData\Roaming\File Scout\uninst.exe (PUP.Optional.FileScout.A) -> Keine Aktion durchgeführt. C:\$RECYCLE.BIN\S-1-5-21-603513771-2939990097-2127156883-1000\$R7HRK1O.dll (Adware.WebCake) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Sophie\Downloads\VideoPerformerSetup.exe (Adware.InstallBrain) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\IBUpdaterService\repository.xml (Adware.InstallBrain) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\BrowserDefender\2.6.1562.220\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\bl (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\BrowserDefender\2.6.1562.220\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\BrowserDefender.settings (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\BrowserDefender\2.6.1562.220\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\dm (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\BrowserDefender\2.6.1562.220\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\traking_settings\00 (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\BrowserDefender\2.6.1562.220\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\traking_settings\01 (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\BrowserDefender\2.6.1562.220\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\traking_settings\02 (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\BrowserDefender\2.6.1562.220\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\traking_settings\03 (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\BrowserDefender\2.6.1562.220\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\traking_settings\10 (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\BrowserDefender\2.6.1562.220\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\traking_settings\11 (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\BrowserDefender\2.6.1562.220\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\traking_settings\12 (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\BrowserDefender\2.6.1562.220\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\traking_settings\13 (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\BrowserDefender\2.6.1562.220\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\traking_settings\20 (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\BrowserDefender\2.6.1562.220\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\traking_settings\21 (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\BrowserDefender\2.6.1562.220\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\traking_settings\22 (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\BrowserDefender\2.6.1562.220\{c16c1ccb-1111-4e5c-a2f3-533ad2fec8e8}\traking_settings\23 (PUP.Optional.BrowserDefender.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.11.11.09 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16721 Rene :: RENE-HP [Administrator] 11.11.2013 19:14:34 mbam-log-2013-11-11 (19-14-34).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 440926 Laufzeit: 1 Stunde(n), 34 Minute(n), 4 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 7 HKCR\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3} (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\CLSID\{DF84E609-C3A4-49CB-A160-61767DAF8899} (PUP.Optional.WebCake.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\Interface\{DF84E609-C3A4-49CB-A160-61767DAF8899} (PUP.Optional.WebCake.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847} (PUP.Optional.SweetPacks) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847} (PUP.Optional.SweetPacks) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35C-6118-11DC-9C72-001320C79847} (PUP.Optional.SweetPacks) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847} (PUP.Optional.SweetPacks) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 3 C:\Users\Geli\AppData\Roaming\PerformerSoft\PC Performer (PUP.Optional.PCPerformer.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Rene\AppData\Roaming\SpeedAnalysis2 (PUP.Optional.SpeedAnalysis.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Rene\AppData\Roaming\File Scout (PUP.Optional.FileScout.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateien: 15 C:\Users\Rene\AppData\Roaming\File Scout\filescout.exe (PUP.Optional.FileScout.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Rene\Downloads\SetupImgBurn_2.5.8.0.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Sophie\Downloads\etypesetup.exe (PUP.Optional.Somoto) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Sophie\Downloads\iLividSetupV1.exe (PUP.Optional.Bandoo) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Sophie\Downloads\PhotoMania.exe (PUP.Optional.SweetIM) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Sophie\Downloads\TubeBox_Setup_3.6.1.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Geli\AppData\Roaming\PerformerSoft\PC Performer\rcpupdate.ini (PUP.Optional.PCPerformer.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Geli\AppData\Roaming\PerformerSoft\PC Performer\eng_rcp.dat (PUP.Optional.PCPerformer.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Geli\AppData\Roaming\PerformerSoft\PC Performer\ExcludeList.rcp (PUP.Optional.PCPerformer.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Geli\AppData\Roaming\PerformerSoft\PC Performer\log_08-20-2013.log (PUP.Optional.PCPerformer.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Geli\AppData\Roaming\PerformerSoft\PC Performer\results.rcp (PUP.Optional.PCPerformer.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Geli\AppData\Roaming\PerformerSoft\PC Performer\TempHLList.rcp (PUP.Optional.PCPerformer.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Rene\AppData\Roaming\SpeedAnalysis2\speedanalysis.crx (PUP.Optional.SpeedAnalysis.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Rene\AppData\Roaming\speedanalysis.ico (PUP.Optional.SpeedAnalysis2.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Rene\AppData\Roaming\File Scout\uninst.exe (PUP.Optional.FileScout.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) Code:
ATTFilter Typ: Adware (1)
not-a-virus:AdWare.Win32.DelBar.a Nicht gefunden 05.09.2013 21:07:56
Typ: trojanisches Programm (1)
Trojan-Downloader.Win32.MultiDL.k Nicht gefunden 05.09.2013 21:07:53
Code:
ATTFilter Typ: trojanisches Programm (1)
Trojan-Downloader.Win32.MultiDL.k Wird nach dem Neustart des Computers verarbeitet 31.08.2013 22:21:13
|
|
13.11.2013, 08:32
| #5 |
| /// the machine /// TB-Ausbilder | Wichtige Sicherheitswarnung zu Ihrem Internetanschluss Abuse T-Online Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
13.11.2013, 09:22
| #6 |
| | Wichtige Sicherheitswarnung zu Ihrem Internetanschluss Abuse T-Online Hallo Schrauber, sorry für die späte Antwort. Baue nebenbei noch ein Haus und musste auf dem Bau vorbei schauen. Hier Deine Logs. Code:
ATTFilter # AdwCleaner v3.012 - Bericht erstellt am 13/11/2013 um 08:57:01
# Updated 11/11/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Rene - RENE-HP
# Gestartet von : C:\Users\Rene\Downloads\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\boost_interprocess
Ordner Gelöscht : C:\ProgramData\BrowserDefender
Ordner Gelöscht : C:\ProgramData\Tarma Installer
Ordner Gelöscht : C:\Users\Rene\AppData\LocalLow\SweetIM
Ordner Gelöscht : C:\Users\Rene\AppData\Roaming\PerformerSoft
Ordner Gelöscht : C:\Users\Sophie\AppData\LocalLow\SweetIM
Ordner Gelöscht : C:\Users\Geli\AppData\LocalLow\SweetIM
Ordner Gelöscht : C:\Users\Geli\AppData\Roaming\PerformerSoft
Ordner Gelöscht : C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\gjajpkikblccgefaibcafkfbanllpefi
Datei Gelöscht : C:\Windows\System32\roboot64.exe
Datei Gelöscht : C:\Users\Rene\Desktop\eBay.lnk
Datei Gelöscht : C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\sfkr8s1x.default\invalidprefs.js
Datei Gelöscht : C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\sfkr8s1x.default\searchplugins\11-suche.xml
Datei Gelöscht : C:\Users\Geli\AppData\Roaming\Mozilla\Firefox\Profiles\wlr3mofs.default\searchplugins\11-suche.xml
Datei Gelöscht : C:\Users\Geli\AppData\Roaming\Mozilla\Firefox\Profiles\wlr3mofs.default\searchplugins\MyStart.xml
Datei Gelöscht : C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\sfkr8s1x.default\user.js
Datei Gelöscht : C:\Users\Sophie\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www1.delta-search.com_0.localstorage
Datei Gelöscht : C:\Users\Sophie\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www1.delta-search.com_0.localstorage-journal
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\gjajpkikblccgefaibcafkfbanllpefi
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\HPSF_Tasks_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\HPSF_Tasks_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\sweetim_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\sweetim_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\sweetpacksupdatemanager_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SweetPacksUpdateManager_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASMANCS
Schlüssel Gelöscht : HKCU\Software\a68d8bbc6dec48
Schlüssel Gelöscht : HKLM\SOFTWARE\a68d8bbc6dec48
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AF175732-0D59-716D-F757-9F1492D808D9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FB684D26-01F4-4D9D-87CB-F486BEBA56DC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0AFD55C8-ADF8-4A33-A6E1-DEDB7A36AEB4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35B-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EEE6C367-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EEE6C35B-6118-11DC-9C72-001320C79847}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{C424171E-592A-415A-9EB1-DFD6D95D3530}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
Schlüssel Gelöscht : HKCU\Software\Delta
Schlüssel Gelöscht : HKCU\Software\IM
***** [ Browser ] *****
-\\ Internet Explorer v10.0.9200.16720
-\\ Mozilla Firefox v24.0 (de)
[ Datei : C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\sfkr8s1x.default\prefs.js ]
Zeile gelöscht : user_pref("extensions.delta.admin", false);
Zeile gelöscht : user_pref("extensions.delta.aflt", "babsst");
Zeile gelöscht : user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");
Zeile gelöscht : user_pref("extensions.delta.autoRvrt", "false");
Zeile gelöscht : user_pref("extensions.delta.dfltLng", "de");
Zeile gelöscht : user_pref("extensions.delta.excTlbr", false);
Zeile gelöscht : user_pref("extensions.delta.ffxUnstlRst", true);
Zeile gelöscht : user_pref("extensions.delta.id", "a0cb8a0900000000000074de2b3fd784");
Zeile gelöscht : user_pref("extensions.delta.instlDay", "15937");
Zeile gelöscht : user_pref("extensions.delta.instlRef", "sst");
Zeile gelöscht : user_pref("extensions.delta.newTab", false);
Zeile gelöscht : user_pref("extensions.delta.prdct", "delta");
Zeile gelöscht : user_pref("extensions.delta.prtnrId", "delta");
Zeile gelöscht : user_pref("extensions.delta.rvrt", "false");
Zeile gelöscht : user_pref("extensions.delta.smplGrp", "none");
Zeile gelöscht : user_pref("extensions.delta.tlbrId", "base");
Zeile gelöscht : user_pref("extensions.delta.tlbrSrchUrl", "");
Zeile gelöscht : user_pref("extensions.delta.vrsn", "1.8.24.5");
Zeile gelöscht : user_pref("extensions.delta.vrsnTs", "1.8.24.59:25:57");
Zeile gelöscht : user_pref("extensions.delta.vrsni", "1.8.24.5");
Zeile gelöscht : user_pref("extensions.delta_i.babExt", "");
Zeile gelöscht : user_pref("extensions.delta_i.babTrack", "affID=119649&tsp=4980");
Zeile gelöscht : user_pref("extensions.delta_i.srcExt", "ss");
[ Datei : C:\Users\Geli\AppData\Roaming\Mozilla\Firefox\Profiles\wlr3mofs.default\prefs.js ]
-\\ Google Chrome v
[ Datei : C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\preferences ]
Gelöscht : homepage
*************************
AdwCleaner[R0].txt - [9051 octets] - [13/11/2013 08:46:08]
AdwCleaner[S0].txt - [8383 octets] - [13/11/2013 08:57:01]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [8443 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.8 (11.05.2013:1)
OS: Windows 7 Home Premium x64
Ran by Rene on 13.11.2013 at 9:05:32,22
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{FB684D26-01F4-4D9D-87CB-F486BEBA56DC}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-603513771-2939990097-2127156883-1000\Software\sweetim
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{24FE3852-5D00-43EF-8C8B-FF32F43D11A7}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{24FE3852-5D00-43EF-8C8B-FF32F43D11A7}
~~~ Files
~~~ Folders
~~~ FireFox
Emptied folder: C:\Users\Rene\AppData\Roaming\mozilla\firefox\profiles\sfkr8s1x.default\minidumps [18 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 13.11.2013 at 9:11:29,68
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-11-2013
Ran by Rene (administrator) on RENE-HP on 13-11-2013 09:17:58
Running from C:\Users\Rene\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe
(SurfRight B.V.) C:\Program Files\HitmanPro\hmpsched.exe
(Microsoft Corporation) C:\Windows\SYSTEM32\WISPTIS.EXE
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\avmike.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\certsrv.exe
(Portrait Displays, Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Shared\dtsrvc.exe
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe
(PDF Complete Inc) C:\Program Files (x86)\PDF Complete\pdfsvc.exe
(Portrait Displays, Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(HP) C:\Program Files (x86)\HP SimplePass 2011\TouchControl.exe
(HP) C:\Program Files (x86)\HP SimplePass 2011\BioMonitor.exe
(Microsoft Corporation) C:\Windows\SYSTEM32\WISPTIS.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Hewlett-Packard ) C:\Program Files\IDT\WDM\beats64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Hewlett-Packard Co.) C:\Program Files\hp\HP Photosmart 5510d series\Bin\ScanToPCActivationApp.exe
(Portrait Displays, Inc) C:\Program Files (x86)\Hewlett-Packard\HP My Display TouchSmart Edition\OSDManager.exe
(shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
() C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\wpctrl.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
(CyberLink) C:\Program Files (x86)\Hewlett-Packard\Media\Webcam\YCMMirage.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
(Portrait Displays, Inc) C:\Program Files (x86)\Hewlett-Packard\HP My Display TouchSmart Edition\DTHtml.exe
(Portrait Displays Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Shared\HookManager.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosHdpProc.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
(Portrait Displays, Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdiSdkHelperx64.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\tosBtProc.exe
(Intel Corporation) C:\Windows\system32\igfxext.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
() C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\DP\DPHelper.exe
() C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\DP\DPHelper64.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\GCalService.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\HPTouchSmartSyncCalReminderApp.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [BeatsOSDApp] - C:\Program Files\IDT\WDM\beats64.exe [37888 2013-11-11] (Hewlett-Packard )
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [hpsysdrv] - C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe [62768 2008-11-20] (Hewlett-Packard)
HKLM\...\Run: [Logitech Download Assistant] - C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [1424896 2013-11-11] (IDT, Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\klogon: C:\Windows\System32\klogon.dll (Kaspersky Lab ZAO)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKCU\...\Run: [HP Photosmart 5510d series (NET)] - C:\Program Files\hp\HP Photosmart 5510d series\Bin\ScanToPCActivationApp.exe [2676584 2011-08-16] (Hewlett-Packard Co.)
HKCU\...\Policies\system: [DisableLockWorkstation] 0
HKCU\...\Policies\system: [DisableChangePassword] 0
HKLM-x32\...\Run: [Easybits Recovery] - C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [61112 2011-05-17] (EasyBits Software AS)
HKLM-x32\...\Run: [DT HPO] - C:\Program Files (x86)\Common Files\Portrait Displays\Shared\DT_Startup.exe [120400 2012-08-16] (Portrait Displays, Inc.)
HKLM-x32\...\Run: [PDF Complete] - C:\Program Files (x86)\PDF Complete\pdfsty.exe [658424 2011-05-06] (PDF Complete Inc)
HKLM-x32\...\Run: [FreePDF Assistant] - C:\Program Files (x86)\FreePDF_XP\fpassist.exe [371200 2011-02-23] (shbox.de)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [ITSecMng] - C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\ItSecMng.exe [83336 2009-07-22] (TOSHIBA CORPORATION)
HKLM-x32\...\Run: [AVP] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe [206448 2012-10-31] (Kaspersky Lab ZAO)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [PivotSoftware] - C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\pivot_Startup.exe [110192 2010-05-13] ()
HKLM-x32\...\Run: [SDTray] - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [3830224 2013-05-16] (Safer-Networking Ltd.)
HKU\Sophie\...\Run: [Google Update] - C:\Users\Sophie\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2012-05-22] (Google Inc.)
HKU\Sophie\...\Run: [ICQ] - C:\Users\Sophie\AppData\Roaming\ICQ\Application\ICQ7M\ICQ.exe [127040 2012-05-22] (ICQ, LLC.)
HKU\Sophie\...\Run: [Facebook Update] - C:\Users\Sophie\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-07-15] (Facebook Inc.)
HKU\Sophie\...\Run: [Spotify] - C:\Users\Sophie\AppData\Roaming\Spotify\spotify.exe [4640768 2013-07-25] (Spotify Ltd)
HKU\Sophie\...\Policies\system: [DisableLockWorkstation] 0
HKU\Sophie\...\Policies\system: [DisableChangePassword] 0
Startup: C:\Users\Rene\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Photosmart 5510d series (Netzwerk).lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Photosmart 5510d series (Netzwerk).lnk -> C:\Program Files\HP\HP Photosmart 5510d series\bin\HPStatusBL.dll (Hewlett-Packard Co.)
Startup: C:\Users\Sophie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Photosmart 5510d series (Netzwerk).lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Photosmart 5510d series (Netzwerk).lnk -> C:\Program Files\HP\HP Photosmart 5510d series\bin\HPStatusBL.dll (Hewlett-Packard Co.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://t-online.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {24FE3852-5D00-43EF-8C8B-FF32F43D11A7} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
SearchScopes: HKCU - {0A96340D-6C40-488D-95AE-9727C2FDAD83} URL = hxxp://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {23EAF3AA-0DF2-4142-BBF0-8BBC4D6ADE77} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {C0B87CE2-AE1C-4207-A8FE-3DB227F9AE01} URL = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
SearchScopes: HKCU - {F453F4C8-F208-4B75-98C6-2F61B6F74158} URL = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}
BHO: IEVkbdBHO Class - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\x64\ievkbd.dll (Kaspersky Lab ZAO)
BHO: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\x64\IEBHO.dll (HP)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: FilterBHO Class - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\x64\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: IEVkbdBHO Class - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ievkbd.dll (Kaspersky Lab ZAO)
BHO-x32: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\IEBHO.dll (HP)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: FilterBHO Class - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWow64\EZUPBH~1.DLL [52920 2011-12-20] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\sfkr8s1x.default
FF NewTab: chrome://unitedtb/content/newtab/newtab-page.xhtml
FF DefaultSearchEngine: Google
FF SearchEngineOrder.user_pref("browser.search.order.1", "");: user_pref("browser.search.order.1", "");
FF SelectedSearchEngine: Google
FF Homepage: t-online.de
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/VirtualEarth3D,version=4.0 - c:\Program Files (x86)\Virtual Earth 3D\ No File
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5 - C:\ProgramData\Visan\plugins\npRLSecurePluginLayer.dll (RocketLife, LLP)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\sfkr8s1x.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\sfkr8s1x.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\sfkr8s1x.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\sfkr8s1x.default\searchplugins\webde-suche.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: FRITZ!Box AddOn - C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\sfkr8s1x.default\Extensions\fb_add_on@avm.de
FF Extension: toolbar - C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\sfkr8s1x.default\Extensions\toolbar@gmx.net.xpi
FF Extension: TrueSuite Website Logon - C:\Program Files (x86)\Mozilla Firefox\extensions\websitelogon@truesuite.com
FF HKLM-x32\...\Firefox\Extensions: [quickprint@hp.com] - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension
FF Extension: SmartPrintButton - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension
FF HKLM-x32\...\Firefox\Extensions: [virtualKeyboard@kaspersky.ru] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\virtualKeyboard@kaspersky.ru
FF Extension: Kaspersky Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\virtualKeyboard@kaspersky.ru
FF HKLM-x32\...\Firefox\Extensions: [linkfilter@kaspersky.ru] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\linkfilter@kaspersky.ru
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\linkfilter@kaspersky.ru
FF HKLM-x32\...\Firefox\Extensions: [KavAntiBanner@Kaspersky.ru] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\KavAntiBanner@Kaspersky.ru
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\KavAntiBanner@Kaspersky.ru
Chrome:
=======
CHR Extension: (Docs) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0
CHR Extension: (Google Drive) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0
CHR Extension: (YouTube) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0
CHR Extension: (Google Search) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0
CHR Extension: (Kaspersky URL Advisor) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.0.477_0
CHR Extension: (Virtual Keyboard) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\12.0.0.477_0
CHR Extension: (Website Logon) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpgfhihjicjofdejkbjgnjlaglaciobe\1.0_0
CHR Extension: () - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk\6.0.2_0
CHR Extension: (Gmail) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
CHR Extension: (Anti-Banner) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\12.0.0.374_0
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ChromeExt\urladvisor.crx
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ChromeExt\virtkbd.crx
CHR HKLM-x32\...\Chrome\Extension: [jpgfhihjicjofdejkbjgnjlaglaciobe] - C:\Program Files (x86)\HP SimplePass 2011\tschrome.crx
CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ChromeExt\ab.crx
==================== Services (Whitelisted) =================
R2 avmike; C:\Program Files\FRITZ!Fernzugang\avmike.exe [336248 2012-02-02] (AVM Berlin)
R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe [206448 2012-10-31] (Kaspersky Lab ZAO)
R2 certsrv; C:\Program Files\FRITZ!Fernzugang\certsrv.exe [143736 2011-10-31] (AVM Berlin)
R2 DTSRVC; C:\Program Files (x86)\Common Files\Portrait Displays\Shared\dtsrvc.exe [136784 2012-08-16] (Portrait Displays, Inc.)
R2 HitmanProScheduler; C:\Program Files\HitmanPro\hmpsched.exe [109352 2013-11-11] (SurfRight B.V.)
R2 nwtsrv; C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe [189304 2011-10-31] (AVM Berlin)
R2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1128952 2011-05-06] (PDF Complete Inc)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1817560 2013-05-16] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1033688 2013-05-16] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2013-05-15] (Safer-Networking Ltd.)
==================== Drivers (Whitelisted) ====================
R0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [460888 2011-03-04] (Kaspersky Lab ZAO)
R1 kl2; C:\Windows\System32\DRIVERS\kl2.sys [11864 2011-03-04] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [637272 2012-10-31] (Kaspersky Lab)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [29488 2011-03-10] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [22544 2009-11-02] (Kaspersky Lab)
R2 NPF_devolo; C:\Windows\sysWOW64\drivers\npf_devolo.sys [34048 2008-11-28] (CACE Technologies)
R3 NWIM; C:\Windows\System32\DRIVERS\avmnwim.sys [412024 2011-07-05] (AVM Berlin)
R3 NWVoltron; C:\Windows\system32\drivers\NWVoltron.sys [28440 2011-06-23] ()
S3 NWWakeFilterV; C:\Windows\system32\drivers\NWWakeFilterV.sys [16152 2011-06-23] (n/a)
S3 pmxdrv; C:\Windows\system32\drivers\pmxdrv.sys [31152 2011-12-20] ()
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-11-13 09:17 - 2013-11-13 09:17 - 01957610 _____ (Farbar) C:\Users\Rene\Downloads\FRST64.exe
2013-11-13 09:11 - 2013-11-13 09:11 - 00001336 _____ C:\Users\Rene\Desktop\JRT.txt
2013-11-13 09:05 - 2013-11-13 09:05 - 00000000 ____D C:\Windows\ERUNT
2013-11-13 09:04 - 2013-11-13 09:04 - 01034531 _____ (Thisisu) C:\Users\Rene\Downloads\JRT.exe
2013-11-13 09:03 - 2013-11-13 09:03 - 00001676 _____ C:\Users\Rene\Desktop\HitmanPro_20131113_0903.log
2013-11-13 09:01 - 2013-11-13 09:01 - 00008547 _____ C:\Users\Rene\Desktop\AdwCleaner[S0].txt
2013-11-13 09:01 - 2013-11-13 09:01 - 00000165 ____H C:\Users\Rene\Desktop\~$Präsentation1.pptx
2013-11-13 08:45 - 2013-11-13 08:57 - 00000000 ____D C:\AdwCleaner
2013-11-13 08:44 - 2013-11-13 08:44 - 00339318 _____ C:\Users\Rene\Desktop\Präsentation1.pptx
2013-11-13 08:41 - 2013-11-13 08:41 - 01085542 _____ C:\Users\Rene\Downloads\adwcleaner.exe
2013-11-12 13:19 - 2013-11-12 13:19 - 00255840 _____ C:\Users\Rene\Desktop\Desktop.7z
2013-11-12 12:38 - 2013-11-12 12:38 - 00000193 _____ C:\Users\Rene\Desktop\Kaspersky.log
2013-11-12 10:07 - 2013-11-12 10:07 - 00001680 _____ C:\Users\Rene\Desktop\HitmanPro_20131112_0847.log
2013-11-12 10:03 - 2013-11-12 10:03 - 00037449 _____ C:\Users\Rene\Desktop\Addition.txt
2013-11-12 10:02 - 2013-11-12 10:02 - 00046048 _____ C:\Users\Rene\Desktop\FRST.txt
2013-11-12 10:01 - 2013-11-12 10:01 - 00004999 _____ C:\Users\Rene\Desktop\Gmer.txt
2013-11-12 09:46 - 2013-11-12 09:46 - 00377856 _____ C:\Users\Rene\Downloads\gmer_2.1.19163.exe
2013-11-12 09:44 - 2013-11-13 09:17 - 00022540 _____ C:\Users\Rene\Downloads\FRST.txt
2013-11-12 09:43 - 2013-11-12 09:44 - 00037449 _____ C:\Users\Rene\Downloads\Addition.txt
2013-11-12 09:42 - 2013-11-12 09:42 - 00000000 ____D C:\FRST
2013-11-12 09:39 - 2013-11-12 09:39 - 00000470 _____ C:\Users\Rene\Downloads\defogger_disable.log
2013-11-12 09:39 - 2013-11-12 09:39 - 00000000 _____ C:\Users\Rene\defogger_reenable
2013-11-12 09:38 - 2013-11-12 09:37 - 00050477 _____ C:\Users\Rene\Downloads\Defogger.exe
2013-11-11 20:23 - 2013-11-11 20:23 - 00005286 _____ C:\Windows\system32\.crusader
2013-11-11 20:06 - 2013-11-11 20:06 - 00001907 _____ C:\Users\Public\Desktop\HitmanPro.lnk
2013-11-11 20:06 - 2013-11-11 20:06 - 00000000 ____D C:\Program Files\HitmanPro
2013-11-11 20:04 - 2013-11-12 08:47 - 00000000 ____D C:\ProgramData\HitmanPro
2013-11-11 20:04 - 2013-11-11 20:05 - 10264904 _____ (SurfRight B.V.) C:\Users\Rene\Downloads\HitmanPro_x64.exe
2013-11-11 20:03 - 2013-11-11 20:03 - 09452704 _____ (SurfRight B.V.) C:\Users\Rene\Downloads\HitmanPro3.7.8.208.exe
2013-11-11 19:50 - 2013-11-11 19:49 - 06141440 _____ (IDT, Inc.) C:\Windows\system32\IDTNGUI.exe
2013-11-11 19:50 - 2013-11-11 19:49 - 05126144 _____ (IDT, Inc.) C:\Windows\system32\IDTNHP.dll
2013-11-11 19:50 - 2013-11-11 19:49 - 01819136 _____ (IDT, Inc.) C:\Windows\system32\IDTNC64.cpl
2013-11-11 19:50 - 2013-11-11 19:49 - 01059328 _____ (IDT, Inc.) C:\Windows\system32\IDTNX.dll
2013-11-11 19:50 - 2013-11-11 19:49 - 00249344 _____ (IDT, Inc.) C:\Windows\system32\IDTNJ.exe
2013-11-11 19:50 - 2013-11-11 19:49 - 00037888 _____ (Hewlett-Packard ) C:\Windows\system32\beats64.exe
2013-11-11 19:49 - 2013-11-11 19:51 - 00000000 ____D C:\Program Files\IDT
2013-11-11 19:49 - 2013-11-11 19:49 - 01986048 _____ (IDT, Inc.) C:\Windows\system32\stapo64.dll
2013-11-11 19:49 - 2013-11-11 19:49 - 00653824 ____N (IDT, Inc.) C:\Windows\system32\stapi64.dll
2013-11-11 19:49 - 2013-11-11 19:49 - 00535040 _____ (IDT, Inc.) C:\Windows\system32\Drivers\stwrt64.sys
2013-11-11 19:41 - 2013-11-11 19:41 - 00000000 ____D C:\Program Files (x86)\Ralink
2013-11-11 19:40 - 2013-11-11 19:40 - 00000000 ____D C:\Users\Rene\AppData\Roaming\InstallShield
2013-11-11 19:39 - 2013-11-12 16:19 - 00000000 ____D C:\Users\Rene\Desktop\Bilder Ebay Kleinanzeigen
2013-10-20 16:53 - 2013-10-20 16:56 - 00003922 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{03891525-6FDC-4836-BAB3-0D1EEB370C56}
2013-10-16 02:17 - 2013-09-23 00:27 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-10-16 02:17 - 2013-09-22 23:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-10-16 02:17 - 2013-09-21 04:38 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-10-16 02:17 - 2013-09-21 04:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-10-16 02:16 - 2013-09-23 00:28 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-10-16 02:16 - 2013-09-23 00:28 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-10-16 02:16 - 2013-09-23 00:27 - 14335488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-10-16 02:16 - 2013-09-23 00:27 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-10-16 02:16 - 2013-09-23 00:27 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-10-16 02:16 - 2013-09-23 00:27 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-10-16 02:16 - 2013-09-23 00:27 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-10-16 02:16 - 2013-09-23 00:27 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-10-16 02:16 - 2013-09-23 00:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-10-16 02:16 - 2013-09-23 00:27 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-10-16 02:16 - 2013-09-23 00:27 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-10-16 02:16 - 2013-09-23 00:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-10-16 02:16 - 2013-09-22 23:55 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-10-16 02:16 - 2013-09-22 23:55 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-10-16 02:16 - 2013-09-22 23:55 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-10-16 02:16 - 2013-09-22 23:54 - 19252224 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-10-16 02:16 - 2013-09-22 23:54 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-10-16 02:16 - 2013-09-22 23:54 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-10-16 02:16 - 2013-09-22 23:54 - 02647552 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-10-16 02:16 - 2013-09-22 23:54 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-10-16 02:16 - 2013-09-22 23:54 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-10-16 02:16 - 2013-09-22 23:54 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-10-16 02:16 - 2013-09-22 23:54 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-10-16 02:16 - 2013-09-22 23:54 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-10-16 02:16 - 2013-09-22 23:54 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-10-16 02:16 - 2013-09-21 03:48 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-10-16 02:16 - 2013-09-21 03:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-10-15 09:20 - 2013-07-12 11:41 - 00185344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys
2013-10-15 09:20 - 2013-07-12 11:41 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
2013-10-15 09:20 - 2013-07-03 05:05 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2013-10-15 09:20 - 2013-07-03 05:05 - 00032896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2013-10-15 09:17 - 2013-07-04 13:50 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2013-10-15 09:16 - 2013-07-04 12:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2013-10-15 09:16 - 2013-06-06 06:50 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2013-10-15 09:16 - 2013-06-06 06:49 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2013-10-15 09:16 - 2013-06-06 06:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2013-10-15 09:16 - 2013-06-06 06:47 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2013-10-15 09:16 - 2013-06-06 05:57 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2013-10-15 09:16 - 2013-06-06 05:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2013-10-15 09:16 - 2013-06-06 05:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2013-10-15 09:16 - 2013-06-06 04:30 - 00368128 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-10-15 09:16 - 2013-06-06 04:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2013-10-15 09:16 - 2013-06-06 04:01 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2013-10-15 09:11 - 2013-06-25 23:55 - 00785624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2013-10-15 09:04 - 2013-09-14 02:10 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-10-15 09:04 - 2013-09-08 03:30 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-10-15 09:04 - 2013-09-08 03:27 - 00327168 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2013-10-15 09:04 - 2013-09-08 03:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswsock.dll
2013-10-15 09:04 - 2013-08-28 02:21 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-10-15 09:04 - 2013-07-04 13:57 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2013-10-15 09:04 - 2013-07-04 13:50 - 00102400 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2013-10-15 09:04 - 2013-07-04 12:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll
2013-10-15 09:04 - 2013-07-04 12:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll
2013-10-15 09:04 - 2013-07-04 11:11 - 00140800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2013-10-15 09:03 - 2013-08-29 03:17 - 05549504 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-10-15 09:03 - 2013-08-29 03:16 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-10-15 09:03 - 2013-08-29 03:16 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2013-10-15 09:03 - 2013-08-29 03:16 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-10-15 09:03 - 2013-08-29 03:13 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2013-10-15 09:03 - 2013-08-29 02:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-10-15 09:03 - 2013-08-29 02:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-10-15 09:03 - 2013-08-29 02:50 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-10-15 09:03 - 2013-08-29 02:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2013-10-15 09:03 - 2013-08-29 02:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-10-15 09:03 - 2013-08-29 02:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2013-10-15 09:03 - 2013-08-29 01:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-10-15 09:03 - 2013-08-29 01:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-10-15 09:03 - 2013-08-29 01:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-10-15 09:03 - 2013-08-29 01:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-10-15 09:03 - 2013-08-28 02:12 - 00461312 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll
2013-10-15 09:03 - 2013-08-01 13:09 - 00983488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-10-15 09:03 - 2013-07-20 11:33 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-15 09:03 - 2013-07-20 11:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
==================== One Month Modified Files and Folders =======
2013-11-13 09:18 - 2013-11-12 09:44 - 00022540 _____ C:\Users\Rene\Downloads\FRST.txt
2013-11-13 09:17 - 2013-11-13 09:17 - 01957610 _____ (Farbar) C:\Users\Rene\Downloads\FRST64.exe
2013-11-13 09:17 - 2012-08-21 10:42 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-13 09:13 - 2012-05-22 18:03 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-603513771-2939990097-2127156883-1001UA.job
2013-11-13 09:11 - 2013-11-13 09:11 - 00001336 _____ C:\Users\Rene\Desktop\JRT.txt
2013-11-13 09:06 - 2009-07-14 05:45 - 00024400 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-13 09:06 - 2009-07-14 05:45 - 00024400 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-13 09:05 - 2013-11-13 09:05 - 00000000 ____D C:\Windows\ERUNT
2013-11-13 09:04 - 2013-11-13 09:04 - 01034531 _____ (Thisisu) C:\Users\Rene\Downloads\JRT.exe
2013-11-13 09:04 - 2011-12-20 01:10 - 00696620 _____ C:\Windows\system32\perfh007.dat
2013-11-13 09:04 - 2011-12-20 01:10 - 00147916 _____ C:\Windows\system32\perfc007.dat
2013-11-13 09:04 - 2009-07-14 06:13 - 01612484 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-13 09:03 - 2013-11-13 09:03 - 00001676 _____ C:\Users\Rene\Desktop\HitmanPro_20131113_0903.log
2013-11-13 09:02 - 2013-09-05 19:01 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-13 09:01 - 2013-11-13 09:01 - 00008547 _____ C:\Users\Rene\Desktop\AdwCleaner[S0].txt
2013-11-13 09:01 - 2013-11-13 09:01 - 00000165 ____H C:\Users\Rene\Desktop\~$Präsentation1.pptx
2013-11-13 09:00 - 2012-10-31 20:59 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-13 08:59 - 2012-10-31 20:59 - 00001102 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-13 08:59 - 2012-08-21 10:39 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-11-13 08:59 - 2011-12-20 01:46 - 00000000 ____D C:\ProgramData\PDFC
2013-11-13 08:58 - 2012-05-22 15:19 - 01498835 _____ C:\Windows\WindowsUpdate.log
2013-11-13 08:58 - 2011-12-20 01:50 - 00000000 ____D C:\ProgramData\truesuite
2013-11-13 08:58 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-13 08:58 - 2009-07-14 05:51 - 00073555 _____ C:\Windows\setupact.log
2013-11-13 08:57 - 2013-11-13 08:45 - 00000000 ____D C:\AdwCleaner
2013-11-13 08:57 - 2012-05-31 11:34 - 00000000 ____D C:\Users\Rene\AppData\Local\CrashDumps
2013-11-13 08:44 - 2013-11-13 08:44 - 00339318 _____ C:\Users\Rene\Desktop\Präsentation1.pptx
2013-11-13 08:41 - 2013-11-13 08:41 - 01085542 _____ C:\Users\Rene\Downloads\adwcleaner.exe
2013-11-13 08:36 - 2012-06-10 22:35 - 00000336 _____ C:\Windows\Tasks\HP Photo Creations Communicator.job
2013-11-13 07:57 - 2012-05-22 18:47 - 00001142 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-603513771-2939990097-2127156883-1001UA.job
2013-11-12 20:29 - 2012-05-22 15:30 - 00003922 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{CF4CA5DA-2485-4C39-842E-3908496AFD16}
2013-11-12 19:57 - 2012-05-22 18:47 - 00001120 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-603513771-2939990097-2127156883-1001Core.job
2013-11-12 18:13 - 2012-05-22 18:03 - 00001072 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-603513771-2939990097-2127156883-1001Core.job
2013-11-12 16:19 - 2013-11-11 19:39 - 00000000 ____D C:\Users\Rene\Desktop\Bilder Ebay Kleinanzeigen
2013-11-12 13:19 - 2013-11-12 13:19 - 00255840 _____ C:\Users\Rene\Desktop\Desktop.7z
2013-11-12 12:38 - 2013-11-12 12:38 - 00000193 _____ C:\Users\Rene\Desktop\Kaspersky.log
2013-11-12 10:07 - 2013-11-12 10:07 - 00001680 _____ C:\Users\Rene\Desktop\HitmanPro_20131112_0847.log
2013-11-12 10:03 - 2013-11-12 10:03 - 00037449 _____ C:\Users\Rene\Desktop\Addition.txt
2013-11-12 10:02 - 2013-11-12 10:02 - 00046048 _____ C:\Users\Rene\Desktop\FRST.txt
2013-11-12 10:01 - 2013-11-12 10:01 - 00004999 _____ C:\Users\Rene\Desktop\Gmer.txt
2013-11-12 09:46 - 2013-11-12 09:46 - 00377856 _____ C:\Users\Rene\Downloads\gmer_2.1.19163.exe
2013-11-12 09:44 - 2013-11-12 09:43 - 00037449 _____ C:\Users\Rene\Downloads\Addition.txt
2013-11-12 09:42 - 2013-11-12 09:42 - 00000000 ____D C:\FRST
2013-11-12 09:39 - 2013-11-12 09:39 - 00000470 _____ C:\Users\Rene\Downloads\defogger_disable.log
2013-11-12 09:39 - 2013-11-12 09:39 - 00000000 _____ C:\Users\Rene\defogger_reenable
2013-11-12 09:39 - 2012-05-22 15:21 - 00000000 ____D C:\Users\Rene
2013-11-12 09:37 - 2013-11-12 09:38 - 00050477 _____ C:\Users\Rene\Downloads\Defogger.exe
2013-11-12 09:00 - 2012-11-18 12:46 - 00003180 _____ C:\Windows\System32\Tasks\HPCeeScheduleForRene
2013-11-12 09:00 - 2012-11-18 12:46 - 00000328 _____ C:\Windows\Tasks\HPCeeScheduleForRene.job
2013-11-12 08:47 - 2013-11-11 20:04 - 00000000 ____D C:\ProgramData\HitmanPro
2013-11-11 20:57 - 2013-10-09 18:50 - 00000000 ____D C:\Users\Rene\AppData\Roaming\Dropbox
2013-11-11 20:57 - 2012-05-22 15:30 - 00000000 ___RD C:\Users\Rene\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-11-11 20:54 - 2013-10-09 18:52 - 00000000 ___RD C:\Users\Rene\Dropbox
2013-11-11 20:53 - 2010-11-21 04:47 - 00783712 _____ C:\Windows\PFRO.log
2013-11-11 20:43 - 2013-01-03 15:30 - 00000000 ____D C:\Users\Rene\Documents\Hausbau
2013-11-11 20:23 - 2013-11-11 20:23 - 00005286 _____ C:\Windows\system32\.crusader
2013-11-11 20:06 - 2013-11-11 20:06 - 00001907 _____ C:\Users\Public\Desktop\HitmanPro.lnk
2013-11-11 20:06 - 2013-11-11 20:06 - 00000000 ____D C:\Program Files\HitmanPro
2013-11-11 20:05 - 2013-11-11 20:04 - 10264904 _____ (SurfRight B.V.) C:\Users\Rene\Downloads\HitmanPro_x64.exe
2013-11-11 20:03 - 2013-11-11 20:03 - 09452704 _____ (SurfRight B.V.) C:\Users\Rene\Downloads\HitmanPro3.7.8.208.exe
2013-11-11 19:52 - 2012-05-23 16:10 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log
2013-11-11 19:51 - 2013-11-11 19:49 - 00000000 ____D C:\Program Files\IDT
2013-11-11 19:50 - 2011-12-20 01:21 - 00000000 ____D C:\ProgramData\SonicFocus
2013-11-11 19:49 - 2013-11-11 19:50 - 06141440 _____ (IDT, Inc.) C:\Windows\system32\IDTNGUI.exe
2013-11-11 19:49 - 2013-11-11 19:50 - 05126144 _____ (IDT, Inc.) C:\Windows\system32\IDTNHP.dll
2013-11-11 19:49 - 2013-11-11 19:50 - 01819136 _____ (IDT, Inc.) C:\Windows\system32\IDTNC64.cpl
2013-11-11 19:49 - 2013-11-11 19:50 - 01059328 _____ (IDT, Inc.) C:\Windows\system32\IDTNX.dll
2013-11-11 19:49 - 2013-11-11 19:50 - 00249344 _____ (IDT, Inc.) C:\Windows\system32\IDTNJ.exe
2013-11-11 19:49 - 2013-11-11 19:50 - 00037888 _____ (Hewlett-Packard ) C:\Windows\system32\beats64.exe
2013-11-11 19:49 - 2013-11-11 19:49 - 01986048 _____ (IDT, Inc.) C:\Windows\system32\stapo64.dll
2013-11-11 19:49 - 2013-11-11 19:49 - 00653824 ____N (IDT, Inc.) C:\Windows\system32\stapi64.dll
2013-11-11 19:49 - 2013-11-11 19:49 - 00535040 _____ (IDT, Inc.) C:\Windows\system32\Drivers\stwrt64.sys
2013-11-11 19:49 - 2011-12-20 01:21 - 04241408 _____ (IDT, Inc.) C:\Windows\system32\stlang64.dll
2013-11-11 19:49 - 2011-12-20 01:21 - 01424896 _____ (IDT, Inc.) C:\Windows\sttray64.exe
2013-11-11 19:49 - 2011-12-20 01:21 - 00442368 _____ (Andrea Electronics Corporation) C:\Windows\system32\AESTEC64.dll
2013-11-11 19:49 - 2011-12-20 01:21 - 00223744 _____ (IDT, Inc.) C:\Windows\system32\HPToneCtrls64.dll
2013-11-11 19:49 - 2011-12-20 01:21 - 00162304 _____ (Andrea Electronics Corporation) C:\Windows\system32\AESTAC64.dll
2013-11-11 19:49 - 2011-12-20 01:21 - 00090624 _____ (Andrea Electronics Corporation) C:\Windows\system32\AESTCo64.dll
2013-11-11 19:49 - 2011-12-20 01:21 - 00068608 _____ (Andrea Electronics Corporation) C:\Windows\system32\AESTAR64.dll
2013-11-11 19:49 - 2011-12-20 01:18 - 00250880 _____ (IDT, Inc.) C:\Windows\system32\staco64.dll
2013-11-11 19:49 - 2011-02-11 17:32 - 00000000 ____D C:\SWSETUP
2013-11-11 19:48 - 2013-10-09 19:24 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2013-11-11 19:41 - 2013-11-11 19:41 - 00000000 ____D C:\Program Files (x86)\Ralink
2013-11-11 19:41 - 2011-12-20 01:29 - 00005496 _____ C:\Windows\system32\RaCoInst.log
2013-11-11 19:40 - 2013-11-11 19:40 - 00000000 ____D C:\Users\Rene\AppData\Roaming\InstallShield
2013-11-04 15:44 - 2012-05-30 11:17 - 00000000 ____D C:\ProgramData\HP Photo Creations
2013-11-04 15:41 - 2013-03-30 10:25 - 00003922 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{673C6173-064B-48E4-8E60-310E0137200F}
2013-11-03 20:39 - 2012-11-28 21:16 - 00003216 _____ C:\Windows\System32\Tasks\HPCeeScheduleForRENE-HP$
2013-11-03 20:39 - 2012-11-28 21:16 - 00000340 _____ C:\Windows\Tasks\HPCeeScheduleForRENE-HP$.job
2013-11-03 18:42 - 2013-05-15 19:42 - 00000000 _____ C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2013-11-03 18:40 - 2012-05-23 16:06 - 00000000 ____D C:\Users\Rene\AppData\Roaming\HpUpdate
2013-11-03 18:40 - 2012-05-23 16:06 - 00000000 ____D C:\Users\Rene\AppData\Roaming\HP Support Assistant
2013-11-03 17:56 - 2013-08-08 21:29 - 00013400 _____ C:\Users\Rene\Documents\Gesamtkosten Haus.xlsx
2013-10-26 09:52 - 2012-11-22 22:03 - 00269312 ___SH C:\Users\Rene\Documents\Thumbs.db
2013-10-20 17:03 - 2013-10-09 18:52 - 00001017 _____ C:\Users\Rene\Desktop\Dropbox.lnk
2013-10-20 17:03 - 2013-10-09 18:51 - 00000000 ____D C:\Users\Rene\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2013-10-20 16:56 - 2013-10-20 16:53 - 00003922 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{03891525-6FDC-4836-BAB3-0D1EEB370C56}
2013-10-20 16:55 - 2012-10-31 20:59 - 00004102 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-10-20 16:55 - 2012-10-31 20:59 - 00003850 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-10-16 03:15 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-10-16 02:37 - 2013-03-14 22:57 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-10-16 02:37 - 2013-03-14 22:57 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-10-16 02:37 - 2009-07-14 05:45 - 00342240 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-16 02:19 - 2012-05-22 15:56 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-10-16 02:12 - 2011-02-11 18:15 - 01589442 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2013-10-16 02:08 - 2013-08-19 08:27 - 00000000 ____D C:\Windows\system32\MRT
2013-10-16 02:05 - 2012-06-01 10:16 - 80541720 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
Some content of TEMP:
====================
C:\Users\Rene\AppData\Local\Temp\Extract.exe
C:\Users\Rene\AppData\Local\Temp\Quarantine.exe
C:\Users\Rene\AppData\Local\Temp\SP57550.exe
C:\Users\Rene\AppData\Local\Temp\SP58084.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-11-12 10:40
==================== End Of Log ============================
--- --- --- |
|
13.11.2013, 15:59
| #7 |
| /// the machine /// TB-Ausbilder | Wichtige Sicherheitswarnung zu Ihrem Internetanschluss Abuse T-OnlineESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
13.11.2013, 22:00
| #8 |
| | Wichtige Sicherheitswarnung zu Ihrem Internetanschluss Abuse T-Online Hallo Schrauber. Erstmal vielen Dank das Du Dir die Zeit nimmst mir zu helfen.Mir geht nur die ewige Post von der Telekom auf die Nerven und da ich beruflich sehr viel unterwegs bin, könnte ich mir in meiner Freizeit auch was anderes vorstellen als den Rechner zu säubern. Zum Glück gibt es da ja professionelle Hilfe von Euch. Sollte mein Rechner jetzt sauber sein, können wir dann die ganze Prozedur nochmal auf meinem Latop durch gehen? Hier erstmal die Logs Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=9ee9c09e61c806439d1db72591cc3da7
# engine=15871
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-11-13 06:24:21
# local_time=2013-11-13 07:24:21 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1285 16777213 100 98 37525 80691011 0 0
# compatibility_mode=5893 16776573 100 94 36913 135996911 0 0
# scanned=202381
# found=0
# cleaned=0
# scan_time=4826
Code:
ATTFilter unsupported operating system! Aborted!
FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-11-2013
Ran by Rene (administrator) on RENE-HP on 13-11-2013 19:41:32
Running from C:\Users\Rene\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe
(SurfRight B.V.) C:\Program Files\HitmanPro\hmpsched.exe
(Microsoft Corporation) C:\Windows\SYSTEM32\WISPTIS.EXE
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\avmike.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\certsrv.exe
(Portrait Displays, Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Shared\dtsrvc.exe
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe
(PDF Complete Inc) C:\Program Files (x86)\PDF Complete\pdfsvc.exe
(Portrait Displays, Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(HP) C:\Program Files (x86)\HP SimplePass 2011\TouchControl.exe
(HP) C:\Program Files (x86)\HP SimplePass 2011\BioMonitor.exe
(Microsoft Corporation) C:\Windows\SYSTEM32\WISPTIS.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Hewlett-Packard ) C:\Program Files\IDT\WDM\beats64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Hewlett-Packard Co.) C:\Program Files\hp\HP Photosmart 5510d series\Bin\ScanToPCActivationApp.exe
(Portrait Displays, Inc) C:\Program Files (x86)\Hewlett-Packard\HP My Display TouchSmart Edition\OSDManager.exe
(shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
() C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\wpctrl.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
(CyberLink) C:\Program Files (x86)\Hewlett-Packard\Media\Webcam\YCMMirage.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
(Portrait Displays, Inc) C:\Program Files (x86)\Hewlett-Packard\HP My Display TouchSmart Edition\DTHtml.exe
(Portrait Displays Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Shared\HookManager.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosHdpProc.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
(Portrait Displays, Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdiSdkHelperx64.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\tosBtProc.exe
(Intel Corporation) C:\Windows\system32\igfxext.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
() C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\DP\DPHelper.exe
() C:\Program Files (x86)\Common Files\Portrait Displays\Plugins\DP\DPHelper64.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\GCalService.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\HPTouchSmartSyncCalReminderApp.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe
(SurfRight B.V.) C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe
(Microsoft Corporation) C:\Windows\System32\dinotify.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [BeatsOSDApp] - C:\Program Files\IDT\WDM\beats64.exe [37888 2013-11-11] (Hewlett-Packard )
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [hpsysdrv] - C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe [62768 2008-11-20] (Hewlett-Packard)
HKLM\...\Run: [Logitech Download Assistant] - C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [1424896 2013-11-11] (IDT, Inc.)
HKLM\...\RunOnce: [NCPluginUpdater] - "c:\program files (x86)\hewlett-packard\hp health check\activecheck\product_line\NCPluginUpdater.exe" Update [21720 2013-11-07] (Hewlett-Packard)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\klogon: C:\Windows\System32\klogon.dll (Kaspersky Lab ZAO)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKCU\...\Run: [HP Photosmart 5510d series (NET)] - C:\Program Files\hp\HP Photosmart 5510d series\Bin\ScanToPCActivationApp.exe [2676584 2011-08-16] (Hewlett-Packard Co.)
HKCU\...\Policies\system: [DisableLockWorkstation] 0
HKCU\...\Policies\system: [DisableChangePassword] 0
HKLM-x32\...\Run: [Easybits Recovery] - C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [61112 2011-05-17] (EasyBits Software AS)
HKLM-x32\...\Run: [DT HPO] - C:\Program Files (x86)\Common Files\Portrait Displays\Shared\DT_Startup.exe [120400 2012-08-16] (Portrait Displays, Inc.)
HKLM-x32\...\Run: [PDF Complete] - C:\Program Files (x86)\PDF Complete\pdfsty.exe [658424 2011-05-06] (PDF Complete Inc)
HKLM-x32\...\Run: [FreePDF Assistant] - C:\Program Files (x86)\FreePDF_XP\fpassist.exe [371200 2011-02-23] (shbox.de)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [ITSecMng] - C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\ItSecMng.exe [83336 2009-07-22] (TOSHIBA CORPORATION)
HKLM-x32\...\Run: [AVP] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe [206448 2012-10-31] (Kaspersky Lab ZAO)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [PivotSoftware] - C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\pivot_Startup.exe [110192 2010-05-13] ()
HKLM-x32\...\Run: [SDTray] - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [3830224 2013-05-16] (Safer-Networking Ltd.)
HKU\Sophie\...\Run: [Google Update] - C:\Users\Sophie\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2012-05-22] (Google Inc.)
HKU\Sophie\...\Run: [ICQ] - C:\Users\Sophie\AppData\Roaming\ICQ\Application\ICQ7M\ICQ.exe [127040 2012-05-22] (ICQ, LLC.)
HKU\Sophie\...\Run: [Facebook Update] - C:\Users\Sophie\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-07-15] (Facebook Inc.)
HKU\Sophie\...\Run: [Spotify] - C:\Users\Sophie\AppData\Roaming\Spotify\spotify.exe [4640768 2013-07-25] (Spotify Ltd)
HKU\Sophie\...\Policies\system: [DisableLockWorkstation] 0
HKU\Sophie\...\Policies\system: [DisableChangePassword] 0
Startup: C:\Users\Rene\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Photosmart 5510d series (Netzwerk).lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Photosmart 5510d series (Netzwerk).lnk -> C:\Program Files\HP\HP Photosmart 5510d series\bin\HPStatusBL.dll (Hewlett-Packard Co.)
Startup: C:\Users\Sophie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Photosmart 5510d series (Netzwerk).lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Photosmart 5510d series (Netzwerk).lnk -> C:\Program Files\HP\HP Photosmart 5510d series\bin\HPStatusBL.dll (Hewlett-Packard Co.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://t-online.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {24FE3852-5D00-43EF-8C8B-FF32F43D11A7} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
SearchScopes: HKCU - {0A96340D-6C40-488D-95AE-9727C2FDAD83} URL = hxxp://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {23EAF3AA-0DF2-4142-BBF0-8BBC4D6ADE77} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
SearchScopes: HKCU - {C0B87CE2-AE1C-4207-A8FE-3DB227F9AE01} URL = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
SearchScopes: HKCU - {F453F4C8-F208-4B75-98C6-2F61B6F74158} URL = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}
BHO: IEVkbdBHO Class - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\x64\ievkbd.dll (Kaspersky Lab ZAO)
BHO: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\x64\IEBHO.dll (HP)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: FilterBHO Class - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\x64\klwtbbho.dll (Kaspersky Lab ZAO)
BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
BHO-x32: IEVkbdBHO Class - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ievkbd.dll (Kaspersky Lab ZAO)
BHO-x32: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\IEBHO.dll (HP)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: FilterBHO Class - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWow64\EZUPBH~1.DLL [52920 2011-12-20] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\sfkr8s1x.default
FF NewTab: chrome://unitedtb/content/newtab/newtab-page.xhtml
FF DefaultSearchEngine: Google
FF SearchEngineOrder.user_pref("browser.search.order.1", "");: user_pref("browser.search.order.1", "");
FF SelectedSearchEngine: Google
FF Homepage: t-online.de
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_152.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/VirtualEarth3D,version=4.0 - c:\Program Files (x86)\Virtual Earth 3D\ No File
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_152.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5 - C:\ProgramData\Visan\plugins\npRLSecurePluginLayer.dll (RocketLife, LLP)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\sfkr8s1x.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\sfkr8s1x.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\sfkr8s1x.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\sfkr8s1x.default\searchplugins\webde-suche.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: FRITZ!Box AddOn - C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\sfkr8s1x.default\Extensions\fb_add_on@avm.de
FF Extension: toolbar - C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\sfkr8s1x.default\Extensions\toolbar@gmx.net.xpi
FF Extension: TrueSuite Website Logon - C:\Program Files (x86)\Mozilla Firefox\extensions\websitelogon@truesuite.com
FF HKLM-x32\...\Firefox\Extensions: [quickprint@hp.com] - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension
FF Extension: SmartPrintButton - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension
FF HKLM-x32\...\Firefox\Extensions: [virtualKeyboard@kaspersky.ru] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\virtualKeyboard@kaspersky.ru
FF Extension: Kaspersky Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\virtualKeyboard@kaspersky.ru
FF HKLM-x32\...\Firefox\Extensions: [linkfilter@kaspersky.ru] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\linkfilter@kaspersky.ru
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\linkfilter@kaspersky.ru
FF HKLM-x32\...\Firefox\Extensions: [KavAntiBanner@Kaspersky.ru] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\KavAntiBanner@Kaspersky.ru
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\KavAntiBanner@Kaspersky.ru
Chrome:
=======
CHR Extension: (Docs) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0
CHR Extension: (Google Drive) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0
CHR Extension: (YouTube) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0
CHR Extension: (Google Search) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0
CHR Extension: (Kaspersky URL Advisor) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.0.477_0
CHR Extension: (Virtual Keyboard) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\12.0.0.477_0
CHR Extension: (Website Logon) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpgfhihjicjofdejkbjgnjlaglaciobe\1.0_0
CHR Extension: () - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk\6.0.2_0
CHR Extension: (Gmail) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
CHR Extension: (Anti-Banner) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\12.0.0.374_0
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ChromeExt\urladvisor.crx
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ChromeExt\virtkbd.crx
CHR HKLM-x32\...\Chrome\Extension: [jpgfhihjicjofdejkbjgnjlaglaciobe] - C:\Program Files (x86)\HP SimplePass 2011\tschrome.crx
CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ChromeExt\ab.crx
==================== Services (Whitelisted) =================
R2 avmike; C:\Program Files\FRITZ!Fernzugang\avmike.exe [336248 2012-02-02] (AVM Berlin)
R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe [206448 2012-10-31] (Kaspersky Lab ZAO)
R2 certsrv; C:\Program Files\FRITZ!Fernzugang\certsrv.exe [143736 2011-10-31] (AVM Berlin)
R2 DTSRVC; C:\Program Files (x86)\Common Files\Portrait Displays\Shared\dtsrvc.exe [136784 2012-08-16] (Portrait Displays, Inc.)
R2 HitmanProScheduler; C:\Program Files\HitmanPro\hmpsched.exe [109352 2013-11-11] (SurfRight B.V.)
R2 hmpalertsvc; C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe [1752488 2013-11-13] (SurfRight B.V.)
S3 McComponentHostService; C:\Program Files (x86)\McAfee Security Scan\3.0.285\McCHSvc.exe [234776 2012-09-05] (McAfee, Inc.)
R2 nwtsrv; C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe [189304 2011-10-31] (AVM Berlin)
R2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1128952 2011-05-06] (PDF Complete Inc)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1817560 2013-05-16] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1033688 2013-05-16] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2013-05-15] (Safer-Networking Ltd.)
==================== Drivers (Whitelisted) ====================
R2 hmpalert; C:\Windows\system32\drivers\hmpalert.sys [17416 2013-11-13] ()
R0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [460888 2011-03-04] (Kaspersky Lab ZAO)
R1 kl2; C:\Windows\System32\DRIVERS\kl2.sys [11864 2011-03-04] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [637272 2012-10-31] (Kaspersky Lab)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [29488 2011-03-10] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [22544 2009-11-02] (Kaspersky Lab)
R2 NPF_devolo; C:\Windows\sysWOW64\drivers\npf_devolo.sys [34048 2008-11-28] (CACE Technologies)
R3 NWIM; C:\Windows\System32\DRIVERS\avmnwim.sys [412024 2011-07-05] (AVM Berlin)
R3 NWVoltron; C:\Windows\system32\drivers\NWVoltron.sys [28440 2011-06-23] ()
S3 NWWakeFilterV; C:\Windows\system32\drivers\NWWakeFilterV.sys [16152 2011-06-23] (n/a)
S3 pmxdrv; C:\Windows\system32\drivers\pmxdrv.sys [31152 2011-12-20] ()
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-11-13 19:40 - 2013-11-13 19:40 - 00000041 _____ C:\Users\Rene\Desktop\checkup.txt
2013-11-13 19:39 - 2013-11-13 19:39 - 00891184 _____ C:\Users\Rene\Downloads\SecurityCheck.exe
2013-11-13 17:59 - 2013-11-13 17:59 - 02347384 _____ (ESET) C:\Users\Rene\Downloads\esetsmartinstaller_enu.exe
2013-11-13 16:48 - 2013-11-13 16:48 - 00533424 _____ (SurfRight) C:\Windows\SysWOW64\hmpalert.dll
2013-11-13 16:48 - 2013-11-13 16:48 - 00488104 _____ (SurfRight) C:\Windows\system32\hmpalert.dll
2013-11-13 16:48 - 2013-11-13 16:48 - 00017416 _____ C:\Windows\system32\Drivers\hmpalert.sys
2013-11-13 16:48 - 2013-11-13 16:48 - 00000000 ____D C:\ProgramData\HitmanPro.Alert
2013-11-13 16:48 - 2013-11-13 16:48 - 00000000 ____D C:\Program Files (x86)\HitmanPro.Alert
2013-11-13 16:47 - 2013-11-13 16:47 - 01752488 _____ (SurfRight B.V.) C:\Users\Rene\Downloads\hmpalert.exe
2013-11-13 16:02 - 2013-11-13 16:02 - 00002168 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2013-11-13 16:02 - 2013-11-13 16:02 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2013-11-13 09:18 - 2013-11-13 09:18 - 00046818 _____ C:\Users\Rene\Desktop\FRST_1.txt
2013-11-13 09:17 - 2013-11-13 09:17 - 01957610 _____ (Farbar) C:\Users\Rene\Downloads\FRST64.exe
2013-11-13 09:11 - 2013-11-13 09:11 - 00001336 _____ C:\Users\Rene\Desktop\JRT.txt
2013-11-13 09:05 - 2013-11-13 09:05 - 00000000 ____D C:\Windows\ERUNT
2013-11-13 09:04 - 2013-11-13 09:04 - 01034531 _____ (Thisisu) C:\Users\Rene\Downloads\JRT.exe
2013-11-13 09:03 - 2013-11-13 09:03 - 00001676 _____ C:\Users\Rene\Desktop\HitmanPro_20131113_0903.log
2013-11-13 09:01 - 2013-11-13 09:01 - 00008547 _____ C:\Users\Rene\Desktop\AdwCleaner[S0].txt
2013-11-13 08:45 - 2013-11-13 08:57 - 00000000 ____D C:\AdwCleaner
2013-11-13 08:44 - 2013-11-13 08:44 - 00339318 _____ C:\Users\Rene\Desktop\Präsentation1.pptx
2013-11-13 08:41 - 2013-11-13 08:41 - 01085542 _____ C:\Users\Rene\Downloads\adwcleaner.exe
2013-11-12 13:19 - 2013-11-12 13:19 - 00255840 _____ C:\Users\Rene\Desktop\Desktop.7z
2013-11-12 12:38 - 2013-11-12 12:38 - 00000193 _____ C:\Users\Rene\Desktop\Kaspersky.log
2013-11-12 10:07 - 2013-11-12 10:07 - 00001680 _____ C:\Users\Rene\Desktop\HitmanPro_20131112_0847.log
2013-11-12 10:03 - 2013-11-12 10:03 - 00037449 _____ C:\Users\Rene\Desktop\Addition.txt
2013-11-12 10:02 - 2013-11-12 10:02 - 00046048 _____ C:\Users\Rene\Desktop\FRST.txt
2013-11-12 10:01 - 2013-11-12 10:01 - 00004999 _____ C:\Users\Rene\Desktop\Gmer.txt
2013-11-12 09:46 - 2013-11-12 09:46 - 00377856 _____ C:\Users\Rene\Downloads\gmer_2.1.19163.exe
2013-11-12 09:44 - 2013-11-13 19:41 - 00023430 _____ C:\Users\Rene\Downloads\FRST.txt
2013-11-12 09:43 - 2013-11-12 09:44 - 00037449 _____ C:\Users\Rene\Downloads\Addition.txt
2013-11-12 09:42 - 2013-11-12 09:42 - 00000000 ____D C:\FRST
2013-11-12 09:39 - 2013-11-12 09:39 - 00000470 _____ C:\Users\Rene\Downloads\defogger_disable.log
2013-11-12 09:39 - 2013-11-12 09:39 - 00000000 _____ C:\Users\Rene\defogger_reenable
2013-11-12 09:38 - 2013-11-12 09:37 - 00050477 _____ C:\Users\Rene\Downloads\Defogger.exe
2013-11-11 20:23 - 2013-11-11 20:23 - 00005286 _____ C:\Windows\system32\.crusader
2013-11-11 20:06 - 2013-11-11 20:06 - 00001907 _____ C:\Users\Public\Desktop\HitmanPro.lnk
2013-11-11 20:06 - 2013-11-11 20:06 - 00000000 ____D C:\Program Files\HitmanPro
2013-11-11 20:04 - 2013-11-12 08:47 - 00000000 ____D C:\ProgramData\HitmanPro
2013-11-11 20:04 - 2013-11-11 20:05 - 10264904 _____ (SurfRight B.V.) C:\Users\Rene\Downloads\HitmanPro_x64.exe
2013-11-11 20:03 - 2013-11-11 20:03 - 09452704 _____ (SurfRight B.V.) C:\Users\Rene\Downloads\HitmanPro3.7.8.208.exe
2013-11-11 19:50 - 2013-11-11 19:49 - 06141440 _____ (IDT, Inc.) C:\Windows\system32\IDTNGUI.exe
2013-11-11 19:50 - 2013-11-11 19:49 - 05126144 _____ (IDT, Inc.) C:\Windows\system32\IDTNHP.dll
2013-11-11 19:50 - 2013-11-11 19:49 - 01819136 _____ (IDT, Inc.) C:\Windows\system32\IDTNC64.cpl
2013-11-11 19:50 - 2013-11-11 19:49 - 01059328 _____ (IDT, Inc.) C:\Windows\system32\IDTNX.dll
2013-11-11 19:50 - 2013-11-11 19:49 - 00249344 _____ (IDT, Inc.) C:\Windows\system32\IDTNJ.exe
2013-11-11 19:50 - 2013-11-11 19:49 - 00037888 _____ (Hewlett-Packard ) C:\Windows\system32\beats64.exe
2013-11-11 19:49 - 2013-11-11 19:51 - 00000000 ____D C:\Program Files\IDT
2013-11-11 19:49 - 2013-11-11 19:49 - 01986048 _____ (IDT, Inc.) C:\Windows\system32\stapo64.dll
2013-11-11 19:49 - 2013-11-11 19:49 - 00653824 ____N (IDT, Inc.) C:\Windows\system32\stapi64.dll
2013-11-11 19:49 - 2013-11-11 19:49 - 00535040 _____ (IDT, Inc.) C:\Windows\system32\Drivers\stwrt64.sys
2013-11-11 19:41 - 2013-11-11 19:41 - 00000000 ____D C:\Program Files (x86)\Ralink
2013-11-11 19:40 - 2013-11-11 19:40 - 00000000 ____D C:\Users\Rene\AppData\Roaming\InstallShield
2013-11-11 19:39 - 2013-11-13 11:48 - 00000000 ____D C:\Users\Rene\Desktop\Bilder Ebay Kleinanzeigen
2013-10-20 16:53 - 2013-10-20 16:56 - 00003922 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{03891525-6FDC-4836-BAB3-0D1EEB370C56}
2013-10-16 02:17 - 2013-09-23 00:27 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-10-16 02:17 - 2013-09-22 23:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-10-16 02:17 - 2013-09-21 04:38 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-10-16 02:17 - 2013-09-21 04:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-10-16 02:16 - 2013-09-23 00:28 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-10-16 02:16 - 2013-09-23 00:28 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-10-16 02:16 - 2013-09-23 00:27 - 14335488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-10-16 02:16 - 2013-09-23 00:27 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-10-16 02:16 - 2013-09-23 00:27 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-10-16 02:16 - 2013-09-23 00:27 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-10-16 02:16 - 2013-09-23 00:27 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-10-16 02:16 - 2013-09-23 00:27 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-10-16 02:16 - 2013-09-23 00:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-10-16 02:16 - 2013-09-23 00:27 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-10-16 02:16 - 2013-09-23 00:27 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-10-16 02:16 - 2013-09-23 00:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-10-16 02:16 - 2013-09-22 23:55 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-10-16 02:16 - 2013-09-22 23:55 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-10-16 02:16 - 2013-09-22 23:55 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-10-16 02:16 - 2013-09-22 23:54 - 19252224 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-10-16 02:16 - 2013-09-22 23:54 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-10-16 02:16 - 2013-09-22 23:54 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-10-16 02:16 - 2013-09-22 23:54 - 02647552 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-10-16 02:16 - 2013-09-22 23:54 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-10-16 02:16 - 2013-09-22 23:54 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-10-16 02:16 - 2013-09-22 23:54 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-10-16 02:16 - 2013-09-22 23:54 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-10-16 02:16 - 2013-09-22 23:54 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-10-16 02:16 - 2013-09-22 23:54 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-10-16 02:16 - 2013-09-21 03:48 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-10-16 02:16 - 2013-09-21 03:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-10-15 09:20 - 2013-07-12 11:41 - 00185344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys
2013-10-15 09:20 - 2013-07-12 11:41 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
2013-10-15 09:20 - 2013-07-03 05:05 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2013-10-15 09:20 - 2013-07-03 05:05 - 00032896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2013-10-15 09:17 - 2013-07-04 13:50 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2013-10-15 09:16 - 2013-07-04 12:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2013-10-15 09:16 - 2013-06-06 06:50 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2013-10-15 09:16 - 2013-06-06 06:49 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2013-10-15 09:16 - 2013-06-06 06:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2013-10-15 09:16 - 2013-06-06 06:47 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2013-10-15 09:16 - 2013-06-06 05:57 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2013-10-15 09:16 - 2013-06-06 05:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2013-10-15 09:16 - 2013-06-06 05:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2013-10-15 09:16 - 2013-06-06 04:30 - 00368128 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-10-15 09:16 - 2013-06-06 04:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2013-10-15 09:16 - 2013-06-06 04:01 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2013-10-15 09:11 - 2013-06-25 23:55 - 00785624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2013-10-15 09:04 - 2013-09-14 02:10 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-10-15 09:04 - 2013-09-08 03:30 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-10-15 09:04 - 2013-09-08 03:27 - 00327168 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2013-10-15 09:04 - 2013-09-08 03:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswsock.dll
2013-10-15 09:04 - 2013-08-28 02:21 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-10-15 09:04 - 2013-07-04 13:57 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2013-10-15 09:04 - 2013-07-04 13:50 - 00102400 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2013-10-15 09:04 - 2013-07-04 12:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll
2013-10-15 09:04 - 2013-07-04 12:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll
2013-10-15 09:04 - 2013-07-04 11:11 - 00140800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2013-10-15 09:03 - 2013-08-29 03:17 - 05549504 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-10-15 09:03 - 2013-08-29 03:16 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-10-15 09:03 - 2013-08-29 03:16 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2013-10-15 09:03 - 2013-08-29 03:16 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-10-15 09:03 - 2013-08-29 03:13 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2013-10-15 09:03 - 2013-08-29 02:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-10-15 09:03 - 2013-08-29 02:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-10-15 09:03 - 2013-08-29 02:50 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-10-15 09:03 - 2013-08-29 02:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2013-10-15 09:03 - 2013-08-29 02:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-10-15 09:03 - 2013-08-29 02:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2013-10-15 09:03 - 2013-08-29 01:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-10-15 09:03 - 2013-08-29 01:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-10-15 09:03 - 2013-08-29 01:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-10-15 09:03 - 2013-08-29 01:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-10-15 09:03 - 2013-08-28 02:12 - 00461312 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll
2013-10-15 09:03 - 2013-08-01 13:09 - 00983488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-10-15 09:03 - 2013-07-20 11:33 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-15 09:03 - 2013-07-20 11:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
==================== One Month Modified Files and Folders =======
2013-11-13 19:41 - 2013-11-12 09:44 - 00023430 _____ C:\Users\Rene\Downloads\FRST.txt
2013-11-13 19:40 - 2013-11-13 19:40 - 00000041 _____ C:\Users\Rene\Desktop\checkup.txt
2013-11-13 19:39 - 2013-11-13 19:39 - 00891184 _____ C:\Users\Rene\Downloads\SecurityCheck.exe
2013-11-13 19:36 - 2012-06-10 22:35 - 00000336 _____ C:\Windows\Tasks\HP Photo Creations Communicator.job
2013-11-13 19:36 - 2011-12-20 01:10 - 00696620 _____ C:\Windows\system32\perfh007.dat
2013-11-13 19:36 - 2011-12-20 01:10 - 00147916 _____ C:\Windows\system32\perfc007.dat
2013-11-13 19:36 - 2009-07-14 06:13 - 01612484 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-13 19:18 - 2012-08-21 10:42 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-13 19:13 - 2012-05-22 18:03 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-603513771-2939990097-2127156883-1001UA.job
2013-11-13 19:10 - 2012-05-22 15:30 - 00003922 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{CF4CA5DA-2485-4C39-842E-3908496AFD16}
2013-11-13 19:01 - 2012-10-31 20:59 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-13 18:39 - 2012-08-21 10:39 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-11-13 18:32 - 2012-05-22 15:19 - 02016376 _____ C:\Windows\WindowsUpdate.log
2013-11-13 18:13 - 2012-05-22 18:03 - 00001072 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-603513771-2939990097-2127156883-1001Core.job
2013-11-13 18:00 - 2012-10-31 20:59 - 00001102 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-13 17:59 - 2013-11-13 17:59 - 02347384 _____ (ESET) C:\Users\Rene\Downloads\esetsmartinstaller_enu.exe
2013-11-13 16:57 - 2012-05-22 18:47 - 00001142 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-603513771-2939990097-2127156883-1001UA.job
2013-11-13 16:48 - 2013-11-13 16:48 - 00533424 _____ (SurfRight) C:\Windows\SysWOW64\hmpalert.dll
2013-11-13 16:48 - 2013-11-13 16:48 - 00488104 _____ (SurfRight) C:\Windows\system32\hmpalert.dll
2013-11-13 16:48 - 2013-11-13 16:48 - 00017416 _____ C:\Windows\system32\Drivers\hmpalert.sys
2013-11-13 16:48 - 2013-11-13 16:48 - 00000000 ____D C:\ProgramData\HitmanPro.Alert
2013-11-13 16:48 - 2013-11-13 16:48 - 00000000 ____D C:\Program Files (x86)\HitmanPro.Alert
2013-11-13 16:47 - 2013-11-13 16:47 - 01752488 _____ (SurfRight B.V.) C:\Users\Rene\Downloads\hmpalert.exe
2013-11-13 16:02 - 2013-11-13 16:02 - 00002168 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2013-11-13 16:02 - 2013-11-13 16:02 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2013-11-13 16:02 - 2013-06-13 19:48 - 00000000 ____D C:\Program Files (x86)\McAfee Security Scan
2013-11-13 16:02 - 2012-08-21 10:42 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-11-13 16:02 - 2012-05-29 10:42 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-11-13 16:02 - 2012-05-29 10:42 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-11-13 16:02 - 2012-05-23 10:18 - 00000000 ____D C:\Users\Rene\AppData\Local\Adobe
2013-11-13 13:05 - 2012-11-18 12:46 - 00003180 _____ C:\Windows\System32\Tasks\HPCeeScheduleForRene
2013-11-13 13:05 - 2012-11-18 12:46 - 00000328 _____ C:\Windows\Tasks\HPCeeScheduleForRene.job
2013-11-13 13:05 - 2012-05-23 16:10 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log
2013-11-13 13:04 - 2013-05-15 19:42 - 00000000 _____ C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2013-11-13 13:02 - 2012-05-23 16:06 - 00000000 ____D C:\Users\Rene\AppData\Roaming\HpUpdate
2013-11-13 13:02 - 2012-05-23 16:06 - 00000000 ____D C:\Users\Rene\AppData\Roaming\HP Support Assistant
2013-11-13 11:48 - 2013-11-11 19:39 - 00000000 ____D C:\Users\Rene\Desktop\Bilder Ebay Kleinanzeigen
2013-11-13 09:18 - 2013-11-13 09:18 - 00046818 _____ C:\Users\Rene\Desktop\FRST_1.txt
2013-11-13 09:17 - 2013-11-13 09:17 - 01957610 _____ (Farbar) C:\Users\Rene\Downloads\FRST64.exe
2013-11-13 09:11 - 2013-11-13 09:11 - 00001336 _____ C:\Users\Rene\Desktop\JRT.txt
2013-11-13 09:06 - 2009-07-14 05:45 - 00024400 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-13 09:06 - 2009-07-14 05:45 - 00024400 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-13 09:05 - 2013-11-13 09:05 - 00000000 ____D C:\Windows\ERUNT
2013-11-13 09:04 - 2013-11-13 09:04 - 01034531 _____ (Thisisu) C:\Users\Rene\Downloads\JRT.exe
2013-11-13 09:03 - 2013-11-13 09:03 - 00001676 _____ C:\Users\Rene\Desktop\HitmanPro_20131113_0903.log
2013-11-13 09:02 - 2013-09-05 19:01 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-13 09:01 - 2013-11-13 09:01 - 00008547 _____ C:\Users\Rene\Desktop\AdwCleaner[S0].txt
2013-11-13 08:59 - 2011-12-20 01:46 - 00000000 ____D C:\ProgramData\PDFC
2013-11-13 08:58 - 2011-12-20 01:50 - 00000000 ____D C:\ProgramData\truesuite
2013-11-13 08:58 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-13 08:58 - 2009-07-14 05:51 - 00073555 _____ C:\Windows\setupact.log
2013-11-13 08:57 - 2013-11-13 08:45 - 00000000 ____D C:\AdwCleaner
2013-11-13 08:57 - 2012-05-31 11:34 - 00000000 ____D C:\Users\Rene\AppData\Local\CrashDumps
2013-11-13 08:44 - 2013-11-13 08:44 - 00339318 _____ C:\Users\Rene\Desktop\Präsentation1.pptx
2013-11-13 08:41 - 2013-11-13 08:41 - 01085542 _____ C:\Users\Rene\Downloads\adwcleaner.exe
2013-11-12 19:57 - 2012-05-22 18:47 - 00001120 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-603513771-2939990097-2127156883-1001Core.job
2013-11-12 13:19 - 2013-11-12 13:19 - 00255840 _____ C:\Users\Rene\Desktop\Desktop.7z
2013-11-12 12:38 - 2013-11-12 12:38 - 00000193 _____ C:\Users\Rene\Desktop\Kaspersky.log
2013-11-12 10:07 - 2013-11-12 10:07 - 00001680 _____ C:\Users\Rene\Desktop\HitmanPro_20131112_0847.log
2013-11-12 10:03 - 2013-11-12 10:03 - 00037449 _____ C:\Users\Rene\Desktop\Addition.txt
2013-11-12 10:02 - 2013-11-12 10:02 - 00046048 _____ C:\Users\Rene\Desktop\FRST.txt
2013-11-12 10:01 - 2013-11-12 10:01 - 00004999 _____ C:\Users\Rene\Desktop\Gmer.txt
2013-11-12 09:46 - 2013-11-12 09:46 - 00377856 _____ C:\Users\Rene\Downloads\gmer_2.1.19163.exe
2013-11-12 09:44 - 2013-11-12 09:43 - 00037449 _____ C:\Users\Rene\Downloads\Addition.txt
2013-11-12 09:42 - 2013-11-12 09:42 - 00000000 ____D C:\FRST
2013-11-12 09:39 - 2013-11-12 09:39 - 00000470 _____ C:\Users\Rene\Downloads\defogger_disable.log
2013-11-12 09:39 - 2013-11-12 09:39 - 00000000 _____ C:\Users\Rene\defogger_reenable
2013-11-12 09:39 - 2012-05-22 15:21 - 00000000 ____D C:\Users\Rene
2013-11-12 09:37 - 2013-11-12 09:38 - 00050477 _____ C:\Users\Rene\Downloads\Defogger.exe
2013-11-12 08:47 - 2013-11-11 20:04 - 00000000 ____D C:\ProgramData\HitmanPro
2013-11-11 20:57 - 2013-10-09 18:50 - 00000000 ____D C:\Users\Rene\AppData\Roaming\Dropbox
2013-11-11 20:57 - 2012-05-22 15:30 - 00000000 ___RD C:\Users\Rene\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-11-11 20:54 - 2013-10-09 18:52 - 00000000 ___RD C:\Users\Rene\Dropbox
2013-11-11 20:53 - 2010-11-21 04:47 - 00783712 _____ C:\Windows\PFRO.log
2013-11-11 20:43 - 2013-01-03 15:30 - 00000000 ____D C:\Users\Rene\Documents\Hausbau
2013-11-11 20:23 - 2013-11-11 20:23 - 00005286 _____ C:\Windows\system32\.crusader
2013-11-11 20:06 - 2013-11-11 20:06 - 00001907 _____ C:\Users\Public\Desktop\HitmanPro.lnk
2013-11-11 20:06 - 2013-11-11 20:06 - 00000000 ____D C:\Program Files\HitmanPro
2013-11-11 20:05 - 2013-11-11 20:04 - 10264904 _____ (SurfRight B.V.) C:\Users\Rene\Downloads\HitmanPro_x64.exe
2013-11-11 20:03 - 2013-11-11 20:03 - 09452704 _____ (SurfRight B.V.) C:\Users\Rene\Downloads\HitmanPro3.7.8.208.exe
2013-11-11 19:51 - 2013-11-11 19:49 - 00000000 ____D C:\Program Files\IDT
2013-11-11 19:50 - 2011-12-20 01:21 - 00000000 ____D C:\ProgramData\SonicFocus
2013-11-11 19:49 - 2013-11-11 19:50 - 06141440 _____ (IDT, Inc.) C:\Windows\system32\IDTNGUI.exe
2013-11-11 19:49 - 2013-11-11 19:50 - 05126144 _____ (IDT, Inc.) C:\Windows\system32\IDTNHP.dll
2013-11-11 19:49 - 2013-11-11 19:50 - 01819136 _____ (IDT, Inc.) C:\Windows\system32\IDTNC64.cpl
2013-11-11 19:49 - 2013-11-11 19:50 - 01059328 _____ (IDT, Inc.) C:\Windows\system32\IDTNX.dll
2013-11-11 19:49 - 2013-11-11 19:50 - 00249344 _____ (IDT, Inc.) C:\Windows\system32\IDTNJ.exe
2013-11-11 19:49 - 2013-11-11 19:50 - 00037888 _____ (Hewlett-Packard ) C:\Windows\system32\beats64.exe
2013-11-11 19:49 - 2013-11-11 19:49 - 01986048 _____ (IDT, Inc.) C:\Windows\system32\stapo64.dll
2013-11-11 19:49 - 2013-11-11 19:49 - 00653824 ____N (IDT, Inc.) C:\Windows\system32\stapi64.dll
2013-11-11 19:49 - 2013-11-11 19:49 - 00535040 _____ (IDT, Inc.) C:\Windows\system32\Drivers\stwrt64.sys
2013-11-11 19:49 - 2011-12-20 01:21 - 04241408 _____ (IDT, Inc.) C:\Windows\system32\stlang64.dll
2013-11-11 19:49 - 2011-12-20 01:21 - 01424896 _____ (IDT, Inc.) C:\Windows\sttray64.exe
2013-11-11 19:49 - 2011-12-20 01:21 - 00442368 _____ (Andrea Electronics Corporation) C:\Windows\system32\AESTEC64.dll
2013-11-11 19:49 - 2011-12-20 01:21 - 00223744 _____ (IDT, Inc.) C:\Windows\system32\HPToneCtrls64.dll
2013-11-11 19:49 - 2011-12-20 01:21 - 00162304 _____ (Andrea Electronics Corporation) C:\Windows\system32\AESTAC64.dll
2013-11-11 19:49 - 2011-12-20 01:21 - 00090624 _____ (Andrea Electronics Corporation) C:\Windows\system32\AESTCo64.dll
2013-11-11 19:49 - 2011-12-20 01:21 - 00068608 _____ (Andrea Electronics Corporation) C:\Windows\system32\AESTAR64.dll
2013-11-11 19:49 - 2011-12-20 01:18 - 00250880 _____ (IDT, Inc.) C:\Windows\system32\staco64.dll
2013-11-11 19:49 - 2011-02-11 17:32 - 00000000 ____D C:\SWSETUP
2013-11-11 19:48 - 2013-10-09 19:24 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2013-11-11 19:41 - 2013-11-11 19:41 - 00000000 ____D C:\Program Files (x86)\Ralink
2013-11-11 19:41 - 2011-12-20 01:29 - 00005496 _____ C:\Windows\system32\RaCoInst.log
2013-11-11 19:40 - 2013-11-11 19:40 - 00000000 ____D C:\Users\Rene\AppData\Roaming\InstallShield
2013-11-04 15:44 - 2012-05-30 11:17 - 00000000 ____D C:\ProgramData\HP Photo Creations
2013-11-04 15:41 - 2013-03-30 10:25 - 00003922 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{673C6173-064B-48E4-8E60-310E0137200F}
2013-11-03 20:39 - 2012-11-28 21:16 - 00003216 _____ C:\Windows\System32\Tasks\HPCeeScheduleForRENE-HP$
2013-11-03 20:39 - 2012-11-28 21:16 - 00000340 _____ C:\Windows\Tasks\HPCeeScheduleForRENE-HP$.job
2013-11-03 17:56 - 2013-08-08 21:29 - 00013400 _____ C:\Users\Rene\Documents\Gesamtkosten Haus.xlsx
2013-10-26 09:52 - 2012-11-22 22:03 - 00269312 ___SH C:\Users\Rene\Documents\Thumbs.db
2013-10-20 17:03 - 2013-10-09 18:52 - 00001017 _____ C:\Users\Rene\Desktop\Dropbox.lnk
2013-10-20 17:03 - 2013-10-09 18:51 - 00000000 ____D C:\Users\Rene\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2013-10-20 16:56 - 2013-10-20 16:53 - 00003922 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{03891525-6FDC-4836-BAB3-0D1EEB370C56}
2013-10-20 16:55 - 2012-10-31 20:59 - 00004102 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-10-20 16:55 - 2012-10-31 20:59 - 00003850 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-10-16 03:15 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-10-16 02:37 - 2013-03-14 22:57 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-10-16 02:37 - 2013-03-14 22:57 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-10-16 02:37 - 2009-07-14 05:45 - 00342240 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-16 02:19 - 2012-05-22 15:56 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-10-16 02:12 - 2011-02-11 18:15 - 01589442 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2013-10-16 02:08 - 2013-08-19 08:27 - 00000000 ____D C:\Windows\system32\MRT
2013-10-16 02:05 - 2012-06-01 10:16 - 80541720 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
Some content of TEMP:
====================
C:\Users\Rene\AppData\Local\Temp\Extract.exe
C:\Users\Rene\AppData\Local\Temp\Quarantine.exe
C:\Users\Rene\AppData\Local\Temp\SP57550.exe
C:\Users\Rene\AppData\Local\Temp\SP58084.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-11-12 10:40
==================== End Of Log ============================
--- --- --- --- --- --- --- --- --- Vielen Dank, Gruß regro Ich glaube mit dem Securitycheck ging wohl was daneben. Hier das neue Log. Code:
ATTFilter Results of screen317's Security Check version 0.99.76 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 10 ``````````````Antivirus/Firewall Check:`````````````` Kaspersky Internet Security Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` Spybot - Search & Destroy Malwarebytes Anti-Malware Version 1.75.0.1300 Adobe Flash Player 11.9.900.152 Adobe Reader 10.1.8 Adobe Reader out of Date! Mozilla Firefox (25.0) Google Chrome 27.0.1453.110 ````````Process Check: objlist.exe by Laurent```````` Spybot Teatimer.exe is disabled! Kaspersky Lab Kaspersky Internet Security 2012 avp.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` |
|
14.11.2013, 10:31
| #9 |
| /// the machine /// TB-Ausbilder | Wichtige Sicherheitswarnung zu Ihrem Internetanschluss Abuse T-Online Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
C:\Program Files\Enigma Software Group
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Fertig Die Reihenfolge ist hier entscheidend.
Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann. Und jetzt dann bitte FRST Logs vom laptop.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
14.11.2013, 22:16
| #10 |
| | Wichtige Sicherheitswarnung zu Ihrem Internetanschluss Abuse T-Online Hallo Schrauber, nochmal vielen Dank für Deine schnelle Hilfe. Ich werde den Rechner jetzt mal 1 Woche lang testen und mir den Port von der Telekom wieder frei schalten lasssen. Ich gebe Dir dann bescheid ob der Rechner sauber läuft. Gruß regro Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 14-11-2013
Ran by Rene at 2013-11-14 17:28:52 Run:1
Running from C:\Users\Rene\Downloads
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
C:\Program Files\Enigma Software Group
*****************
esgiguard => Service deleted successfully.
C:\Program Files\Enigma Software Group => Moved successfully.
==== End of Fixlog ====
Gruß regro Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.11.14.08 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16721 Rene :: ACER [Administrator] 14.11.2013 21:50:01 mbam-log-2013-11-14 (21-50-01).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 212313 Laufzeit: 6 Minute(n), 43 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 14-11-2013
Ran by Rene (administrator) on ACER on 14-11-2013 22:09:16
Running from C:\Users\Rene\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\adminservice.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe
(Deutsche Telekom AG) C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Alcor Micro Corp.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe
() C:\Windows\PLFSetI.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe
(Acer) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version6\TeamViewer.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(The Eraser Project) C:\Program Files\Eraser\Eraser.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [AmIcoSinglun64] - C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [323584 2009-09-23] (Alcor Micro Corp.)
HKLM\...\Run: [mwlDaemon] - C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe [349480 2009-12-02] (Egis Technology Inc.)
HKLM\...\Run: [PLFSetI] - C:\Windows\PLFSetI.exe [200704 2008-07-29] ()
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1842472 2009-09-18] (Synaptics Incorporated)
HKLM\...\Run: [Acer ePower Management] - C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [860192 2010-02-05] (Acer Incorporated)
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)
Winlogon\Notify\klogon: C:\Windows\System32\klogon.dll (Kaspersky Lab ZAO)
HKCU\...\Run: [AVMUSBFernanschluss] - C:\Users\Rene\AppData\Local\Apps\2.0\MPQAEAVC.5G0\E9285KBK.NT7\frit..tion_8488884cfbcefd60_0002.0003_f406d43803d5433d\AVMAutoStart.exe [139264 2013-04-04] (AVM Berlin)
HKCU\...\Run: [Speech Recognition] - C:\Windows\Speech\Common\sapisvr.exe [44544 2009-07-14] (Microsoft Corporation)
HKCU\...\Run: [Spybot-S&D Cleaning] - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe [3642312 2013-05-16] (Safer-Networking Ltd.)
HKCU\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_9_900_117_Plugin.exe -update plugin [829832 2013-10-10] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2009-12-24] (Intel Corporation)
HKLM-x32\...\Run: [BackupManagerTray] - C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [265984 2010-01-13] (NewTech Infosystems, Inc.)
HKLM-x32\...\Run: [NortonOnlineBackupReminder] - C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe [588648 2009-07-25] (Symantec Corporation)
HKLM-x32\...\Run: [EgisUpdate] - C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe [200488 2009-10-23] (Egis Technology Inc.)
HKLM-x32\...\Run: [EgisTecPMMUpdate] - C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe [401192 2009-10-23] (Egis Technology Inc.)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-01-22] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [AVP] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe [206448 2012-12-06] (Kaspersky Lab ZAO)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: [SDTray] - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [3830224 2013-05-16] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [154144 2010-01-15] ()
HKU\Default User\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [154144 2010-01-15] ()
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Whitelisted) ====================
ProxyServer: localhost:21320
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://navigon.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,ICQ Search = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM-x32 - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL =
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
BHO: No Name - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - No File
BHO: IEVkbdBHO Class - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\x64\ievkbd.dll (Kaspersky Lab ZAO)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: FilterBHO Class - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\x64\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\smart web printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: No Name - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - No File
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: IEVkbdBHO Class - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ievkbd.dll (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: FilterBHO Class - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\smart web printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM-x32 - No Name - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKCU - No Name - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - No File
Handler: ftp - No CLSID Value -
Handler: https - No CLSID Value -
Handler-x32: ftp - No CLSID Value -
Handler-x32: https - No CLSID Value -
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\0z0tuhtq.default
FF user.js: detected! => C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\0z0tuhtq.default\user.js
FF DefaultSearchEngine: Google
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.t-online.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.2 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @garmin.com/GpsControl - C:\Program Files (x86)\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Rene\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Rene\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\0z0tuhtq.default\searchplugins\searchplugins-backup
FF SearchPlugin: C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\0z0tuhtq.default\searchplugins\Web Search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Conduit Engine - C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\0z0tuhtq.default\Extensions\engine@conduit.com
FF Extension: Telekom Toolbar 3.0 - C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\0z0tuhtq.default\Extensions\totbff01@telekom.de
FF Extension: ICQ Toolbar - C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\0z0tuhtq.default\Extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
FF Extension: DVDVideoSoftTB Community Toolbar - C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\0z0tuhtq.default\Extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
FF Extension: ciuvo-extension - C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\0z0tuhtq.default\Extensions\ciuvo-extension@icq.de.xpi
FF Extension: movie2kdownloader - C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\0z0tuhtq.default\Extensions\movie2kdownloader@movie2kdownloader.com.xpi
FF Extension: toolbar - C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\0z0tuhtq.default\Extensions\toolbar@gmx.net.xpi
FF Extension: ImTranslator - C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\0z0tuhtq.default\Extensions\{9AA46F4F-4DC7-4c06-97AF-5035170634FE}.xpi
FF Extension: No Name - C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\0z0tuhtq.default\Extensions\{D249FD00-4DF9-11D9-9FDC-0080481ADA61}.xpi
FF Extension: No Name - C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\0z0tuhtq.default\Extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}.xpi
FF Extension: No Name - C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\0z0tuhtq.default\Extensions\{EEE6C361-6118-11DC-9C72-001320C79847}.xpi
FF Extension: Anti-Banner - C:\Program Files (x86)\Mozilla Firefox\extensions\KavAntiBanner@kaspersky.ru_bak2
FF Extension: Modul zur Link-Untersuchung - C:\Program Files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak2
FF Extension: Skype extension for Firefox - C:\Program Files (x86)\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF HKLM-x32\...\Firefox\Extensions: [virtualKeyboard@kaspersky.ru] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\virtualKeyboard@kaspersky.ru
FF Extension: Kaspersky Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\virtualKeyboard@kaspersky.ru
FF HKLM-x32\...\Firefox\Extensions: [linkfilter@kaspersky.ru] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\linkfilter@kaspersky.ru
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\linkfilter@kaspersky.ru
FF HKLM-x32\...\Firefox\Extensions: [KavAntiBanner@Kaspersky.ru] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\KavAntiBanner@Kaspersky.ru
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\KavAntiBanner@Kaspersky.ru
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (Movie2kDownloader) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\blaofbhgbmeikidhlkmjhbkbfohpgekf\1.0_0
CHR Extension: (YouTube) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (GMX MailCheck) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\camnampocfohlcgbajligmemmabnljcm\1.1_0
CHR Extension: (Google Search) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Kaspersky URL Advisor) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.0.477_0
CHR Extension: (Complitly plugin for chrome) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlfienamagdnkekbbbocojppncdambda\1.1_0
CHR Extension: (Virtual Keyboard) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\12.0.0.477_0
CHR Extension: (DVDVideoSoft Browser Extension) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0
CHR Extension: (DivX Plus Web Player HTML5 \u003Cvideo\u003E) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0
CHR Extension: (Gmail) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1
CHR Extension: (Anti-Banner) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\12.0.0.374_0
CHR HKLM-x32\...\Chrome\Extension: [blaofbhgbmeikidhlkmjhbkbfohpgekf] - C:\Program Files (x86)\Movie2KDownloader.com\Movie2KDownloader10.crx
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ChromeExt\urladvisor.crx
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ChromeExt\virtkbd.crx
CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx
CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ChromeExt\ab.crx
==================== Services (Whitelisted) =================
R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe [206448 2012-12-06] (Kaspersky Lab ZAO)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MWLService; C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [305448 2009-12-02] (Egis Technology Inc.)
R2 Netzmanager Service; C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe [2635776 2012-07-20] (Deutsche Telekom AG)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1817560 2013-05-16] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1033688 2013-05-16] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2013-05-15] (Safer-Networking Ltd.)
S2 SystemStoreService; C:\Program Files (x86)\SoftwareUpdater\SystemStore.exe [296448 2013-05-06] ()
S3 ServiceLayer; "C:\Program Files (x86)\Nokia\PC Connectivity Solution\ServiceLayer.exe" [x]
==================== Drivers (Whitelisted) ====================
S3 AbilisT; C:\Windows\System32\Drivers\AbilisBdaTuner.sys [128264 2010-03-18] (ABILIS Systems)
R3 avmaudio; C:\Windows\System32\DRIVERS\avmaudio.sys [116480 2013-04-04] (AVM Berlin)
R3 avmaura; C:\Windows\System32\DRIVERS\avmaura.sys [116480 2013-04-04] (AVM Berlin)
R3 azvusb; C:\Windows\System32\DRIVERS\azvusb.sys [54784 2009-08-24] (AzureWave Technologies, Inc.)
S3 dgderdrv; C:\Windows\System32\drivers\dgderdrv.sys [20568 2010-05-25] (Devguru Co., Ltd)
R0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [460888 2011-03-04] (Kaspersky Lab ZAO)
R1 kl2; C:\Windows\System32\DRIVERS\kl2.sys [11864 2011-03-04] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [637272 2012-12-06] (Kaspersky Lab)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [29488 2011-03-10] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [22544 2009-11-02] (Kaspersky Lab)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R1 MPFP; C:\Windows\System32\Drivers\Mpfp.sys [176144 2009-04-09] (McAfee, Inc.)
S3 TelekomNM6; C:\Program Files\Netzmanager\NMInfraIS2\Driver\TelekomNM6.sys [45664 2010-09-16] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH)
R2 {B154377D-700F-42cc-9474-23858FBDF4BD}; c:\Program Files (x86)\CyberLink\PowerDVD9\000.fcl [146928 2010-01-22] (CyberLink Corp.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-11-14 22:09 - 2013-11-14 22:09 - 00024798 _____ C:\Users\Rene\Downloads\FRST.txt
2013-11-14 22:09 - 2013-11-14 22:09 - 00000000 ____D C:\FRST
2013-11-14 22:08 - 2013-11-14 22:08 - 01957794 _____ (Farbar) C:\Users\Rene\Downloads\FRST64.exe
2013-11-14 22:05 - 2013-11-14 22:05 - 01090529 _____ (Farbar) C:\Users\Rene\Downloads\FRST.exe
2013-10-19 13:14 - 2013-10-19 13:14 - 00000000 ____D C:\ProgramData\Acer
2013-10-19 12:59 - 2013-10-19 12:59 - 00000000 ____D C:\Windows\ERUNT
2013-10-19 12:58 - 2013-10-19 12:59 - 00002408 _____ C:\DelFix.txt
2013-10-19 12:55 - 2013-10-19 12:55 - 00000000 ___SD C:\unistall.exe
2013-10-18 10:15 - 2013-10-19 10:36 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-10-18 09:41 - 2013-10-18 10:16 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-10-18 09:39 - 2013-10-18 09:59 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-10-18 09:35 - 2013-10-18 09:36 - 12576792 _____ (Malwarebytes Corp.) C:\Users\Rene\Downloads\mbar-1.07.0.1007.exe
2013-10-18 09:22 - 2013-10-18 09:22 - 00000000 ____D C:\ProgramData\Oracle
2013-10-18 09:21 - 2013-10-08 06:50 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-10-18 09:21 - 2013-10-08 06:46 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-10-18 09:21 - 2013-10-08 06:46 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-10-18 09:21 - 2013-10-08 06:46 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-10-18 09:20 - 2013-10-18 09:21 - 00004886 _____ C:\Windows\SysWOW64\jupdate-1.7.0_45-b18.log
2013-10-18 08:44 - 2013-10-18 08:44 - 00985600 _____ C:\Users\Rene\Downloads\MicrosoftFixit50123.msi
2013-10-18 08:16 - 2013-09-04 13:12 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2013-10-18 08:16 - 2013-09-04 13:11 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2013-10-18 08:16 - 2013-09-04 13:11 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2013-10-18 08:16 - 2013-09-04 13:11 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2013-10-18 08:16 - 2013-09-04 13:11 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2013-10-18 08:16 - 2013-09-04 13:11 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2013-10-18 08:16 - 2013-09-04 13:11 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2013-10-16 11:40 - 2013-07-12 11:41 - 00185344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys
2013-10-16 11:40 - 2013-07-12 11:41 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
2013-10-16 11:20 - 2013-09-23 00:28 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-10-16 11:20 - 2013-09-23 00:28 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-10-16 11:20 - 2013-09-23 00:27 - 14335488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-10-16 11:20 - 2013-09-23 00:27 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-10-16 11:20 - 2013-09-23 00:27 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-10-16 11:20 - 2013-09-23 00:27 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-10-16 11:20 - 2013-09-23 00:27 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-10-16 11:20 - 2013-09-23 00:27 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-10-16 11:20 - 2013-09-23 00:27 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-10-16 11:20 - 2013-09-23 00:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-10-16 11:20 - 2013-09-23 00:27 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-10-16 11:20 - 2013-09-23 00:27 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-10-16 11:20 - 2013-09-23 00:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-10-16 11:20 - 2013-09-22 23:55 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-10-16 11:20 - 2013-09-22 23:55 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-10-16 11:20 - 2013-09-22 23:55 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-10-16 11:20 - 2013-09-22 23:54 - 19252224 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-10-16 11:20 - 2013-09-22 23:54 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-10-16 11:20 - 2013-09-22 23:54 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-10-16 11:20 - 2013-09-22 23:54 - 02647552 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-10-16 11:20 - 2013-09-22 23:54 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-10-16 11:20 - 2013-09-22 23:54 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-10-16 11:20 - 2013-09-22 23:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-10-16 11:20 - 2013-09-22 23:54 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-10-16 11:20 - 2013-09-22 23:54 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-10-16 11:20 - 2013-09-22 23:54 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-10-16 11:20 - 2013-09-22 23:54 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-10-16 11:20 - 2013-09-21 04:38 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-10-16 11:20 - 2013-09-21 04:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-10-16 11:20 - 2013-09-21 03:48 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-10-16 11:20 - 2013-09-21 03:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
==================== One Month Modified Files and Folders =======
2013-11-14 22:09 - 2013-11-14 22:09 - 00024798 _____ C:\Users\Rene\Downloads\FRST.txt
2013-11-14 22:09 - 2013-11-14 22:09 - 00000000 ____D C:\FRST
2013-11-14 22:08 - 2013-11-14 22:08 - 01957794 _____ (Farbar) C:\Users\Rene\Downloads\FRST64.exe
2013-11-14 22:06 - 2013-10-10 17:33 - 01387453 _____ C:\Windows\WindowsUpdate.log
2013-11-14 22:05 - 2013-11-14 22:05 - 01090529 _____ (Farbar) C:\Users\Rene\Downloads\FRST.exe
2013-11-14 22:03 - 2010-10-13 22:36 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-11-14 22:02 - 2009-07-14 05:45 - 00017600 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-14 22:02 - 2009-07-14 05:45 - 00017600 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-14 21:57 - 2012-06-27 20:04 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-14 21:55 - 2010-11-25 23:02 - 00001116 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1350229881-1465274305-1763068460-1000UA.job
2013-11-14 21:47 - 2013-02-23 21:41 - 00000434 _____ C:\Windows\system32\Drivers\etc\hosts.ics
2013-11-14 21:47 - 2010-11-25 23:02 - 00001064 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1350229881-1465274305-1763068460-1000Core.job
2013-11-14 21:47 - 2010-06-20 15:23 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-14 21:47 - 2010-06-20 15:23 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-10-19 16:24 - 2010-07-01 20:07 - 00000000 ____D C:\Users\Rene\Desktop\seltene Symbole
2013-10-19 16:07 - 2013-05-06 20:38 - 00004100 _____ C:\Windows\System32\Tasks\Freemium1ClickMaint
2013-10-19 15:30 - 2013-05-06 20:36 - 00004208 _____ C:\Windows\System32\Tasks\Software Updater
2013-10-19 15:30 - 2013-05-06 20:36 - 00004130 _____ C:\Windows\System32\Tasks\Software Updater Ui
2013-10-19 13:14 - 2013-10-19 13:14 - 00000000 ____D C:\ProgramData\Acer
2013-10-19 13:14 - 2012-02-07 10:11 - 00000000 ____D C:\Users\Rene\AppData\Local\Deployment
2013-10-19 13:14 - 2012-02-07 10:11 - 00000000 ____D C:\Users\Rene\AppData\Local\Apps\2.0
2013-10-19 13:13 - 2013-10-10 18:11 - 00011382 _____ C:\Windows\PFRO.log
2013-10-19 13:13 - 2013-10-10 18:11 - 00000672 _____ C:\Windows\setupact.log
2013-10-19 13:13 - 2012-06-27 16:55 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-10-19 13:13 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-19 12:59 - 2013-10-19 12:59 - 00000000 ____D C:\Windows\ERUNT
2013-10-19 12:59 - 2013-10-19 12:58 - 00002408 _____ C:\DelFix.txt
2013-10-19 12:55 - 2013-10-19 12:55 - 00000000 ___SD C:\unistall.exe
2013-10-19 11:23 - 2009-07-14 03:34 - 00000215 _____ C:\Windows\system.ini
2013-10-19 10:36 - 2013-10-18 10:15 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-10-19 10:36 - 2010-06-20 15:04 - 00000000 ____D C:\Users\Rene\AppData\Local\Mozilla
2013-10-19 10:35 - 2013-07-09 21:01 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox.bak
2013-10-18 18:59 - 2010-11-25 23:06 - 00002363 _____ C:\Users\Rene\Desktop\Google Chrome.lnk
2013-10-18 15:00 - 2011-06-24 20:45 - 00000000 ____D C:\Users\Rene\AppData\Local\Samsung
2013-10-18 15:00 - 2010-11-10 18:44 - 00000000 ____D C:\Users\Rene\AppData\Roaming\Samsung
2013-10-18 15:00 - 2010-11-10 18:43 - 00000000 ____D C:\ProgramData\Samsung
2013-10-18 15:00 - 2010-11-10 18:43 - 00000000 ____D C:\Program Files (x86)\Samsung
2013-10-18 13:56 - 2010-02-11 03:03 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-10-18 13:51 - 2010-06-20 18:50 - 00000000 ____D C:\Users\Rene
2013-10-18 13:50 - 2010-11-25 23:02 - 00004084 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1350229881-1465274305-1763068460-1000UA
2013-10-18 13:50 - 2010-11-25 23:02 - 00003688 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1350229881-1465274305-1763068460-1000Core
2013-10-18 13:49 - 2011-10-07 20:31 - 00000000 ____D C:\Users\Rene\AppData\Roaming\DVDVideoSoft
2013-10-18 10:16 - 2013-10-18 09:41 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-10-18 09:59 - 2013-10-18 09:39 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-10-18 09:36 - 2013-10-18 09:35 - 12576792 _____ (Malwarebytes Corp.) C:\Users\Rene\Downloads\mbar-1.07.0.1007.exe
2013-10-18 09:22 - 2013-10-18 09:22 - 00000000 ____D C:\ProgramData\Oracle
2013-10-18 09:21 - 2013-10-18 09:20 - 00004886 _____ C:\Windows\SysWOW64\jupdate-1.7.0_45-b18.log
2013-10-18 09:21 - 2013-07-03 18:10 - 00000000 ____D C:\Program Files (x86)\Java
2013-10-18 09:00 - 2010-04-09 03:13 - 00654400 _____ C:\Windows\system32\perfh007.dat
2013-10-18 09:00 - 2010-04-09 03:13 - 00130240 _____ C:\Windows\system32\perfc007.dat
2013-10-18 09:00 - 2009-07-14 06:13 - 01498742 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-18 08:52 - 2009-07-14 05:45 - 00362800 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-18 08:44 - 2013-10-18 08:44 - 00985600 _____ C:\Users\Rene\Downloads\MicrosoftFixit50123.msi
2013-10-18 08:36 - 2009-07-14 06:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-10-18 08:34 - 2010-06-20 15:23 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-10-18 08:34 - 2010-06-20 15:23 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-10-18 07:53 - 2013-03-14 22:44 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-10-18 07:53 - 2013-03-14 22:44 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-10-16 14:12 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-10-16 11:23 - 2010-02-11 03:19 - 00000000 ____D C:\ProgramData\Microsoft Help
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-10-16 14:03
==================== End Of Log ============================
--- --- --- --- --- --- Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 14-11-2013
Ran by Rene at 2013-11-14 22:10:11
Running from C:\Users\Rene\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Kaspersky Internet Security (Enabled - Up to date) {2EAA32A5-1EE1-1B22-95DA-337730C6E984}
AS: Kaspersky Internet Security (Enabled - Up to date) {95CBD341-38DB-14AC-AF6A-08054B41A339}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security (Enabled) {1691B380-548E-1A7A-BE85-9A42CE15AEFF}
==================== Installed Programs ======================
Update for Microsoft Office 2007 (KB2508958) (x32)
64 Bit HP CIO Components Installer (Version: 7.2.8)
Acer Backup Manager (x32 Version: 2.0.0.58)
Acer Crystal Eye Webcam (x32 Version: 5.2.5.3)
Acer Crystal Eye webcam Ver:1.1.158.203 (x32 Version: 1.1.158.203)
Acer ePower Management (x32 Version: 5.00.3002)
Acer eRecovery Management (x32 Version: 4.05.3007)
Acer GameZone Console (x32 Version: 5.1.0.2)
Acer Registration (x32 Version: 1.02.3006)
Acer ScreenSaver (x32 Version: 1.1.0122.2010)
Acer Updater (x32 Version: 1.01.3017)
Acrobat.com (x32 Version: 1.6.65)
Adobe AIR (x32 Version: 1.5.0.7220)
Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.117)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.117)
Adobe Reader X (10.1.8) - Deutsch (x32 Version: 10.1.8)
Alcor Micro USB Card Reader (x32 Version: 1.5.17.05094)
Ashampoo Burning Studio 6 FREE v.6.80 (x32 Version: 6.8.0)
ATI Catalyst Install Manager (Version: 3.0.758.0)
AVM FRITZ!Box Druckeranschluss (x32)
Backup Manager Basic (x32 Version: 2.0.0.58)
Bluetooth Stack for Windows by Toshiba (Version: v7.00.11)
Bluetooth Win7 Suite (64) (Version: 7.01.000.18)
Broadcom Gigabit NetLink Controller (Version: 12.52.03)
BufferChm (x32 Version: 140.0.212.000)
Catalyst Control Center - Branding (x32 Version: 1.00.0000)
Catalyst Control Center Core Implementation (x32 Version: 2010.0122.858.16002)
Catalyst Control Center Graphics Full Existing (x32 Version: 2010.0122.858.16002)
Catalyst Control Center Graphics Full New (x32 Version: 2010.0122.858.16002)
Catalyst Control Center Graphics Light (x32 Version: 2010.0122.858.16002)
Catalyst Control Center Graphics Previews Vista (x32 Version: 2010.0122.858.16002)
Catalyst Control Center InstallProxy (x32 Version: 2010.0122.858.16002)
Catalyst Control Center Localization All (x32 Version: 2010.0122.858.16002)
CCC Help Chinese Standard (x32 Version: 2010.0122.0857.16002)
CCC Help Chinese Traditional (x32 Version: 2010.0122.0857.16002)
CCC Help Czech (x32 Version: 2010.0122.0857.16002)
CCC Help Danish (x32 Version: 2010.0122.0857.16002)
CCC Help Dutch (x32 Version: 2010.0122.0857.16002)
CCC Help English (x32 Version: 2010.0122.0857.16002)
CCC Help Finnish (x32 Version: 2010.0122.0857.16002)
CCC Help French (x32 Version: 2010.0122.0857.16002)
CCC Help German (x32 Version: 2010.0122.0857.16002)
CCC Help Greek (x32 Version: 2010.0122.0857.16002)
CCC Help Hungarian (x32 Version: 2010.0122.0857.16002)
CCC Help Italian (x32 Version: 2010.0122.0857.16002)
CCC Help Japanese (x32 Version: 2010.0122.0857.16002)
CCC Help Korean (x32 Version: 2010.0122.0857.16002)
CCC Help Norwegian (x32 Version: 2010.0122.0857.16002)
CCC Help Polish (x32 Version: 2010.0122.0857.16002)
CCC Help Portuguese (x32 Version: 2010.0122.0857.16002)
CCC Help Russian (x32 Version: 2010.0122.0857.16002)
CCC Help Spanish (x32 Version: 2010.0122.0857.16002)
CCC Help Swedish (x32 Version: 2010.0122.0857.16002)
CCC Help Thai (x32 Version: 2010.0122.0857.16002)
CCC Help Turkish (x32 Version: 2010.0122.0857.16002)
ccc-core-static (x32 Version: 2010.0122.858.16002)
ccc-utility64 (Version: 2010.0122.858.16002)
CDBurnerXP (Version: 4.3.8.2523)
Compatibility Pack für 2007 Office System (x32 Version: 12.0.6612.1000)
Copy (x32 Version: 140.0.212.000)
CyberLink PowerDVD 9 (x32 Version: 9.0.2529.50)
D3DX10 (x32 Version: 15.4.2368.0902)
Dairy Dash (x32)
Destinations (x32 Version: 140.0.77.000)
DeviceDiscovery (x32 Version: 140.0.212.000)
DivX-Setup (x32 Version: 2.6.1.3)
DJ_AIO_06_F4500_SW_MIN (x32 Version: 140.0.690.000)
Dream Day First Home (x32)
DriverAgent by eSupport.com
easyFly 4 Starter Edition (HKCU Version: 4.0.1.3)
eBay Worldwide (x32 Version: 2.1.0901)
Eraser 6.0.7.1893 (Version: 6.7.1893)
F4500 (x32 Version: 140.0.690.000)
Free System Utilities (x32 Version: 1.0.0.28)
Free SystemUtilities (x32 Version: 1.0.0.28)
FreePDF (Remove only) (x32)
FRITZ!Box USB-Fernanschluss (HKCU Version: 2.3.0.2)
Garmin Communicator Plugin (x32 Version: 4.0.4)
Garmin Communicator Plugin x64 (Version: 4.0.4)
Google Chrome (HKCU Version: 30.0.1599.101)
Google Earth (x32 Version: 5.2.1.1329)
Google Update Helper (x32 Version: 1.3.21.165)
GPBaseService2 (x32 Version: 140.0.211.000)
GPL Ghostscript 9.00 (x32)
HDVidCodec (x32 Version: 2.1 Build 26473)
Helium (x32 Version: 1.0.0)
Hewlett-Packard ACLM.NET v1.1.0.0 (x32 Version: 1.00.0000)
HP Customer Participation Program 14.0 (Version: 14.0)
HP Deskjet F4500 All-in-One Driver Software 14.0 Rel. 6 (Version: 14.0)
HP Imaging Device Functions 14.0 (Version: 14.0)
HP Product Detection (x32 Version: 11.14.0001)
HP Smart Web Printing 4.60 (Version: 4.60)
HP Solution Center 14.0 (Version: 14.0)
HP Update (x32 Version: 5.005.000.001)
HPDiagnosticAlert (x32 Version: 1.00.0000)
HPPhotoGadget (x32 Version: 140.0.524.000)
HPProductAssistant (x32 Version: 140.0.212.000)
HPSSupply (x32 Version: 140.0.211.000)
Identity Card (x32 Version: 1.00.3003)
Intel(R) Control Center (x32 Version: 1.2.1.1007)
Intel(R) Management Engine Components (x32 Version: 6.0.0.1179)
Intel(R) Rapid Storage Technology (x32 Version: 9.5.6.1001)
Java 7 Update 45 (x32 Version: 7.0.450)
Java Auto Updater (x32 Version: 2.1.9.8)
Junk Mail filter update (x32 Version: 15.4.3502.0922)
Kaspersky Internet Security 2012 (x32 Version: 12.0.0.374)
K-Lite Codec Pack 6.2.0 (Full) (x32 Version: 6.2.0)
Launch Manager (x32 Version: 4.0.4)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
MarketResearch (x32 Version: 140.0.212.000)
MediaMonkey 4.0 (x32 Version: 4.0)
Merriam Websters Spell Jam (x32)
Mesh Runtime (x32 Version: 15.4.5722.2)
Messenger Companion (x32 Version: 15.4.3502.0922)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30320)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Office 2007 Service Pack 3 (SP3) (x32)
Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Excel MUI (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003)
Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Home and Student 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Language Pack 2007 - German/Deutsch (x32 Version: 12.0.6612.1000)
Microsoft Office Live Add-in 1.5 (x32 Version: 2.0.4024.1)
Microsoft Office O MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000)
Microsoft Office OneNote MUI (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office PowerPoint Viewer 2007 (German) (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (Spanish) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proofing (English) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32)
Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Shared 64-bit MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office SharePoint Designer 2007 Service Pack 3 (SP3) (x32)
Microsoft Office SharePoint Designer MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Suite Activation Assistant (x32 Version: 2.9)
Microsoft Office Word MUI (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office X MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Silverlight (Version: 5.1.20913.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (x32 Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Works (x32 Version: 9.7.0621)
Microsoft WSE 3.0 Runtime (x32 Version: 3.0.5305.0)
Mozilla Firefox 24.0 (x86 de) (x32 Version: 24.0)
Mozilla Maintenance Service (x32 Version: 24.0)
MSVC80_x64_v2 (Version: 1.0.3.0)
MSVC80_x86_v2 (x32 Version: 1.0.3.0)
MSVC90_x64 (Version: 1.0.1.2)
MSVC90_x86 (x32 Version: 1.0.1.2)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT_amd64 (x32 Version: 15.4.2862.0708)
MSXML 4.0 SP3 Parser (KB2721691) (x32 Version: 4.30.2114.0)
MSXML 4.0 SP3 Parser (KB2758694) (x32 Version: 4.30.2117.0)
MSXML 4.0 SP3 Parser (KB973685) (x32 Version: 4.30.2107.0)
MyWinLocker (x32 Version: 3.1.103.0)
NAVIGON Fresh 3.4.1 (x32 Version: 3.4.1)
neroxml (x32 Version: 1.0.0)
Network64 (Version: 140.0.215.000)
Network64 (Version: 140.0.221.000)
Netzmanager (Version: 1.071)
Netzmanager (x32 Version: 1.071)
Norton Online Backup (x32 Version: 1.2.0.36)
NTI Backup Now 5 (x32 Version: 5.1.2.628)
NTI Backup Now Standard (x32 Version: 5.1.2.628)
NTI Media Maker 8 (x32 Version: 8.0.12.6630)
OpenOffice.org 3.4.1 (x32 Version: 3.41.9593)
PC Connectivity Solution (x32 Version: 10.33.1.0)
Personal Backup 5.3 (x32 Version: 5.3)
Picasa 3 (x32 Version: 3.8)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6662)
RedMon - Redirection Port Monitor
Revo Uninstaller 1.94 (x32 Version: 1.94)
SAMSUNG USB Driver for Mobile Phones (Version: 1.4.4.0)
Scan (x32 Version: 140.0.80.000)
Shop for HP Supplies (Version: 14.0)
Skype Toolbars (x32 Version: 1.0.4051)
Skype™ 5.10 (x32 Version: 5.10.116)
SmartWebPrinting (x32 Version: 140.0.186.000)
SolutionCenter (x32 Version: 140.0.213.000)
Spybot - Search & Destroy (x32 Version: 2.1.19)
Status (x32 Version: 140.0.212.000)
Synaptics Pointing Device Driver (Version: 14.0.6.0)
TeamViewer 6 (x32 Version: 6.0.13992)
Toolbox (x32 Version: 140.0.428.000)
TrayApp (x32 Version: 140.0.212.000)
TVCenter (Version: 6.4.1.858)
Update for 2007 Microsoft Office System (KB967642) (x32)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
Update for Microsoft Office 2007 Help for Common Features (KB963673) (x32)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32)
Update for Microsoft Office Excel 2007 Help (KB963678) (x32)
Update for Microsoft Office OneNote 2007 Help (KB963670) (x32)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (x32)
Update for Microsoft Office Powerpoint 2007 Help (KB963669) (x32)
Update for Microsoft Office Script Editor Help (KB963671) (x32)
Update for Microsoft Office Word 2007 Help (KB963665) (x32)
Update für Microsoft Office Excel 2007 Help (KB963678) (x32)
Update für Microsoft Office Outlook 2007 Help (KB963677) (x32)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (x32)
Update für Microsoft Office Word 2007 Help (KB963665) (x32)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0)
VLC media player 1.0.5 (x32 Version: 1.0.5)
VLC media player 2.0.2 (Version: 2.0.2)
WebReg (x32 Version: 140.0.212.017)
Welcome Center (x32 Version: 1.00.3012)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3502.0922)
Windows Live Family Safety (Version: 15.4.3502.0922)
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0)
Windows Live Installer (x32 Version: 15.4.3502.0922)
Windows Live Language Selector (Version: 15.4.3502.0922)
Windows Live Mail (x32 Version: 15.4.3502.0922)
Windows Live Mesh (x32 Version: 15.4.3502.0922)
Windows Live Mesh ActiveX control for remote connections (x32 Version: 15.4.5722.2)
Windows Live Messenger (x32 Version: 15.4.3502.0922)
Windows Live Messenger Companion Core (x32 Version: 15.4.3502.0922)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (x32 Version: 15.4.3502.0922)
Windows Live Photo Common (x32 Version: 15.4.3502.0922)
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922)
Windows Live PIMT Platform (x32 Version: 15.4.3502.0922)
Windows Live Remote Client (Version: 15.4.5722.2)
Windows Live Remote Client Resources (Version: 15.4.5722.2)
Windows Live Remote Service (Version: 15.4.5722.2)
Windows Live Remote Service Resources (Version: 15.4.5722.2)
Windows Live SOXE (x32 Version: 15.4.3502.0922)
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922)
Windows Live Sync (x32 Version: 14.0.8089.726)
Windows Live UX Platform (x32 Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (x32 Version: 15.4.3502.0922)
Windows Live Writer (x32 Version: 15.4.3502.0922)
Windows Live Writer Resources (x32 Version: 15.4.3502.0922)
Windows Media Player Firefox Plugin (x32 Version: 1.0.0.8)
Windows-Treiberpaket - Nokia pccsmcfd (08/22/2008 7.0.0.0) (Version: 08/22/2008 7.0.0.0)
WinRAR
Zattoo4 4.0.5 (x32 Version: 4.0.5)
==================== Restore Points =========================
==================== Hosts content: ==========================
2009-07-14 03:34 - 2013-10-19 10:29 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
Task: {2C43D7F1-E8E1-423C-A956-0C081B490BA6} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-06-20] (Google Inc.)
Task: {32A29844-9BD2-46D3-9B14-F132EA0B7F88} - System32\Tasks\{BF109B09-49C9-448E-ABB0-A86134FBB567} => C:\Program Files (x86)\Skype\Phone\Skype.exe [2012-07-13] (Skype Technologies S.A.)
Task: {3BE62253-4312-43BF-874B-CB4CD25AEFD7} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-06-20] (Google Inc.)
Task: {47835EFB-4E6C-4908-80B0-8479A6E2CA0C} - System32\Tasks\Software Updater => C:\Program Files (x86)\SoftwareUpdater\SoftwareUpdater.Bootstrapper.exe [2013-07-09] ()
Task: {5551CC9F-EBAA-4BC3-A0A1-6140B6F8C299} - System32\Tasks\Software Updater Ui => C:\Program Files (x86)\SoftwareUpdater\SoftwareUpdater.Ui.exe [2013-09-19] ()
Task: {6C132CC4-91A0-4441-8452-059AAF27CB46} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe
Task: {73C9FF26-8F45-44F5-A369-6B6B2FB51A79} - System32\Tasks\{631A522C-7A50-4186-9AD5-AE0B705C82CD} => Iexplore.exe hxxp://ui.skype.com/ui/0/5.10.0.116/de/go/help.faq.installer?LastError=1603
Task: {92C91A35-BCB4-4FCC-BD1B-CDCDB7EF3768} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-10] (Adobe Systems Incorporated)
Task: {93191DB2-489D-47AE-ABFD-028CB62708BB} - System32\Tasks\Recovery Management\Burn Notification => C:\Program Files\Acer\Acer eRecovery Management\NotificationCenter\Notification.exe [2009-11-03] (Acer)
Task: {9B3A3465-4C71-4811-898D-5D70B685594C} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1350229881-1465274305-1763068460-1000UA => C:\Users\Rene\AppData\Local\Google\Update\GoogleUpdate.exe [2010-10-15] (Google Inc.)
Task: {B52CD3DF-B3C5-42EC-96A4-B64753A3AE6B} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe
Task: {B7DB672C-345B-49AE-8957-F72BFF54967A} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe
Task: {B8448AA1-6F25-48B3-9ACF-FD652B286227} - System32\Tasks\Freemium1ClickMaint => C:\Users\Rene\Downloads\1Click.exe
Task: {E2004075-FB28-45A9-A927-48AAC6AF3F2B} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1350229881-1465274305-1763068460-1000Core => C:\Users\Rene\AppData\Local\Google\Update\GoogleUpdate.exe [2010-10-15] (Google Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1350229881-1465274305-1763068460-1000Core.job => C:\Users\Rene\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1350229881-1465274305-1763068460-1000UA.job => C:\Users\Rene\AppData\Local\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2010-06-20 18:53 - 2010-03-15 10:28 - 00166400 _____ () C:\Program Files\WinRAR\rarext.dll
2008-11-12 03:16 - 2008-11-12 03:16 - 01401856 _____ () C:\Program Files (x86)\EgisTec MyWinLocker\x64\libeay32.dll
2010-01-07 13:42 - 2010-01-07 13:42 - 00016384 ____R () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2010-04-08 17:24 - 2010-04-08 17:24 - 00270336 _____ () C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2010-01-07 02:46 - 2010-01-07 02:46 - 00465576 _____ () C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\sqlite3.dll
2010-01-07 02:43 - 2010-01-07 02:43 - 01081600 _____ () C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\ACE.dll
2010-02-11 03:37 - 2009-12-24 02:32 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2013-10-10 17:24 - 2013-05-16 09:55 - 00113496 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2013-10-10 17:24 - 2013-05-16 09:55 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2013-10-10 17:24 - 2013-05-16 09:55 - 00161112 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2013-10-10 17:24 - 2012-08-23 09:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2013-10-10 17:24 - 2012-04-03 16:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2011-04-24 22:13 - 2011-04-24 22:13 - 02118032 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\QtCore4.dll
2011-04-24 22:13 - 2011-04-24 22:13 - 07008656 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\QtGui4.dll
2011-04-24 22:13 - 2011-04-24 22:13 - 02089360 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\QtDeclarative4.dll
2011-04-24 22:13 - 2011-04-24 22:13 - 01270160 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\QtScript4.dll
2011-04-24 22:13 - 2011-04-24 22:13 - 00192912 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\QtSql4.dll
2011-04-24 22:13 - 2011-04-24 22:13 - 00758160 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\QtNetwork4.dll
2011-04-20 18:56 - 2011-04-20 18:56 - 00025088 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\imageformats\qgif4.dll
2013-10-18 10:15 - 2013-10-18 10:15 - 03279768 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2013-10-10 18:58 - 2013-10-10 18:58 - 16233864 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\ProgramData\Temp:0B9176C0
AlternateDataStreams: C:\ProgramData\Temp:AB689DEA
==================== Safe Mode (whitelisted) ===================
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service"
==================== Faulty Device Manager Devices =============
Name: Atheros AR5B93 Wireless Network Adapter
Description: Atheros AR5B93 Wireless Network Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Atheros Communications Inc.
Service: athr
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: Deskjet F4500 series
Description: Deskjet F4500 series
Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}
Manufacturer: HP
Service:
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: Deskjet F4500 series
Description: Deskjet F4500 series
Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
Manufacturer: HP
Service: StillCam
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (10/19/2013 01:14:22 PM) (Source: SecurityCenter) (User: )
Description: Das Windows-Sicherheitscenter konnte keine Ereignisabfragen mit der WMI herstellen, um Antiviren, AntiSpyware- und Firewallprogramme von Drittanbietern zu überwachen.
Error: (10/19/2013 10:33:08 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: UpdaterService.exe, Version: 1.0.0.6, Zeitstempel: 0x4a4de121
Name des fehlerhaften Moduls: UpdaterService.exe, Version: 1.0.0.6, Zeitstempel: 0x4a4de121
Ausnahmecode: 0xc0000417
Fehleroffset: 0x00011f0f
ID des fehlerhaften Prozesses: 0x96c
Startzeit der fehlerhaften Anwendung: 0xUpdaterService.exe0
Pfad der fehlerhaften Anwendung: UpdaterService.exe1
Pfad des fehlerhaften Moduls: UpdaterService.exe2
Berichtskennung: UpdaterService.exe3
Error: (10/19/2013 09:43:38 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (10/18/2013 11:32:35 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.
Error: (10/18/2013 02:30:11 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.
Error: (10/18/2013 01:45:46 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (10/18/2013 11:09:26 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (10/18/2013 11:09:20 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (10/18/2013 09:13:13 AM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - Failed to compile: System.Web.Routing, Version=3.5.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil . Error code = 0x80070005
Error: (10/18/2013 09:13:11 AM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - Failed to compile: System.Web.Entity, Version=3.5.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil . Error code = 0x80070005
System errors:
=============
Error: (11/14/2013 10:09:22 PM) (Source: ipnathlp) (User: )
Description: 0
Error: (11/14/2013 10:03:04 PM) (Source: ipnathlp) (User: )
Description: 0
Error: (11/14/2013 10:01:47 PM) (Source: ipnathlp) (User: )
Description: 0
Error: (11/14/2013 09:58:05 PM) (Source: ipnathlp) (User: )
Description: 0
Error: (11/14/2013 09:54:20 PM) (Source: ipnathlp) (User: )
Description: 0
Error: (11/14/2013 09:49:15 PM) (Source: ipnathlp) (User: )
Description: 0
Error: (11/14/2013 09:47:52 PM) (Source: WMPNetworkSvc) (User: )
Description: WMPNetworkSvc0x80004002
Error: (11/14/2013 09:47:50 PM) (Source: WMPNetworkSvc) (User: )
Description: WMPNetworkSvc0x80004002
Error: (11/14/2013 09:47:44 PM) (Source: ipnathlp) (User: )
Description: 192.168.178.37192.168.137.0255.255.255.0
Error: (10/19/2013 05:28:19 PM) (Source: ipnathlp) (User: )
Description: 0
Microsoft Office Sessions:
=========================
CodeIntegrity Errors:
===================================
Date: 2013-10-19 11:29:07.684
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-10-19 11:29:07.497
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-10-19 11:29:07.309
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-10-19 11:29:07.122
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-10-16 12:20:34.408
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-10-16 12:20:34.143
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-10-16 12:20:33.847
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-10-16 12:20:33.597
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-10-10 18:55:00.221
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-10-10 18:54:59.971
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Percentage of memory in use: 70%
Total physical RAM: 3956.5 MB
Available physical RAM: 1172.04 MB
Total Pagefile: 7911.19 MB
Available Pagefile: 4490.42 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB
==================== Drives ================================
Drive c: (ACER) (Fixed) (Total:286.27 GB) (Free:50.31 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 298 GB) (Disk ID: F0CCF0CC)
Partition 1: (Not Active) - (Size=12 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=286 GB) - (Type=07 NTFS)
==================== End Of Log ============================
|
|
15.11.2013, 18:37
| #11 |
| /// the machine /// TB-Ausbilder | Wichtige Sicherheitswarnung zu Ihrem Internetanschluss Abuse T-Online Downloade Dir bitte AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
15.11.2013, 19:46
| #12 |
| | Wichtige Sicherheitswarnung zu Ihrem Internetanschluss Abuse T-Online Hallo Schrauber. Hier bitte das Log vom AdwCleaner. Gruß regro Code:
ATTFilter # AdwCleaner v3.012 - Bericht erstellt am 15/11/2013 um 19:20:13
# Updated 11/11/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Rene - ACER
# Gestartet von : C:\Users\Rene\Downloads\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
[#] Dienst Gelöscht : SystemStoreService
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\boost_interprocess
Ordner Gelöscht : C:\ProgramData\ICQ\ICQToolbar
Ordner Gelöscht : C:\ProgramData\Partner
Ordner Gelöscht : C:\Program Files (x86)\HDvidCodec.com
Ordner Gelöscht : C:\Program Files (x86)\Iminent
Ordner Gelöscht : C:\Program Files (x86)\myfree codec
Ordner Gelöscht : C:\Program Files (x86)\SoftwareUpdater
Ordner Gelöscht : C:\Users\Rene\AppData\Local\eSupport.com
Ordner Gelöscht : C:\Users\Rene\AppData\Local\PackageAware
Ordner Gelöscht : C:\Users\Rene\AppData\Local\Temp\boost_interprocess
Ordner Gelöscht : C:\Users\Rene\AppData\LocalLow\boost_interprocess
Ordner Gelöscht : C:\Users\Rene\AppData\LocalLow\Delta
Ordner Gelöscht : C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\0z0tuhtq.default\Conduit
Ordner Gelöscht : C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\0z0tuhtq.default\ConduitEngine
Ordner Gelöscht : C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\0z0tuhtq.default\ICQToolbarData
Ordner Gelöscht : C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\0z0tuhtq.default\SweetIMToolbarData
Ordner Gelöscht : C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\0z0tuhtq.default\CT2269050
Ordner Gelöscht : C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\0z0tuhtq.default\Extensions\{800B5000-A755-47E1-992B-48A1C1357F07}
Ordner Gelöscht : C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\0z0tuhtq.default\Extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
Ordner Gelöscht : C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\blaofbhgbmeikidhlkmjhbkbfohpgekf
Ordner Gelöscht : C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlfienamagdnkekbbbocojppncdambda
Datei Gelöscht : C:\Users\Public\Desktop\eBay.lnk
Datei Gelöscht : C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\0z0tuhtq.default\invalidprefs.js
Datei Gelöscht : C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\0z0tuhtq.default\searchplugins\Web Search.xml
Datei Gelöscht : C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\0z0tuhtq.default\user.js
Datei Gelöscht : C:\Windows\System32\Tasks\Software Updater Ui
Datei Gelöscht : C:\Windows\System32\Tasks\Software Updater
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\blaofbhgbmeikidhlkmjhbkbfohpgekf
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\ICQ\ICQToolBar
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\driverscanner
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskInstallChecker_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskInstallChecker_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BingBar_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\driverscanner_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\driverscanner_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\sweetim_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\sweetim_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\sweetimsetup_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\sweetimsetup_rasmancs
Schlüssel Gelöscht : HKCU\Software\5b0dadcb669ea41
Schlüssel Gelöscht : HKLM\SOFTWARE\5b0dadcb669ea41
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader16053_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader16053_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader25726_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader25726_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader65368_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader65368_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_cdburnerxp-pro_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_cdburnerxp-pro_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{02054E11-5113-4BE3-8153-AA8DFB5D3761}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{2BF2028E-3F3C-4C05-AB45-B2F1DCFE0759}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{8F5F1CB6-EA9E-40AF-A5CA-C7FD63CC1971}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{DB538320-D3C5-433C-BCA9-C4081A054FCF}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Schlüssel Gelöscht : HKCU\Software\Ciuvo
Schlüssel Gelöscht : HKCU\Software\Iminent
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\UpdateStar
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKLM\Software\Bandoo
Schlüssel Gelöscht : HKLM\Software\DataMngr
Schlüssel Gelöscht : HKLM\Software\ICQ\ICQToolbar
Schlüssel Gelöscht : HKLM\Software\Iminent
Schlüssel Gelöscht : HKLM\Software\Uniblue
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\1ClickDownload
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchTheWebARP
***** [ Browser ] *****
-\\ Internet Explorer v10.0.9200.16736
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\SearchUrl [Default]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchUrl [Default]
-\\ Mozilla Firefox v25.0 (de)
[ Datei : C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\0z0tuhtq.default\prefs.js ]
Zeile gelöscht : user_pref("extensions.delta.admin", false);
Zeile gelöscht : user_pref("extensions.delta.aflt", "babsst");
Zeile gelöscht : user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");
Zeile gelöscht : user_pref("extensions.delta.autoRvrt", "false");
Zeile gelöscht : user_pref("extensions.delta.dfltLng", "en");
Zeile gelöscht : user_pref("extensions.delta.excTlbr", false);
Zeile gelöscht : user_pref("extensions.delta.id", "06452e60000000000000f07bcb8478a4");
Zeile gelöscht : user_pref("extensions.delta.instlDay", "15760");
Zeile gelöscht : user_pref("extensions.delta.instlRef", "sst");
Zeile gelöscht : user_pref("extensions.delta.newTab", false);
Zeile gelöscht : user_pref("extensions.delta.prdct", "delta");
Zeile gelöscht : user_pref("extensions.delta.prtnrId", "delta");
Zeile gelöscht : user_pref("extensions.delta.rvrt", "false");
Zeile gelöscht : user_pref("extensions.delta.smplGrp", "none");
Zeile gelöscht : user_pref("extensions.delta.tlbrId", "base");
Zeile gelöscht : user_pref("extensions.delta.tlbrSrchUrl", "");
Zeile gelöscht : user_pref("extensions.delta.vrsn", "1.8.10.0");
Zeile gelöscht : user_pref("extensions.delta.vrsnTs", "1.8.10.011:57:16");
Zeile gelöscht : user_pref("extensions.delta.vrsni", "1.8.10.0");
Zeile gelöscht : user_pref("iminent.webbooster.scripts.minibar.ROOTEXTENSION", "chrome://iminentwebbooster/content/minibar");
Zeile gelöscht : user_pref("iminent.webbooster.scripts.minibar.Services.BHPCode", "01");
Zeile gelöscht : user_pref("iminent.webbooster.scripts.minibar.Services.DefaultEvent", "000");
Zeile gelöscht : user_pref("iminent.webbooster.scripts.minibar.Services.DefaultWebSite", "000");
Zeile gelöscht : user_pref("iminent.webbooster.scripts.minibar.Services.IminentClientCode", "11");
Zeile gelöscht : user_pref("iminent.webbooster.scripts.minibar.Services.SmartFavCode", "02");
Zeile gelöscht : user_pref("iminent.webbooster.scripts.minibar.ShowThankyouPixel", "0");
Zeile gelöscht : user_pref("iminent.webbooster.scripts.minibar.displayFavLinks", "0");
Zeile gelöscht : user_pref("iminent.webbooster.scripts.minibar.registerToolbarEvent140", "1372788200920");
Zeile gelöscht : user_pref("iminent.webbooster.scripts.sslminibar.ROOTEXTENSION", "chrome://iminentwebbooster/content/minibar");
Zeile gelöscht : user_pref("iminent.webbooster.scripts.sslminibar.Services.BHPCode", "01");
Zeile gelöscht : user_pref("iminent.webbooster.scripts.sslminibar.Services.DefaultEvent", "000");
Zeile gelöscht : user_pref("iminent.webbooster.scripts.sslminibar.Services.DefaultWebSite", "000");
Zeile gelöscht : user_pref("iminent.webbooster.scripts.sslminibar.Services.IminentClientCode", "11");
Zeile gelöscht : user_pref("iminent.webbooster.scripts.sslminibar.Services.SmartFavCode", "02");
Zeile gelöscht : user_pref("iminent.webbooster.scripts.sslminibar.ShowThankyouPixel", "0");
Zeile gelöscht : user_pref("iminent.webbooster.scripts.sslminibar.displayFavLinks", "1");
Zeile gelöscht : user_pref("iminent.webbooster.scripts.sslminibar.registerToolbarEvent140", "1372788584402");
*************************
AdwCleaner[R0].txt - [20120 octets] - [15/11/2013 19:18:40]
AdwCleaner[S0].txt - [18925 octets] - [15/11/2013 19:20:13]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [18986 octets] ##########
Gruß regro FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 14-11-2013
Ran by Rene (administrator) on ACER on 15-11-2013 19:43:07
Running from C:\Users\Rene\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\system32\atiesrxx.exe
(SurfRight B.V.) C:\Program Files\HitmanPro\hmpsched.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\adminservice.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Deutsche Telekom AG) C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe
(Alcor Micro Corp.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
() C:\Windows\PLFSetI.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version6\TeamViewer.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [AmIcoSinglun64] - C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [323584 2009-09-23] (Alcor Micro Corp.)
HKLM\...\Run: [mwlDaemon] - C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe [349480 2009-12-02] (Egis Technology Inc.)
HKLM\...\Run: [PLFSetI] - C:\Windows\PLFSetI.exe [200704 2008-07-29] ()
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1842472 2009-09-18] (Synaptics Incorporated)
HKLM\...\Run: [Acer ePower Management] - C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [860192 2010-02-05] (Acer Incorporated)
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)
Winlogon\Notify\klogon: C:\Windows\System32\klogon.dll (Kaspersky Lab ZAO)
HKCU\...\Run: [AVMUSBFernanschluss] - C:\Users\Rene\AppData\Local\Apps\2.0\MPQAEAVC.5G0\E9285KBK.NT7\frit..tion_8488884cfbcefd60_0002.0003_f406d43803d5433d\AVMAutoStart.exe [139264 2013-04-04] (AVM Berlin)
HKCU\...\Run: [Spybot-S&D Cleaning] - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe [3642312 2013-05-16] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2009-12-24] (Intel Corporation)
HKLM-x32\...\Run: [BackupManagerTray] - C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [265984 2010-01-13] (NewTech Infosystems, Inc.)
HKLM-x32\...\Run: [NortonOnlineBackupReminder] - C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe [588648 2009-07-25] (Symantec Corporation)
HKLM-x32\...\Run: [EgisUpdate] - C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe [200488 2009-10-23] (Egis Technology Inc.)
HKLM-x32\...\Run: [EgisTecPMMUpdate] - C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe [401192 2009-10-23] (Egis Technology Inc.)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-01-22] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [AVP] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe [206448 2012-12-06] (Kaspersky Lab ZAO)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: [SDTray] - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [3830224 2013-05-16] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKU\Default User\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [154144 2010-01-15] ()
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://navigon.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
BHO: No Name - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - No File
BHO: IEVkbdBHO Class - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\x64\ievkbd.dll (Kaspersky Lab ZAO)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: FilterBHO Class - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\x64\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\smart web printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: No Name - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - No File
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: IEVkbdBHO Class - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ievkbd.dll (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: FilterBHO Class - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\smart web printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM-x32 - No Name - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKCU - No Name - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - No File
Handler: ftp - No CLSID Value -
Handler: https - No CLSID Value -
Handler-x32: ftp - No CLSID Value -
Handler-x32: https - No CLSID Value -
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\0z0tuhtq.default
FF DefaultSearchEngine: Google
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.t-online.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_152.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.2 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_152.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @garmin.com/GpsControl - C:\Program Files (x86)\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Rene\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Rene\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\0z0tuhtq.default\searchplugins\searchplugins-backup
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: FRITZ!Box AddOn - C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\0z0tuhtq.default\Extensions\fb_add_on@avm.de
FF Extension: Telekom Toolbar 3.0 - C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\0z0tuhtq.default\Extensions\totbff01@telekom.de
FF Extension: ciuvo-extension - C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\0z0tuhtq.default\Extensions\ciuvo-extension@icq.de.xpi
FF Extension: toolbar - C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\0z0tuhtq.default\Extensions\toolbar@gmx.net.xpi
FF Extension: ImTranslator - C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\0z0tuhtq.default\Extensions\{9AA46F4F-4DC7-4c06-97AF-5035170634FE}.xpi
FF Extension: No Name - C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\0z0tuhtq.default\Extensions\{D249FD00-4DF9-11D9-9FDC-0080481ADA61}.xpi
FF Extension: Anti-Banner - C:\Program Files (x86)\Mozilla Firefox\extensions\KavAntiBanner@kaspersky.ru_bak2
FF Extension: Modul zur Link-Untersuchung - C:\Program Files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak2
FF Extension: Skype extension for Firefox - C:\Program Files (x86)\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF HKLM-x32\...\Firefox\Extensions: [virtualKeyboard@kaspersky.ru] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\virtualKeyboard@kaspersky.ru
FF Extension: Kaspersky Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\virtualKeyboard@kaspersky.ru
FF HKLM-x32\...\Firefox\Extensions: [linkfilter@kaspersky.ru] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\linkfilter@kaspersky.ru
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\linkfilter@kaspersky.ru
FF HKLM-x32\...\Firefox\Extensions: [KavAntiBanner@Kaspersky.ru] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\KavAntiBanner@Kaspersky.ru
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\KavAntiBanner@Kaspersky.ru
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (YouTube) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (GMX MailCheck) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\camnampocfohlcgbajligmemmabnljcm\1.1_0
CHR Extension: (Google Search) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Kaspersky URL Advisor) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.0.477_0
CHR Extension: (Virtual Keyboard) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\12.0.0.477_0
CHR Extension: (DVDVideoSoft Browser Extension) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0
CHR Extension: (DivX Plus Web Player HTML5 \u003Cvideo\u003E) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0
CHR Extension: (Gmail) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1
CHR Extension: (Anti-Banner) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\12.0.0.374_0
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ChromeExt\urladvisor.crx
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ChromeExt\virtkbd.crx
CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx
CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ChromeExt\ab.crx
==================== Services (Whitelisted) =================
R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe [206448 2012-12-06] (Kaspersky Lab ZAO)
R2 HitmanProScheduler; C:\Program Files\HitmanPro\hmpsched.exe [109352 2013-11-15] (SurfRight B.V.)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 McComponentHostService; C:\Program Files (x86)\McAfee Security Scan\3.0.285\McCHSvc.exe [234776 2012-09-05] (McAfee, Inc.)
R2 MWLService; C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [305448 2009-12-02] (Egis Technology Inc.)
R2 Netzmanager Service; C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe [2635776 2012-07-20] (Deutsche Telekom AG)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1817560 2013-05-16] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1033688 2013-05-16] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2013-05-15] (Safer-Networking Ltd.)
S3 ServiceLayer; "C:\Program Files (x86)\Nokia\PC Connectivity Solution\ServiceLayer.exe" [x]
==================== Drivers (Whitelisted) ====================
S3 AbilisT; C:\Windows\System32\Drivers\AbilisBdaTuner.sys [128264 2010-03-18] (ABILIS Systems)
R3 avmaudio; C:\Windows\System32\DRIVERS\avmaudio.sys [116480 2013-04-04] (AVM Berlin)
R3 avmaura; C:\Windows\System32\DRIVERS\avmaura.sys [116480 2013-04-04] (AVM Berlin)
R3 azvusb; C:\Windows\System32\DRIVERS\azvusb.sys [54784 2009-08-24] (AzureWave Technologies, Inc.)
S3 dgderdrv; C:\Windows\System32\drivers\dgderdrv.sys [20568 2010-05-25] (Devguru Co., Ltd)
R0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [460888 2011-03-04] (Kaspersky Lab ZAO)
R1 kl2; C:\Windows\System32\DRIVERS\kl2.sys [11864 2011-03-04] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [637272 2012-12-06] (Kaspersky Lab)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [29488 2011-03-10] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [22544 2009-11-02] (Kaspersky Lab)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R1 MPFP; C:\Windows\System32\Drivers\Mpfp.sys [176144 2009-04-09] (McAfee, Inc.)
S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
S3 TelekomNM6; C:\Program Files\Netzmanager\NMInfraIS2\Driver\TelekomNM6.sys [45664 2010-09-16] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH)
R2 {B154377D-700F-42cc-9474-23858FBDF4BD}; c:\Program Files (x86)\CyberLink\PowerDVD9\000.fcl [146928 2010-01-22] (CyberLink Corp.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-11-15 19:42 - 2013-11-15 19:42 - 00001366 _____ C:\Users\Rene\Desktop\JRT.txt
2013-11-15 19:30 - 2013-11-15 19:30 - 01034531 _____ (Thisisu) C:\Users\Rene\Downloads\JRT.exe
2013-11-15 19:18 - 2013-11-15 19:20 - 00000000 ____D C:\AdwCleaner
2013-11-15 19:12 - 2013-11-15 19:12 - 01085542 _____ C:\Users\Rene\Downloads\adwcleaner.exe
2013-11-15 17:47 - 2013-11-15 17:47 - 00000000 ____D C:\Users\Rene\AppData\Local\Software_Updater
2013-11-15 17:46 - 2013-11-15 17:46 - 00000000 ____D C:\Users\Rene\Documents\Fritz!Box Telefonbuch
2013-11-15 10:15 - 2013-11-15 10:15 - 00314149 _____ C:\Users\Rene\Desktop\TeamSpybot-20131115-101524.cab
2013-11-15 09:26 - 2013-11-15 09:26 - 00001913 _____ C:\Users\Public\Desktop\HitmanPro.lnk
2013-11-15 09:26 - 2013-11-15 09:26 - 00000000 ____D C:\Program Files\HitmanPro
2013-11-15 09:24 - 2013-11-15 09:35 - 00000000 ____D C:\ProgramData\HitmanPro
2013-11-15 09:24 - 2013-11-15 09:25 - 10264904 _____ (SurfRight B.V.) C:\Users\Rene\Downloads\HitmanPro_x64.exe
2013-11-15 09:23 - 2013-11-15 09:24 - 09452704 _____ (SurfRight B.V.) C:\Users\Rene\Downloads\nw_14374_hitmanproexe.exe
2013-11-15 08:41 - 2013-11-15 08:43 - 23513920 _____ (Mozilla) C:\Users\Rene\Downloads\GMX_Firefox_Setup(3).exe
2013-11-15 08:33 - 2013-10-19 10:29 - 00000027 _____ C:\Windows\system32\Drivers\etc\hosts.20131115-083333.backup
2013-11-15 08:27 - 2013-11-15 08:27 - 00002174 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2013-11-15 08:27 - 2013-11-15 08:27 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2013-11-15 08:27 - 2013-11-15 08:27 - 00000000 ____D C:\ProgramData\McAfee
2013-11-15 08:27 - 2013-11-15 08:27 - 00000000 ____D C:\Program Files (x86)\McAfee Security Scan
2013-11-15 07:44 - 2013-10-12 09:45 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-15 07:44 - 2013-10-12 09:43 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-15 07:44 - 2013-10-12 09:43 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-15 07:44 - 2013-10-12 09:43 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-15 07:44 - 2013-10-12 09:43 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-15 07:44 - 2013-10-12 09:43 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-15 07:44 - 2013-10-12 09:43 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-15 07:44 - 2013-10-12 09:43 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-15 07:44 - 2013-10-12 09:43 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-15 07:44 - 2013-10-12 08:03 - 01138176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-11-15 07:44 - 2013-10-12 08:02 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-15 07:44 - 2013-10-12 08:02 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-15 07:44 - 2013-10-12 08:02 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-11-15 07:44 - 2013-10-12 08:02 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-11-15 07:44 - 2013-10-12 08:02 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-11-15 07:44 - 2013-10-12 08:02 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-11-15 07:44 - 2013-10-12 08:02 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-11-15 07:44 - 2013-10-12 08:02 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-11-15 07:44 - 2013-10-12 07:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-15 07:44 - 2013-10-12 07:08 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-11-15 07:44 - 2013-10-12 06:44 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-15 07:44 - 2013-10-12 06:15 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-11-15 07:43 - 2013-10-12 09:45 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-15 07:43 - 2013-10-12 09:45 - 01364992 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-15 07:43 - 2013-10-12 09:43 - 19269632 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-15 07:43 - 2013-10-12 09:43 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-15 07:43 - 2013-10-12 09:43 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-15 07:43 - 2013-10-12 08:03 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-15 07:43 - 2013-10-12 08:02 - 14355968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-15 07:43 - 2013-10-12 08:02 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-15 07:43 - 2013-10-12 08:02 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-11-14 22:17 - 2013-11-14 22:17 - 00037805 _____ C:\Users\Rene\Desktop\FRST.txt
2013-11-14 22:17 - 2013-11-14 22:17 - 00036793 _____ C:\Users\Rene\Desktop\Addition.txt
2013-11-14 22:10 - 2013-11-14 22:11 - 00036793 _____ C:\Users\Rene\Downloads\Addition.txt
2013-11-14 22:09 - 2013-11-15 19:43 - 00022700 _____ C:\Users\Rene\Downloads\FRST.txt
2013-11-14 22:09 - 2013-11-14 22:09 - 00000000 ____D C:\FRST
2013-11-14 22:08 - 2013-11-14 22:08 - 01957794 _____ (Farbar) C:\Users\Rene\Downloads\FRST64.exe
2013-11-14 22:06 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2013-11-14 22:06 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2013-11-14 22:06 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2013-11-14 22:06 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2013-11-14 22:06 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2013-11-14 22:06 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-11-14 22:06 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-11-14 22:06 - 2013-10-04 03:28 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll
2013-11-14 22:06 - 2013-10-04 03:25 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll
2013-11-14 22:06 - 2013-10-04 03:24 - 01930752 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2013-11-14 22:06 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SmartcardCredentialProvider.dll
2013-11-14 22:06 - 2013-10-04 02:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2013-11-14 22:06 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credui.dll
2013-11-14 22:06 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2013-11-14 22:06 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2013-11-14 22:06 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-11-14 22:06 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-11-14 22:06 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2013-11-14 22:06 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2013-11-14 22:06 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2013-11-14 22:06 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2013-11-14 22:06 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-11-14 22:06 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-11-14 22:06 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2013-11-14 22:06 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2013-11-14 22:06 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-11-14 22:06 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2013-11-14 22:06 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2013-11-14 22:06 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2013-11-14 22:06 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-10-19 13:14 - 2013-10-19 13:14 - 00000000 ____D C:\ProgramData\Acer
2013-10-19 12:59 - 2013-11-15 19:32 - 00000000 ____D C:\Windows\ERUNT
2013-10-19 12:58 - 2013-10-19 12:59 - 00002408 _____ C:\DelFix.txt
2013-10-19 12:55 - 2013-10-19 12:55 - 00000000 ___SD C:\unistall.exe
2013-10-18 10:15 - 2013-11-15 08:44 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-10-18 09:41 - 2013-10-18 10:16 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-10-18 09:39 - 2013-10-18 09:59 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-10-18 09:35 - 2013-10-18 09:36 - 12576792 _____ (Malwarebytes Corp.) C:\Users\Rene\Downloads\mbar-1.07.0.1007.exe
2013-10-18 09:22 - 2013-10-18 09:22 - 00000000 ____D C:\ProgramData\Oracle
2013-10-18 09:21 - 2013-10-08 06:50 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-10-18 09:21 - 2013-10-08 06:46 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-10-18 09:21 - 2013-10-08 06:46 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-10-18 09:21 - 2013-10-08 06:46 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-10-18 09:20 - 2013-10-18 09:21 - 00004886 _____ C:\Windows\SysWOW64\jupdate-1.7.0_45-b18.log
2013-10-18 08:44 - 2013-10-18 08:44 - 00985600 _____ C:\Users\Rene\Downloads\MicrosoftFixit50123.msi
2013-10-18 08:16 - 2013-09-04 13:12 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2013-10-18 08:16 - 2013-09-04 13:11 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2013-10-18 08:16 - 2013-09-04 13:11 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2013-10-18 08:16 - 2013-09-04 13:11 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2013-10-18 08:16 - 2013-09-04 13:11 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2013-10-18 08:16 - 2013-09-04 13:11 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2013-10-18 08:16 - 2013-09-04 13:11 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2013-10-16 11:40 - 2013-07-12 11:41 - 00185344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys
2013-10-16 11:40 - 2013-07-12 11:41 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
==================== One Month Modified Files and Folders =======
2013-11-15 19:43 - 2013-11-14 22:09 - 00022700 _____ C:\Users\Rene\Downloads\FRST.txt
2013-11-15 19:42 - 2013-11-15 19:42 - 00001366 _____ C:\Users\Rene\Desktop\JRT.txt
2013-11-15 19:39 - 2010-06-20 15:23 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-15 19:32 - 2013-10-19 12:59 - 00000000 ____D C:\Windows\ERUNT
2013-11-15 19:30 - 2013-11-15 19:30 - 01034531 _____ (Thisisu) C:\Users\Rene\Downloads\JRT.exe
2013-11-15 19:30 - 2009-07-14 05:45 - 00017600 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-15 19:30 - 2009-07-14 05:45 - 00017600 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-15 19:23 - 2010-10-13 22:36 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-11-15 19:22 - 2013-02-23 21:41 - 00000434 _____ C:\Windows\system32\Drivers\etc\hosts.ics
2013-11-15 19:22 - 2012-02-07 10:11 - 00000000 ____D C:\Users\Rene\AppData\Local\Deployment
2013-11-15 19:21 - 2013-10-10 18:11 - 00000784 _____ C:\Windows\setupact.log
2013-11-15 19:21 - 2012-06-27 16:55 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-11-15 19:21 - 2010-06-20 15:23 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-15 19:21 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-15 19:20 - 2013-11-15 19:18 - 00000000 ____D C:\AdwCleaner
2013-11-15 19:20 - 2013-10-10 17:33 - 01670057 _____ C:\Windows\WindowsUpdate.log
2013-11-15 19:12 - 2013-11-15 19:12 - 01085542 _____ C:\Users\Rene\Downloads\adwcleaner.exe
2013-11-15 18:57 - 2012-06-27 20:04 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-15 18:55 - 2010-11-25 23:02 - 00001116 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1350229881-1465274305-1763068460-1000UA.job
2013-11-15 17:47 - 2013-11-15 17:47 - 00000000 ____D C:\Users\Rene\AppData\Local\Software_Updater
2013-11-15 17:46 - 2013-11-15 17:46 - 00000000 ____D C:\Users\Rene\Documents\Fritz!Box Telefonbuch
2013-11-15 16:50 - 2010-04-09 03:13 - 00654400 _____ C:\Windows\system32\perfh007.dat
2013-11-15 16:50 - 2010-04-09 03:13 - 00130240 _____ C:\Windows\system32\perfc007.dat
2013-11-15 16:50 - 2009-07-14 06:13 - 01498742 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-15 14:55 - 2010-11-25 23:02 - 00001064 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1350229881-1465274305-1763068460-1000Core.job
2013-11-15 11:52 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-11-15 10:15 - 2013-11-15 10:15 - 00314149 _____ C:\Users\Rene\Desktop\TeamSpybot-20131115-101524.cab
2013-11-15 09:35 - 2013-11-15 09:24 - 00000000 ____D C:\ProgramData\HitmanPro
2013-11-15 09:26 - 2013-11-15 09:26 - 00001913 _____ C:\Users\Public\Desktop\HitmanPro.lnk
2013-11-15 09:26 - 2013-11-15 09:26 - 00000000 ____D C:\Program Files\HitmanPro
2013-11-15 09:25 - 2013-11-15 09:24 - 10264904 _____ (SurfRight B.V.) C:\Users\Rene\Downloads\HitmanPro_x64.exe
2013-11-15 09:24 - 2013-11-15 09:23 - 09452704 _____ (SurfRight B.V.) C:\Users\Rene\Downloads\nw_14374_hitmanproexe.exe
2013-11-15 08:44 - 2013-10-18 10:15 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-15 08:44 - 2013-02-23 20:47 - 00001155 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-11-15 08:43 - 2013-11-15 08:41 - 23513920 _____ (Mozilla) C:\Users\Rene\Downloads\GMX_Firefox_Setup(3).exe
2013-11-15 08:36 - 2010-06-20 19:56 - 00000000 ____D C:\Users\Rene\AppData\Local\Adobe
2013-11-15 08:27 - 2013-11-15 08:27 - 00002174 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2013-11-15 08:27 - 2013-11-15 08:27 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2013-11-15 08:27 - 2013-11-15 08:27 - 00000000 ____D C:\ProgramData\McAfee
2013-11-15 08:27 - 2013-11-15 08:27 - 00000000 ____D C:\Program Files (x86)\McAfee Security Scan
2013-11-15 08:27 - 2012-06-27 20:04 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-11-15 08:27 - 2012-06-26 18:27 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-11-15 08:27 - 2011-05-19 19:52 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-11-15 08:25 - 2013-10-10 17:25 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-11-15 07:43 - 2010-02-11 03:19 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-11-15 07:39 - 2013-09-19 18:03 - 00000000 ____D C:\Windows\system32\MRT
2013-11-15 07:39 - 2010-07-12 22:27 - 82896128 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-11-14 22:17 - 2013-11-14 22:17 - 00037805 _____ C:\Users\Rene\Desktop\FRST.txt
2013-11-14 22:17 - 2013-11-14 22:17 - 00036793 _____ C:\Users\Rene\Desktop\Addition.txt
2013-11-14 22:11 - 2013-11-14 22:10 - 00036793 _____ C:\Users\Rene\Downloads\Addition.txt
2013-11-14 22:09 - 2013-11-14 22:09 - 00000000 ____D C:\FRST
2013-11-14 22:08 - 2013-11-14 22:08 - 01957794 _____ (Farbar) C:\Users\Rene\Downloads\FRST64.exe
2013-10-19 16:24 - 2010-07-01 20:07 - 00000000 ____D C:\Users\Rene\Desktop\seltene Symbole
2013-10-19 16:07 - 2013-05-06 20:38 - 00004100 _____ C:\Windows\System32\Tasks\Freemium1ClickMaint
2013-10-19 13:14 - 2013-10-19 13:14 - 00000000 ____D C:\ProgramData\Acer
2013-10-19 13:14 - 2012-02-07 10:11 - 00000000 ____D C:\Users\Rene\AppData\Local\Apps\2.0
2013-10-19 13:13 - 2013-10-10 18:11 - 00011382 _____ C:\Windows\PFRO.log
2013-10-19 12:59 - 2013-10-19 12:58 - 00002408 _____ C:\DelFix.txt
2013-10-19 12:55 - 2013-10-19 12:55 - 00000000 ___SD C:\unistall.exe
2013-10-19 11:23 - 2009-07-14 03:34 - 00000215 _____ C:\Windows\system.ini
2013-10-19 10:36 - 2010-06-20 15:04 - 00000000 ____D C:\Users\Rene\AppData\Local\Mozilla
2013-10-19 10:35 - 2013-07-09 21:01 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox.bak
2013-10-19 10:29 - 2013-11-15 08:33 - 00000027 _____ C:\Windows\system32\Drivers\etc\hosts.20131115-083333.backup
2013-10-18 18:59 - 2010-11-25 23:06 - 00002363 _____ C:\Users\Rene\Desktop\Google Chrome.lnk
2013-10-18 15:00 - 2011-06-24 20:45 - 00000000 ____D C:\Users\Rene\AppData\Local\Samsung
2013-10-18 15:00 - 2010-11-10 18:44 - 00000000 ____D C:\Users\Rene\AppData\Roaming\Samsung
2013-10-18 15:00 - 2010-11-10 18:43 - 00000000 ____D C:\ProgramData\Samsung
2013-10-18 15:00 - 2010-11-10 18:43 - 00000000 ____D C:\Program Files (x86)\Samsung
2013-10-18 13:56 - 2010-02-11 03:03 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-10-18 13:51 - 2010-06-20 18:50 - 00000000 ____D C:\Users\Rene
2013-10-18 13:50 - 2010-11-25 23:02 - 00004084 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1350229881-1465274305-1763068460-1000UA
2013-10-18 13:50 - 2010-11-25 23:02 - 00003688 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1350229881-1465274305-1763068460-1000Core
2013-10-18 13:49 - 2011-10-07 20:31 - 00000000 ____D C:\Users\Rene\AppData\Roaming\DVDVideoSoft
2013-10-18 10:16 - 2013-10-18 09:41 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-10-18 09:59 - 2013-10-18 09:39 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-10-18 09:36 - 2013-10-18 09:35 - 12576792 _____ (Malwarebytes Corp.) C:\Users\Rene\Downloads\mbar-1.07.0.1007.exe
2013-10-18 09:22 - 2013-10-18 09:22 - 00000000 ____D C:\ProgramData\Oracle
2013-10-18 09:21 - 2013-10-18 09:20 - 00004886 _____ C:\Windows\SysWOW64\jupdate-1.7.0_45-b18.log
2013-10-18 09:21 - 2013-07-03 18:10 - 00000000 ____D C:\Program Files (x86)\Java
2013-10-18 08:52 - 2009-07-14 05:45 - 00362800 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-18 08:44 - 2013-10-18 08:44 - 00985600 _____ C:\Users\Rene\Downloads\MicrosoftFixit50123.msi
2013-10-18 08:36 - 2009-07-14 06:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-10-18 08:34 - 2010-06-20 15:23 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-10-18 08:34 - 2010-06-20 15:23 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-10-18 07:53 - 2013-03-14 22:44 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-10-18 07:53 - 2013-03-14 22:44 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
Some content of TEMP:
====================
C:\Users\Rene\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-11-14 22:43
==================== End Of Log ============================
--- --- --- --- --- --- Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.8 (11.05.2013:1)
OS: Windows 7 Home Premium x64
Ran by Rene on 15.11.2013 at 19:32:21,20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-1350229881-1465274305-1763068460-1000\Software\sweetim
~~~ Files
~~~ Folders
Successfully deleted: [Empty Folder] C:\Users\Rene\appdata\local\{0E668A33-53A6-49AA-A70D-19D8FFD79228}
Successfully deleted: [Empty Folder] C:\Users\Rene\appdata\local\{2BDE5376-47BF-43E9-A6DC-72FB602828F4}
Successfully deleted: [Empty Folder] C:\Users\Rene\appdata\local\{4D970E70-7485-462C-B4B5-83215294E731}
Successfully deleted: [Empty Folder] C:\Users\Rene\appdata\local\{C630E07F-E8C4-47C6-BB13-435B0E418D92}
~~~ FireFox
Emptied folder: C:\Users\Rene\AppData\Roaming\mozilla\firefox\profiles\0z0tuhtq.default\minidumps [8 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 15.11.2013 at 19:42:07,57
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
16.11.2013, 15:30
| #13 |
| /// the machine /// TB-Ausbilder | Wichtige Sicherheitswarnung zu Ihrem Internetanschluss Abuse T-OnlineESET Online Scanner
Downloade Dir bitte SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
16.11.2013, 22:16
| #14 |
| | Wichtige Sicherheitswarnung zu Ihrem Internetanschluss Abuse T-OnlineCode:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=806651a9d0a84347ab756a0840df2d53
# engine=15910
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-11-16 09:02:40
# local_time=2013-11-16 10:02:40 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1285 16777213 100 98 9636 80959710 0 0
# compatibility_mode=5893 16776573 100 94 95411 136265610 0 0
# scanned=197047
# found=0
# cleaned=0
# scan_time=8952
Code:
ATTFilter Results of screen317's Security Check version 0.99.76 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 10 ``````````````Antivirus/Firewall Check:`````````````` Kaspersky Internet Security Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` MVPS Hosts File Spybot - Search & Destroy Malwarebytes Anti-Malware Version 1.75.0.1300 Java 7 Update 45 Adobe Flash Player 11.9.900.152 Adobe Reader 10.1.8 Adobe Reader out of Date! Mozilla Firefox (25.0) Google Chrome 30.0.1599.101 Google Chrome 30.0.1599.69 ````````Process Check: objlist.exe by Laurent```````` Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbamgui.exe Spybot Teatimer.exe is disabled! Malwarebytes' Anti-Malware mbamscheduler.exe Kaspersky Lab Kaspersky Internet Security 2012 avp.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` Gruß regro FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 14-11-2013
Ran by Rene (administrator) on ACER on 16-11-2013 22:13:48
Running from C:\Users\Rene\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\system32\atiesrxx.exe
(SurfRight B.V.) C:\Program Files\HitmanPro\hmpsched.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\adminservice.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe
(Deutsche Telekom AG) C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Alcor Micro Corp.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe
() C:\Windows\PLFSetI.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Acer) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version6\TeamViewer.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [AmIcoSinglun64] - C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [323584 2009-09-23] (Alcor Micro Corp.)
HKLM\...\Run: [mwlDaemon] - C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe [349480 2009-12-02] (Egis Technology Inc.)
HKLM\...\Run: [PLFSetI] - C:\Windows\PLFSetI.exe [200704 2008-07-29] ()
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1842472 2009-09-18] (Synaptics Incorporated)
HKLM\...\Run: [Acer ePower Management] - C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [860192 2010-02-05] (Acer Incorporated)
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)
Winlogon\Notify\klogon: C:\Windows\System32\klogon.dll (Kaspersky Lab ZAO)
HKCU\...\Run: [AVMUSBFernanschluss] - C:\Users\Rene\AppData\Local\Apps\2.0\MPQAEAVC.5G0\E9285KBK.NT7\frit..tion_8488884cfbcefd60_0002.0003_f406d43803d5433d\AVMAutoStart.exe [139264 2013-04-04] (AVM Berlin)
HKCU\...\Run: [Spybot-S&D Cleaning] - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe [3642312 2013-05-16] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2009-12-24] (Intel Corporation)
HKLM-x32\...\Run: [BackupManagerTray] - C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [265984 2010-01-13] (NewTech Infosystems, Inc.)
HKLM-x32\...\Run: [NortonOnlineBackupReminder] - C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe [588648 2009-07-25] (Symantec Corporation)
HKLM-x32\...\Run: [EgisUpdate] - C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe [200488 2009-10-23] (Egis Technology Inc.)
HKLM-x32\...\Run: [EgisTecPMMUpdate] - C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe [401192 2009-10-23] (Egis Technology Inc.)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-01-22] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [AVP] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe [206448 2012-12-06] (Kaspersky Lab ZAO)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: [SDTray] - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [3830224 2013-05-16] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [154144 2010-01-15] ()
HKU\Default User\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [154144 2010-01-15] ()
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://navigon.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
BHO: No Name - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - No File
BHO: IEVkbdBHO Class - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\x64\ievkbd.dll (Kaspersky Lab ZAO)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: FilterBHO Class - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\x64\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\smart web printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: No Name - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - No File
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: IEVkbdBHO Class - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ievkbd.dll (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: FilterBHO Class - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\smart web printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM-x32 - No Name - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKCU - No Name - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - No File
Handler: ftp - No CLSID Value -
Handler: https - No CLSID Value -
Handler-x32: ftp - No CLSID Value -
Handler-x32: https - No CLSID Value -
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\0z0tuhtq.default
FF DefaultSearchEngine: Google
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.t-online.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_152.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.2 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_152.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @garmin.com/GpsControl - C:\Program Files (x86)\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Rene\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Rene\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\0z0tuhtq.default\searchplugins\searchplugins-backup
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: FRITZ!Box AddOn - C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\0z0tuhtq.default\Extensions\fb_add_on@avm.de
FF Extension: Telekom Toolbar 3.0 - C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\0z0tuhtq.default\Extensions\totbff01@telekom.de
FF Extension: ciuvo-extension - C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\0z0tuhtq.default\Extensions\ciuvo-extension@icq.de.xpi
FF Extension: toolbar - C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\0z0tuhtq.default\Extensions\toolbar@gmx.net.xpi
FF Extension: ImTranslator - C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\0z0tuhtq.default\Extensions\{9AA46F4F-4DC7-4c06-97AF-5035170634FE}.xpi
FF Extension: No Name - C:\Users\Rene\AppData\Roaming\Mozilla\Firefox\Profiles\0z0tuhtq.default\Extensions\{D249FD00-4DF9-11D9-9FDC-0080481ADA61}.xpi
FF Extension: Anti-Banner - C:\Program Files (x86)\Mozilla Firefox\extensions\KavAntiBanner@kaspersky.ru_bak2
FF Extension: Modul zur Link-Untersuchung - C:\Program Files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak2
FF Extension: Skype extension for Firefox - C:\Program Files (x86)\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF HKLM-x32\...\Firefox\Extensions: [virtualKeyboard@kaspersky.ru] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\virtualKeyboard@kaspersky.ru
FF Extension: Kaspersky Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\virtualKeyboard@kaspersky.ru
FF HKLM-x32\...\Firefox\Extensions: [linkfilter@kaspersky.ru] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\linkfilter@kaspersky.ru
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\linkfilter@kaspersky.ru
FF HKLM-x32\...\Firefox\Extensions: [KavAntiBanner@Kaspersky.ru] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\KavAntiBanner@Kaspersky.ru
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\KavAntiBanner@Kaspersky.ru
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (YouTube) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (GMX MailCheck) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\camnampocfohlcgbajligmemmabnljcm\1.1_0
CHR Extension: (Google Search) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Kaspersky URL Advisor) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.0.477_0
CHR Extension: (Virtual Keyboard) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\12.0.0.477_0
CHR Extension: (DVDVideoSoft Browser Extension) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.2_0
CHR Extension: (DivX Plus Web Player HTML5 \u003Cvideo\u003E) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0
CHR Extension: (Gmail) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1
CHR Extension: (Anti-Banner) - C:\Users\Rene\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\12.0.0.374_0
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ChromeExt\urladvisor.crx
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ChromeExt\virtkbd.crx
CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx
CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ChromeExt\ab.crx
==================== Services (Whitelisted) =================
R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe [206448 2012-12-06] (Kaspersky Lab ZAO)
R2 HitmanProScheduler; C:\Program Files\HitmanPro\hmpsched.exe [109352 2013-11-15] (SurfRight B.V.)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 McComponentHostService; C:\Program Files (x86)\McAfee Security Scan\3.0.285\McCHSvc.exe [234776 2012-09-05] (McAfee, Inc.)
R2 MWLService; C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [305448 2009-12-02] (Egis Technology Inc.)
R2 Netzmanager Service; C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe [2635776 2012-07-20] (Deutsche Telekom AG)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1817560 2013-05-16] (Safer-Networking Ltd.)
S2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1033688 2013-05-16] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2013-05-15] (Safer-Networking Ltd.)
S3 ServiceLayer; "C:\Program Files (x86)\Nokia\PC Connectivity Solution\ServiceLayer.exe" [x]
==================== Drivers (Whitelisted) ====================
S3 AbilisT; C:\Windows\System32\Drivers\AbilisBdaTuner.sys [128264 2010-03-18] (ABILIS Systems)
R3 avmaudio; C:\Windows\System32\DRIVERS\avmaudio.sys [116480 2013-04-04] (AVM Berlin)
R3 avmaura; C:\Windows\System32\DRIVERS\avmaura.sys [116480 2013-04-04] (AVM Berlin)
R3 azvusb; C:\Windows\System32\DRIVERS\azvusb.sys [54784 2009-08-24] (AzureWave Technologies, Inc.)
S3 dgderdrv; C:\Windows\System32\drivers\dgderdrv.sys [20568 2010-05-25] (Devguru Co., Ltd)
R0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [460888 2011-03-04] (Kaspersky Lab ZAO)
R1 kl2; C:\Windows\System32\DRIVERS\kl2.sys [11864 2011-03-04] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [637272 2012-12-06] (Kaspersky Lab)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [29488 2011-03-10] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [22544 2009-11-02] (Kaspersky Lab)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R1 MPFP; C:\Windows\System32\Drivers\Mpfp.sys [176144 2009-04-09] (McAfee, Inc.)
S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
S3 TelekomNM6; C:\Program Files\Netzmanager\NMInfraIS2\Driver\TelekomNM6.sys [45664 2010-09-16] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH)
R2 {B154377D-700F-42cc-9474-23858FBDF4BD}; c:\Program Files (x86)\CyberLink\PowerDVD9\000.fcl [146928 2010-01-22] (CyberLink Corp.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-11-16 22:08 - 2013-11-16 22:08 - 00891184 _____ C:\Users\Rene\Downloads\SecurityCheck.exe
2013-11-16 19:28 - 2013-11-16 19:28 - 02347384 _____ (ESET) C:\Users\Rene\Downloads\esetsmartinstaller_enu.exe
2013-11-15 19:47 - 2013-11-15 19:47 - 00043582 _____ C:\Users\Rene\Desktop\FRST.txt_1.txt
2013-11-15 19:44 - 2013-11-15 19:44 - 00019247 _____ C:\Users\Rene\Desktop\AdwCleaner[S0].txt
2013-11-15 19:42 - 2013-11-15 19:42 - 00001366 _____ C:\Users\Rene\Desktop\JRT.txt
2013-11-15 19:30 - 2013-11-15 19:30 - 01034531 _____ (Thisisu) C:\Users\Rene\Downloads\JRT.exe
2013-11-15 19:18 - 2013-11-15 19:20 - 00000000 ____D C:\AdwCleaner
2013-11-15 19:12 - 2013-11-15 19:12 - 01085542 _____ C:\Users\Rene\Downloads\adwcleaner.exe
2013-11-15 17:47 - 2013-11-15 17:47 - 00000000 ____D C:\Users\Rene\AppData\Local\Software_Updater
2013-11-15 17:46 - 2013-11-15 17:46 - 00000000 ____D C:\Users\Rene\Documents\Fritz!Box Telefonbuch
2013-11-15 10:15 - 2013-11-15 10:15 - 00314149 _____ C:\Users\Rene\Desktop\TeamSpybot-20131115-101524.cab
2013-11-15 09:26 - 2013-11-15 09:26 - 00001913 _____ C:\Users\Public\Desktop\HitmanPro.lnk
2013-11-15 09:26 - 2013-11-15 09:26 - 00000000 ____D C:\Program Files\HitmanPro
2013-11-15 09:24 - 2013-11-15 09:35 - 00000000 ____D C:\ProgramData\HitmanPro
2013-11-15 09:24 - 2013-11-15 09:25 - 10264904 _____ (SurfRight B.V.) C:\Users\Rene\Downloads\HitmanPro_x64.exe
2013-11-15 09:23 - 2013-11-15 09:24 - 09452704 _____ (SurfRight B.V.) C:\Users\Rene\Downloads\nw_14374_hitmanproexe.exe
2013-11-15 08:41 - 2013-11-15 08:43 - 23513920 _____ (Mozilla) C:\Users\Rene\Downloads\GMX_Firefox_Setup(3).exe
2013-11-15 08:33 - 2013-10-19 10:29 - 00000027 _____ C:\Windows\system32\Drivers\etc\hosts.20131115-083333.backup
2013-11-15 08:27 - 2013-11-15 08:27 - 00002174 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2013-11-15 08:27 - 2013-11-15 08:27 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2013-11-15 08:27 - 2013-11-15 08:27 - 00000000 ____D C:\ProgramData\McAfee
2013-11-15 08:27 - 2013-11-15 08:27 - 00000000 ____D C:\Program Files (x86)\McAfee Security Scan
2013-11-15 07:44 - 2013-10-12 09:45 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-15 07:44 - 2013-10-12 09:43 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-15 07:44 - 2013-10-12 09:43 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-15 07:44 - 2013-10-12 09:43 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-15 07:44 - 2013-10-12 09:43 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-15 07:44 - 2013-10-12 09:43 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-15 07:44 - 2013-10-12 09:43 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-15 07:44 - 2013-10-12 09:43 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-15 07:44 - 2013-10-12 09:43 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-15 07:44 - 2013-10-12 08:03 - 01138176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-11-15 07:44 - 2013-10-12 08:02 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-15 07:44 - 2013-10-12 08:02 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-15 07:44 - 2013-10-12 08:02 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-11-15 07:44 - 2013-10-12 08:02 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-11-15 07:44 - 2013-10-12 08:02 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-11-15 07:44 - 2013-10-12 08:02 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-11-15 07:44 - 2013-10-12 08:02 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-11-15 07:44 - 2013-10-12 08:02 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-11-15 07:44 - 2013-10-12 07:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-15 07:44 - 2013-10-12 07:08 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-11-15 07:44 - 2013-10-12 06:44 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-15 07:44 - 2013-10-12 06:15 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-11-15 07:43 - 2013-10-12 09:45 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-15 07:43 - 2013-10-12 09:45 - 01364992 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-15 07:43 - 2013-10-12 09:43 - 19269632 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-15 07:43 - 2013-10-12 09:43 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-15 07:43 - 2013-10-12 09:43 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-15 07:43 - 2013-10-12 08:03 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-15 07:43 - 2013-10-12 08:02 - 14355968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-15 07:43 - 2013-10-12 08:02 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-15 07:43 - 2013-10-12 08:02 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-11-14 22:17 - 2013-11-14 22:17 - 00037805 _____ C:\Users\Rene\Desktop\FRST.txt
2013-11-14 22:17 - 2013-11-14 22:17 - 00036793 _____ C:\Users\Rene\Desktop\Addition.txt
2013-11-14 22:10 - 2013-11-14 22:11 - 00036793 _____ C:\Users\Rene\Downloads\Addition.txt
2013-11-14 22:09 - 2013-11-16 22:13 - 00022729 _____ C:\Users\Rene\Downloads\FRST.txt
2013-11-14 22:09 - 2013-11-14 22:09 - 00000000 ____D C:\FRST
2013-11-14 22:08 - 2013-11-14 22:08 - 01957794 _____ (Farbar) C:\Users\Rene\Downloads\FRST64.exe
2013-11-14 22:06 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2013-11-14 22:06 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2013-11-14 22:06 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2013-11-14 22:06 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2013-11-14 22:06 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2013-11-14 22:06 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-11-14 22:06 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-11-14 22:06 - 2013-10-04 03:28 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll
2013-11-14 22:06 - 2013-10-04 03:25 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll
2013-11-14 22:06 - 2013-10-04 03:24 - 01930752 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2013-11-14 22:06 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SmartcardCredentialProvider.dll
2013-11-14 22:06 - 2013-10-04 02:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2013-11-14 22:06 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credui.dll
2013-11-14 22:06 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2013-11-14 22:06 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2013-11-14 22:06 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-11-14 22:06 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-11-14 22:06 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2013-11-14 22:06 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2013-11-14 22:06 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2013-11-14 22:06 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2013-11-14 22:06 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-11-14 22:06 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-11-14 22:06 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2013-11-14 22:06 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2013-11-14 22:06 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-11-14 22:06 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2013-11-14 22:06 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2013-11-14 22:06 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2013-11-14 22:06 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-10-19 13:14 - 2013-10-19 13:14 - 00000000 ____D C:\ProgramData\Acer
2013-10-19 12:59 - 2013-11-15 19:32 - 00000000 ____D C:\Windows\ERUNT
2013-10-19 12:58 - 2013-10-19 12:59 - 00002408 _____ C:\DelFix.txt
2013-10-19 12:55 - 2013-10-19 12:55 - 00000000 ___SD C:\unistall.exe
2013-10-18 10:15 - 2013-11-15 08:44 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-10-18 09:41 - 2013-10-18 10:16 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-10-18 09:39 - 2013-10-18 09:59 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-10-18 09:35 - 2013-10-18 09:36 - 12576792 _____ (Malwarebytes Corp.) C:\Users\Rene\Downloads\mbar-1.07.0.1007.exe
2013-10-18 09:22 - 2013-10-18 09:22 - 00000000 ____D C:\ProgramData\Oracle
2013-10-18 09:21 - 2013-10-08 06:50 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-10-18 09:21 - 2013-10-08 06:46 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-10-18 09:21 - 2013-10-08 06:46 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-10-18 09:21 - 2013-10-08 06:46 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-10-18 09:20 - 2013-10-18 09:21 - 00004886 _____ C:\Windows\SysWOW64\jupdate-1.7.0_45-b18.log
2013-10-18 08:44 - 2013-10-18 08:44 - 00985600 _____ C:\Users\Rene\Downloads\MicrosoftFixit50123.msi
2013-10-18 08:16 - 2013-09-04 13:12 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2013-10-18 08:16 - 2013-09-04 13:11 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2013-10-18 08:16 - 2013-09-04 13:11 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2013-10-18 08:16 - 2013-09-04 13:11 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2013-10-18 08:16 - 2013-09-04 13:11 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2013-10-18 08:16 - 2013-09-04 13:11 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2013-10-18 08:16 - 2013-09-04 13:11 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
==================== One Month Modified Files and Folders =======
2013-11-16 22:14 - 2013-11-14 22:09 - 00022729 _____ C:\Users\Rene\Downloads\FRST.txt
2013-11-16 22:08 - 2013-11-16 22:08 - 00891184 _____ C:\Users\Rene\Downloads\SecurityCheck.exe
2013-11-16 21:59 - 2013-10-10 17:33 - 01699344 _____ C:\Windows\WindowsUpdate.log
2013-11-16 21:57 - 2012-06-27 20:04 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-16 21:55 - 2010-11-25 23:02 - 00001116 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1350229881-1465274305-1763068460-1000UA.job
2013-11-16 21:39 - 2010-06-20 15:23 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-16 19:37 - 2010-10-13 22:36 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-11-16 19:31 - 2009-07-14 05:45 - 00017600 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-16 19:31 - 2009-07-14 05:45 - 00017600 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-16 19:28 - 2013-11-16 19:28 - 02347384 _____ (ESET) C:\Users\Rene\Downloads\esetsmartinstaller_enu.exe
2013-11-16 19:24 - 2013-02-23 21:41 - 00000434 _____ C:\Windows\system32\Drivers\etc\hosts.ics
2013-11-16 19:23 - 2012-02-07 10:11 - 00000000 ____D C:\Users\Rene\AppData\Local\Deployment
2013-11-16 19:22 - 2010-06-20 15:23 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-16 19:21 - 2013-10-10 18:11 - 00000840 _____ C:\Windows\setupact.log
2013-11-16 19:21 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-15 19:47 - 2013-11-15 19:47 - 00043582 _____ C:\Users\Rene\Desktop\FRST.txt_1.txt
2013-11-15 19:44 - 2013-11-15 19:44 - 00019247 _____ C:\Users\Rene\Desktop\AdwCleaner[S0].txt
2013-11-15 19:42 - 2013-11-15 19:42 - 00001366 _____ C:\Users\Rene\Desktop\JRT.txt
2013-11-15 19:32 - 2013-10-19 12:59 - 00000000 ____D C:\Windows\ERUNT
2013-11-15 19:30 - 2013-11-15 19:30 - 01034531 _____ (Thisisu) C:\Users\Rene\Downloads\JRT.exe
2013-11-15 19:21 - 2012-06-27 16:55 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-11-15 19:20 - 2013-11-15 19:18 - 00000000 ____D C:\AdwCleaner
2013-11-15 19:20 - 2010-06-20 15:11 - 00000000 ____D C:\ProgramData\ICQ
2013-11-15 19:12 - 2013-11-15 19:12 - 01085542 _____ C:\Users\Rene\Downloads\adwcleaner.exe
2013-11-15 17:47 - 2013-11-15 17:47 - 00000000 ____D C:\Users\Rene\AppData\Local\Software_Updater
2013-11-15 17:46 - 2013-11-15 17:46 - 00000000 ____D C:\Users\Rene\Documents\Fritz!Box Telefonbuch
2013-11-15 16:50 - 2010-04-09 03:13 - 00654400 _____ C:\Windows\system32\perfh007.dat
2013-11-15 16:50 - 2010-04-09 03:13 - 00130240 _____ C:\Windows\system32\perfc007.dat
2013-11-15 16:50 - 2009-07-14 06:13 - 01498742 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-15 14:55 - 2010-11-25 23:02 - 00001064 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1350229881-1465274305-1763068460-1000Core.job
2013-11-15 11:52 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-11-15 10:15 - 2013-11-15 10:15 - 00314149 _____ C:\Users\Rene\Desktop\TeamSpybot-20131115-101524.cab
2013-11-15 09:35 - 2013-11-15 09:24 - 00000000 ____D C:\ProgramData\HitmanPro
2013-11-15 09:26 - 2013-11-15 09:26 - 00001913 _____ C:\Users\Public\Desktop\HitmanPro.lnk
2013-11-15 09:26 - 2013-11-15 09:26 - 00000000 ____D C:\Program Files\HitmanPro
2013-11-15 09:25 - 2013-11-15 09:24 - 10264904 _____ (SurfRight B.V.) C:\Users\Rene\Downloads\HitmanPro_x64.exe
2013-11-15 09:24 - 2013-11-15 09:23 - 09452704 _____ (SurfRight B.V.) C:\Users\Rene\Downloads\nw_14374_hitmanproexe.exe
2013-11-15 08:44 - 2013-10-18 10:15 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-15 08:44 - 2013-02-23 20:47 - 00001155 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-11-15 08:43 - 2013-11-15 08:41 - 23513920 _____ (Mozilla) C:\Users\Rene\Downloads\GMX_Firefox_Setup(3).exe
2013-11-15 08:36 - 2010-06-20 19:56 - 00000000 ____D C:\Users\Rene\AppData\Local\Adobe
2013-11-15 08:27 - 2013-11-15 08:27 - 00002174 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2013-11-15 08:27 - 2013-11-15 08:27 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2013-11-15 08:27 - 2013-11-15 08:27 - 00000000 ____D C:\ProgramData\McAfee
2013-11-15 08:27 - 2013-11-15 08:27 - 00000000 ____D C:\Program Files (x86)\McAfee Security Scan
2013-11-15 08:27 - 2012-06-27 20:04 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-11-15 08:27 - 2012-06-26 18:27 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-11-15 08:27 - 2011-05-19 19:52 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-11-15 08:25 - 2013-10-10 17:25 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-11-15 07:43 - 2010-02-11 03:19 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-11-15 07:42 - 2013-09-19 18:03 - 00000000 ____D C:\Windows\system32\MRT
2013-11-15 07:39 - 2010-07-12 22:27 - 82896128 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-11-14 22:17 - 2013-11-14 22:17 - 00037805 _____ C:\Users\Rene\Desktop\FRST.txt
2013-11-14 22:17 - 2013-11-14 22:17 - 00036793 _____ C:\Users\Rene\Desktop\Addition.txt
2013-11-14 22:11 - 2013-11-14 22:10 - 00036793 _____ C:\Users\Rene\Downloads\Addition.txt
2013-11-14 22:09 - 2013-11-14 22:09 - 00000000 ____D C:\FRST
2013-11-14 22:08 - 2013-11-14 22:08 - 01957794 _____ (Farbar) C:\Users\Rene\Downloads\FRST64.exe
2013-10-19 16:24 - 2010-07-01 20:07 - 00000000 ____D C:\Users\Rene\Desktop\seltene Symbole
2013-10-19 16:07 - 2013-05-06 20:38 - 00004100 _____ C:\Windows\System32\Tasks\Freemium1ClickMaint
2013-10-19 13:14 - 2013-10-19 13:14 - 00000000 ____D C:\ProgramData\Acer
2013-10-19 13:14 - 2012-02-07 10:11 - 00000000 ____D C:\Users\Rene\AppData\Local\Apps\2.0
2013-10-19 13:13 - 2013-10-10 18:11 - 00011382 _____ C:\Windows\PFRO.log
2013-10-19 12:59 - 2013-10-19 12:58 - 00002408 _____ C:\DelFix.txt
2013-10-19 12:55 - 2013-10-19 12:55 - 00000000 ___SD C:\unistall.exe
2013-10-19 11:23 - 2009-07-14 03:34 - 00000215 _____ C:\Windows\system.ini
2013-10-19 10:36 - 2010-06-20 15:04 - 00000000 ____D C:\Users\Rene\AppData\Local\Mozilla
2013-10-19 10:35 - 2013-07-09 21:01 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox.bak
2013-10-19 10:29 - 2013-11-15 08:33 - 00000027 _____ C:\Windows\system32\Drivers\etc\hosts.20131115-083333.backup
2013-10-18 18:59 - 2010-11-25 23:06 - 00002363 _____ C:\Users\Rene\Desktop\Google Chrome.lnk
2013-10-18 15:00 - 2011-06-24 20:45 - 00000000 ____D C:\Users\Rene\AppData\Local\Samsung
2013-10-18 15:00 - 2010-11-10 18:44 - 00000000 ____D C:\Users\Rene\AppData\Roaming\Samsung
2013-10-18 15:00 - 2010-11-10 18:43 - 00000000 ____D C:\ProgramData\Samsung
2013-10-18 15:00 - 2010-11-10 18:43 - 00000000 ____D C:\Program Files (x86)\Samsung
2013-10-18 13:56 - 2010-02-11 03:03 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-10-18 13:51 - 2010-06-20 18:50 - 00000000 ____D C:\Users\Rene
2013-10-18 13:50 - 2010-11-25 23:02 - 00004084 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1350229881-1465274305-1763068460-1000UA
2013-10-18 13:50 - 2010-11-25 23:02 - 00003688 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1350229881-1465274305-1763068460-1000Core
2013-10-18 13:49 - 2011-10-07 20:31 - 00000000 ____D C:\Users\Rene\AppData\Roaming\DVDVideoSoft
2013-10-18 10:16 - 2013-10-18 09:41 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-10-18 09:59 - 2013-10-18 09:39 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-10-18 09:36 - 2013-10-18 09:35 - 12576792 _____ (Malwarebytes Corp.) C:\Users\Rene\Downloads\mbar-1.07.0.1007.exe
2013-10-18 09:22 - 2013-10-18 09:22 - 00000000 ____D C:\ProgramData\Oracle
2013-10-18 09:21 - 2013-10-18 09:20 - 00004886 _____ C:\Windows\SysWOW64\jupdate-1.7.0_45-b18.log
2013-10-18 09:21 - 2013-07-03 18:10 - 00000000 ____D C:\Program Files (x86)\Java
2013-10-18 08:52 - 2009-07-14 05:45 - 00362800 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-18 08:44 - 2013-10-18 08:44 - 00985600 _____ C:\Users\Rene\Downloads\MicrosoftFixit50123.msi
2013-10-18 08:36 - 2009-07-14 06:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-10-18 08:34 - 2010-06-20 15:23 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-10-18 08:34 - 2010-06-20 15:23 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-10-18 07:53 - 2013-03-14 22:44 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-10-18 07:53 - 2013-03-14 22:44 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
Some content of TEMP:
====================
C:\Users\Rene\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-11-14 22:43
==================== End Of Log ============================
--- --- --- Schönen Abend. |
|
17.11.2013, 07:38
| #15 |
| /// the machine /// TB-Ausbilder | Wichtige Sicherheitswarnung zu Ihrem Internetanschluss Abuse T-Online Adobe updaten. Fertig Die Reihenfolge ist hier entscheidend.
Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
Linear-Darstellung
