| |
| |||||||
Log-Analyse und Auswertung: Win7: kein Sicherheitscenter nach BKA-TrojanerWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
12.11.2013, 17:01
| #1 |
 |  Win7: kein Sicherheitscenter nach BKA-Trojaner Hallo, habe vor ein paar Tagen den PC meines Vaters zur "Wiederherstellung" bekommen. Seine Freundin surft öfters mal auf dubioseren Seiten; dabei wurden dem Rechner sukzessive sämtliche Sicherheitssysteme genommen (Firewall, AV etc). Schließlich fing er sich einen BKA-Trojaner ein (Desktop gesperrt, kein abgesicherter Modus möglich). Mein Weg zur Wiederherstellung verlief bisher wie folgt: ich bootete den Rechner von einer Desinfec't-CD, ließ Avira, BitDefender, Kaspersky und ClamAV laufen und die von ihnen gefunden Trojaner (waren mehrere) beseitigen. Danach startete der Rechner ohne größere Probleme (Fehlermeldung beim Aufruf des Trojaners > mit CCleaner aus Autostart gekickt). Nun bestehen noch ein paar Probleme. Erstens bekomme ich häufiger eine "Server ist ausgelastet"-Meldung, die ich nicht zuordnen kann (Malware oder normales Programm?). Zweitens lassen sich weder das Windows-Sicherheitscenter noch das installierte Avira Internet Security aktivieren. Nach Googlen von "Fehler 1068" landete ich schließlich bei einer Microsoft-Supportseite (hxxp://support.microsoft.com/kb/2519899/de), die ich auch abarbeitete. Ein vollständiger Scan mit MSE (vorübergehend installiert) ergab einen weiteren Trojanerfund (Win32/Reveton.V). Ich vermute, daß ich durch meine Eigenarbeit mehr Schaden als Nutzen produziert habe ... vielleicht gibt es trotzdem noch Rettung für dieses verseuchte Gerät. Eurem Leitfaden für neue Posts folgend ergeben sich folgende Logs: DeFogger lief ohne Fehlermeldung durch. FRST: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-11-2013 01
Ran by **** (administrator) on ****-PC on 12-11-2013 11:30:21
Running from C:\Users\****\Desktop
Windows 7 Ultimate Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Could not list processes ===============
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [TosNC] - C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe [595816 2010-04-23] (TOSHIBA Corporation)
HKLM\...\Run: [TFPUPWDBankService] - C:\Program Files\TOSHIBA\TFPU\TFPUPWDBank.exe [925104 2010-03-02] (TOSHIBA)
HKLM\...\Run: [TFPUService] - C:\Program Files\TOSHIBA\TFPU\TFPUTaskMonitor.exe [793008 2010-03-02] (TOSHIBA)
HKLM\...\Run: [ThpSrv] - C:\Windows\system32\thpsrv /logon
HKLM\...\Run: [SmartAudio] - C:\Program Files\CONEXANT\SAII\SAIICpl.exe [307768 2010-04-28] ()
HKLM\...\Run: [Toshiba TEMPRO] - C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe [1050072 2010-10-26] (Toshiba Europe GmbH)
HKLM\...\Run: [Acronis Scheduler2 Service] - C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [140568 2007-08-31] (Acronis)
HKLM\...\Run: [Logitech Download Assistant] - C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
HKCU\...\Run: [AnyDVD] - C:\Program Files (x86)\SlySoft\AnyDVD\AnyDVDtray.exe [4763256 2010-12-17] (SlySoft, Inc.)
HKCU\...\Run: [SAFE14 Browser Monitor] - C:\Program Files (x86)\Steganos Safe 14\SteganosBrowserMonitor.exe [71168 2012-11-28] (Steganos Software GmbH)
HKCU\...\Run: [My Driver Updater] - C:\Program Files (x86)\Large Software\My Driver Updater\MDULauncher.exe [388240 2012-03-06] (Large Software)
HKCU\...\Run: [Google Update] - C:\Users\****\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2011-06-07] (Google Inc.)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2010-11-05] (Intel Corporation)
HKLM-x32\...\Run: [TWebCamera] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe [2454840 2010-05-01] (TOSHIBA CORPORATION.)
HKLM-x32\...\Run: [TrueImageMonitor.exe] - C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe [2622232 2007-08-31] (Acronis)
HKLM-x32\...\Run: [AcronisTimounterMonitor] - C:\Program Files (x86)\Acronis\TrueImageHome\TimounterMonitor.exe [907040 2007-08-31] (Acronis)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-04] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SAFE14 HotKeys] - C:\Program Files (x86)\Steganos Safe 14\SteganosHotKeyService.exe [85504 2012-11-28] (Steganos Software GmbH)
HKLM-x32\...\Run: [SAFE14 File Redirection Starter] - C:\Program Files (x86)\Steganos Safe 14\fredirstarter.exe [17408 2012-11-28] (Steganos Software GmbH)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [SDTray] - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)
AppInit_DLLs: C:\PROGRA~3\Wincert\WIN64C~1.DLL c:\progra~2\movies~1\datamngr\x64\mgrldr.dll [97280 2009-07-14] ()
IMEO\bitguard.exe: [Debugger] tasklist.exe
IMEO\bprotect.exe: [Debugger] tasklist.exe
IMEO\browserdefender.exe: [Debugger] tasklist.exe
IMEO\browserprotect.exe: [Debugger] tasklist.exe
Lsa: [Authentication Packages] msv1_0 relog_ap
HKLM\...\AppCertDlls: [x86] -> C:\Program Files (x86)\Movies Toolbar\Datamngr\apcrtldr.dll <===== ATTENTION
HKLM\...\AppCertDlls: [x64] -> C:\Program Files (x86)\Movies Toolbar\Datamngr\x64\apcrtldr.dll <===== ATTENTION
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xC939DB442CA4CB01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
URLSearchHook: HKCU - pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files (x86)\pdfforge Toolbar\IE\7.6\pdfforgeToolbarIE.dll (Spigot, Inc.)
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search.ask.com/sr?src=ieb&gct=ds&appid=707&systemid=406&v=a9301-109&apn_uid=9359343755744811&apn_dtid=BND406&o=APN10645&apn_ptnrs=AG6&q={searchTerms}
SearchScopes: HKLM-x32 - Yandex URL = hxxp://yandex.ru/yandsearch?clid=39942&text={searchTerms}
SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search.ask.com/sr?src=ieb&gct=ds&appid=707&systemid=406&v=a9301-109&apn_uid=9359343755744811&apn_dtid=BND406&o=APN10645&apn_ptnrs=AG6&q={searchTerms}
SearchScopes: HKLM-x32 - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2851647
SearchScopes: HKCU - DefaultScope {0CF2F0EB-651F-4B96-B8C5-A6FC52CE7E83} URL = hxxp://www.bing.com/search?FORM=UP97DF&PC=UP97&q={searchTerms}&src=IE-SearchBox
SearchScopes: HKCU - A55766DDBED142D08744997BABF88302 URL = hxxp://www.google.de/search?q={searchTerms}&rlz=1I7ADRA_deCH483
SearchScopes: HKCU - Moikrug URL = hxxp://moikrug.ru/persons/?clid=39942&charset=utf-8&keywords={searchTerms}&submitted=1
SearchScopes: HKCU - Yandex URL = hxxp://yandex.ru/yandsearch?clid=39942&text={searchTerms}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {621291BE-6E45-4CCF-B87B-8D7CF9BE7869} URL = hxxp://ch.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=302398&p={searchTerms}
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=707&systemid=406&apn_dtid=BND406&apn_ptnrs=AG6&o=APN10645&apn_uid=9359343755744811&q={searchTerms}
SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2851647
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Skype add-on for Internet Explorer - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll No File
BHO-x32: TFPUPWDBankBHO Class - {030AC7B6-E7EC-40F1-8FB2-C0FD344DE0B9} - C:\Program Files\TOSHIBA\TFPU\x86\TFPUPWDBankBHO.dll (TODO: <Company name>)
BHO-x32: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files (x86)\pdfforge Toolbar\IE\7.6\pdfforgeToolbarIE.dll (Spigot, Inc.)
BHO-x32: GbIehObj Class - {C41A1C0E-EA6C-11D4-B1B8-444553540008} - C:\Program Files (x86)\GbPlugin\gbiehuni.dll (Banco Itaú Unibanco)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - No Name - {91397D20-1446-11D4-8AF4-0040CA1127B6} - No File
Toolbar: HKLM-x32 - No Name - {377e5d4d-77e5-476a-8716-7e70a9272da0} - No File
Toolbar: HKLM-x32 - pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files (x86)\pdfforge Toolbar\IE\7.6\pdfforgeToolbarIE.dll (Spigot, Inc.)
Toolbar: HKCU - No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
ShellExecuteHooks-x32: GbPluginObj Class - {E37CB5F0-51F5-4395-A808-5FA49E399008} - C:\Program Files (x86)\GbPlugin\gbiehuni.dll [1502264 2013-09-25] (Banco Itaú Unibanco)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Windows\SysWOW64\npdeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @Nero.com/KM - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin - C:\Users\****\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin HKCU: @talk.google.com/O1DPlugin - C:\Users\****\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
FF Plugin HKCU: @talk.google.com/O3DPlugin - C:\Users\****\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\****\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\****\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF HKLM\...\Firefox\Extensions: [{C1CA7765-44E4-452e-9D00-A04F3D434281}] -
FF HKLM-x32\...\Firefox\Extensions: [{C1CA7765-44E4-452e-9D00-A04F3D434281}] -
==================== Services (Whitelisted) =================
S2 AntiVirFirewallService; C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe [655928 2013-09-04] (Avira Operations GmbH & Co. KG)
S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [622648 2013-09-04] (Avira Operations GmbH & Co. KG)
S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-04] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-04] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-04] (Avira Operations GmbH & Co. KG)
R2 GbpSv; C:\PROGRA~2\GbPlugin\GbpSv.exe [451640 2013-09-25] (GAS Tecnologia)
R2 mozybackup; C:\Program Files\MozyHome\mozybackup.exe [54672 2012-08-02] (Mozy, Inc.)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1817560 2013-05-16] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1033688 2013-05-16] (Safer-Networking Ltd.)
S2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2013-05-15] (Safer-Networking Ltd.)
R2 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [124368 2010-10-26] (Toshiba Europe GmbH)
R2 TryAndDecideService; C:\Program Files (x86)\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe [498872 2007-08-31] ()
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe [2028864 2011-12-13] (TuneUp Software)
S2 Winmgmt; C:\PROGRA~3\fwl1lbo.pzz [x]
==================== Drivers (Whitelisted) ====================
R3 AnyDVD; C:\Windows\System32\Drivers\AnyDVD.sys [125512 2010-12-01] (SlySoft, Inc.)
R3 AnyDVD; C:\Windows\SysWow64\Drivers\AnyDVD.sys [125512 2010-12-01] (SlySoft, Inc.)
R3 avfwim; C:\Windows\System32\DRIVERS\avfwim.sys [114608 2013-02-18] (Avira GmbH)
R1 avfwot; C:\Windows\System32\DRIVERS\avfwot.sys [141376 2013-02-18] (Avira GmbH)
R1 avfwot; C:\Windows\SysWow64\DRIVERS\avfwot.sys [131336 2011-06-28] (Avira GmbH)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-04] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-09-04] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-04-05] (Avira Operations GmbH & Co. KG)
R1 mozyFilter; C:\Windows\System32\DRIVERS\mozy.sys [67368 2012-08-02] (Mozy, Inc.)
R3 O2SDGRDR; C:\Windows\System32\DRIVERS\o2sdgx64.sys [49568 2009-08-18] (O2Micro )
S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R1 SLEE_18_DRIVER; C:\Windows\Sleen1864.sys [108648 2012-07-24] (Softwareentwicklung Remus - ArchiCrypt - )
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesDriver64.sys [11856 2010-10-07] (TuneUp Software)
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [x]
S3 tsusbhub; system32\drivers\tsusbhub.sys [x]
S3 VGPU; System32\drivers\rdvgkmd.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-11-12 11:29 - 2013-11-12 11:29 - 01957590 _____ (Farbar) C:\Users\****\Desktop\FRST64.exe
2013-11-12 11:29 - 2013-11-12 11:29 - 00000000 ____D C:\FRST
2013-11-12 11:27 - 2013-11-12 11:28 - 00000470 _____ C:\Users\****\Desktop\defogger_disable.log
2013-11-12 11:27 - 2013-11-12 11:27 - 00000000 _____ C:\Users\****\defogger_reenable
2013-11-12 11:24 - 2013-11-12 11:24 - 00050477 _____ C:\Users\****\Desktop\Defogger.exe
2013-11-11 22:35 - 2013-11-11 22:32 - 00873384 _____ (Oracle Corporation) C:\Windows\SysWOW64\npdeployJava1.dll
2013-11-11 22:35 - 2013-11-11 22:32 - 00796072 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2013-11-11 22:33 - 2013-11-11 22:33 - 00000000 ____D C:\ProgramData\Oracle
2013-11-11 22:32 - 2013-11-11 22:32 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-11-11 20:05 - 2013-11-11 22:30 - 00001912 _____ C:\Windows\epplauncher.mif
2013-11-11 19:22 - 2013-11-12 11:12 - 00000168 _____ C:\Windows\setupact.log
2013-11-11 19:22 - 2013-11-11 19:22 - 00000000 _____ C:\Windows\setuperr.log
2013-11-11 19:00 - 2013-11-11 19:20 - 00002579 _____ C:\Users\****\Desktop\Hkey.reg
2013-11-11 18:37 - 2013-11-11 18:37 - 00000193 _____ C:\Windows\wininit.ini
2013-11-11 18:17 - 2013-11-11 18:37 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-11-11 18:17 - 2013-11-11 18:17 - 00001391 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2013-11-11 18:17 - 2013-11-11 18:17 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking
2013-11-11 18:17 - 2009-01-25 13:14 - 00017272 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2013-11-11 18:16 - 2013-11-11 18:17 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2013-11-11 18:13 - 2013-11-11 18:13 - 00000000 ____D C:\Users\Temp\AppData\Roaming\Macromedia
2013-11-11 18:12 - 2013-11-11 18:12 - 00000000 ____D C:\Users\Temp\AppData\Roaming\TFPU
2013-11-11 18:11 - 2013-11-11 18:12 - 00000000 ____D C:\Users\Temp\AppData\Local\Toshiba
2013-11-11 18:11 - 2013-11-11 18:11 - 00118048 _____ C:\Users\Temp\AppData\Local\GDIPFONTCACHEV1.DAT
2013-11-11 18:11 - 2013-11-11 18:11 - 00001433 _____ C:\Users\Temp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ___RD C:\Users\Temp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ___RD C:\Users\Temp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ____D C:\Users\Temp\Documents\Bluetooth
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ____D C:\Users\Temp\AppData\Roaming\Steganos
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ____D C:\Users\Temp\AppData\Roaming\Intel Corporation
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ____D C:\Users\Temp\AppData\Roaming\Avira
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ____D C:\Users\Temp\AppData\Roaming\Apple Computer
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ____D C:\Users\Temp\AppData\Roaming\Adobe
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ____D C:\Users\Temp\AppData\Local\VirtualStore
2013-11-11 18:10 - 2013-11-11 18:10 - 00000020 ___SH C:\Users\Temp\ntuser.ini
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Vorlagen
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Startmenü
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Netzwerkumgebung
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Lokale Einstellungen
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Eigene Dateien
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Druckumgebung
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Documents\Eigene Musik
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Documents\Eigene Bilder
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\AppData\Local\Verlauf
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\AppData\Local\Anwendungsdaten
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Anwendungsdaten
2013-11-11 18:10 - 2011-06-19 02:20 - 00000000 ____D C:\Users\Temp\Documents\Visual Studio 2008
2013-11-11 18:10 - 2011-06-19 02:20 - 00000000 ____D C:\Users\Temp\AppData\Local\Microsoft Help
2013-11-11 18:10 - 2009-07-14 05:54 - 00000000 ___RD C:\Users\Temp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-11-11 18:10 - 2009-07-14 05:49 - 00000000 ___RD C:\Users\Temp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2013-11-11 17:09 - 2013-11-11 17:09 - 00156192 _____ C:\Users\****\Desktop\cc_20131111_170852.reg
2013-11-11 17:02 - 2013-11-11 17:02 - 00002770 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2013-11-11 17:02 - 2013-11-11 17:02 - 00000834 _____ C:\Users\Public\Desktop\CCleaner.lnk
2013-11-11 17:02 - 2013-11-11 17:02 - 00000000 ____D C:\Program Files\CCleaner
2013-11-11 16:12 - 2013-11-11 17:13 - 00000000 ____D C:\Windows\pss
2013-11-11 13:57 - 2013-11-11 13:57 - 00001121 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-11-11 13:57 - 2013-11-11 13:57 - 00000000 ____D C:\Users\****\AppData\Roaming\Malwarebytes
2013-11-11 13:57 - 2013-11-11 13:57 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-11 13:57 - 2013-11-11 13:57 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-11-11 13:57 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-10-16 21:13 - 2013-11-10 10:26 - 95025368 ____T C:\ProgramData\fwl1lbo.pff
2013-10-16 21:13 - 2013-11-10 10:26 - 00000000 _____ C:\ProgramData\fwl1lbo.ctrl
2013-10-15 17:31 - 2013-09-23 00:28 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-10-15 17:31 - 2013-09-23 00:28 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-10-15 17:31 - 2013-09-23 00:27 - 14335488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-10-15 17:31 - 2013-09-23 00:27 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-10-15 17:31 - 2013-09-23 00:27 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-10-15 17:31 - 2013-09-23 00:27 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-10-15 17:31 - 2013-09-23 00:27 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-10-15 17:31 - 2013-09-23 00:27 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-10-15 17:31 - 2013-09-23 00:27 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-10-15 17:31 - 2013-09-23 00:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-10-15 17:31 - 2013-09-23 00:27 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-10-15 17:31 - 2013-09-23 00:27 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-10-15 17:31 - 2013-09-23 00:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-10-15 17:31 - 2013-09-22 23:55 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-10-15 17:31 - 2013-09-22 23:55 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-10-15 17:31 - 2013-09-22 23:55 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-10-15 17:31 - 2013-09-22 23:54 - 19252224 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-10-15 17:31 - 2013-09-22 23:54 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-10-15 17:31 - 2013-09-22 23:54 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-10-15 17:31 - 2013-09-22 23:54 - 02647552 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-10-15 17:31 - 2013-09-22 23:54 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-10-15 17:31 - 2013-09-22 23:54 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-10-15 17:31 - 2013-09-22 23:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-10-15 17:31 - 2013-09-22 23:54 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-10-15 17:31 - 2013-09-22 23:54 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-10-15 17:31 - 2013-09-22 23:54 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-10-15 17:31 - 2013-09-22 23:54 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-10-15 17:31 - 2013-09-21 04:38 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-10-15 17:31 - 2013-09-21 04:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-10-15 17:31 - 2013-09-21 03:48 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-10-15 17:31 - 2013-09-21 03:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-10-15 17:03 - 2013-09-14 02:10 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-10-15 17:03 - 2013-09-08 03:30 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-10-15 17:03 - 2013-09-08 03:27 - 00327168 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2013-10-15 17:03 - 2013-09-08 03:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswsock.dll
2013-10-15 17:03 - 2013-08-28 02:21 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-10-15 17:03 - 2013-07-12 11:41 - 00185344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys
2013-10-15 17:03 - 2013-07-12 11:41 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
2013-10-15 17:03 - 2013-07-12 11:40 - 00109824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBAUDIO.sys
2013-10-15 17:03 - 2013-07-04 13:57 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2013-10-15 17:03 - 2013-07-04 13:50 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2013-10-15 17:03 - 2013-07-04 13:50 - 00102400 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2013-10-15 17:03 - 2013-07-04 12:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll
2013-10-15 17:03 - 2013-07-04 12:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll
2013-10-15 17:03 - 2013-07-04 12:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2013-10-15 17:03 - 2013-07-04 11:11 - 00140800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2013-10-15 17:03 - 2013-07-03 05:40 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys
2013-10-15 17:03 - 2013-07-03 05:05 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2013-10-15 17:03 - 2013-07-03 05:05 - 00032896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2013-10-15 17:03 - 2013-06-25 23:55 - 00785624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2013-10-15 17:03 - 2013-06-06 06:50 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2013-10-15 17:03 - 2013-06-06 06:49 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2013-10-15 17:03 - 2013-06-06 06:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2013-10-15 17:03 - 2013-06-06 06:47 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2013-10-15 17:03 - 2013-06-06 05:57 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2013-10-15 17:03 - 2013-06-06 05:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2013-10-15 17:03 - 2013-06-06 05:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2013-10-15 17:03 - 2013-06-06 04:30 - 00368128 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-10-15 17:03 - 2013-06-06 04:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2013-10-15 17:03 - 2013-06-06 04:01 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2013-10-15 17:02 - 2013-08-29 03:17 - 05549504 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-10-15 17:02 - 2013-08-29 03:16 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-10-15 17:02 - 2013-08-29 03:16 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2013-10-15 17:02 - 2013-08-29 03:16 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-10-15 17:02 - 2013-08-29 03:13 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2013-10-15 17:02 - 2013-08-29 02:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-10-15 17:02 - 2013-08-29 02:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-10-15 17:02 - 2013-08-29 02:50 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-10-15 17:02 - 2013-08-29 02:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2013-10-15 17:02 - 2013-08-29 02:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-10-15 17:02 - 2013-08-29 02:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2013-10-15 17:02 - 2013-08-29 01:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-10-15 17:02 - 2013-08-29 01:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-10-15 17:02 - 2013-08-29 01:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-10-15 17:02 - 2013-08-29 01:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-10-15 17:02 - 2013-08-28 02:12 - 00461312 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll
2013-10-15 17:02 - 2013-08-01 13:09 - 00983488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-10-15 17:02 - 2013-07-20 11:33 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-15 17:02 - 2013-07-20 11:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
==================== One Month Modified Files and Folders =======
2013-11-12 11:29 - 2013-11-12 11:29 - 01957590 _____ (Farbar) C:\Users\****\Desktop\FRST64.exe
2013-11-12 11:29 - 2013-11-12 11:29 - 00000000 ____D C:\FRST
2013-11-12 11:28 - 2013-11-12 11:27 - 00000470 _____ C:\Users\****\Desktop\defogger_disable.log
2013-11-12 11:27 - 2013-11-12 11:27 - 00000000 _____ C:\Users\****\defogger_reenable
2013-11-12 11:27 - 2010-12-17 13:50 - 00000000 ____D C:\Users\****
2013-11-12 11:24 - 2013-11-12 11:24 - 00050477 _____ C:\Users\****\Desktop\Defogger.exe
2013-11-12 11:20 - 2010-12-17 13:50 - 01402820 _____ C:\Windows\WindowsUpdate.log
2013-11-12 11:20 - 2009-07-14 05:45 - 00013440 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-12 11:20 - 2009-07-14 05:45 - 00013440 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-12 11:18 - 2012-05-03 08:45 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-12 11:12 - 2013-11-11 19:22 - 00000168 _____ C:\Windows\setupact.log
2013-11-12 11:12 - 2013-04-20 13:21 - 00031088 _____ (GbPlugin NDIS Device Driver) C:\Windows\SysWOW64\Drivers\gbpndisrd.sys
2013-11-12 11:12 - 2013-04-20 13:21 - 00010266 _____ C:\Windows\SysWOW64\Drivers\ndisrd.cat
2013-11-12 11:12 - 2013-04-20 13:21 - 00001402 _____ C:\Windows\SysWOW64\Drivers\gas.cer
2013-11-12 11:12 - 2013-03-24 10:06 - 00000000 ____D C:\ProgramData\GbPlugin
2013-11-12 11:12 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-11 23:01 - 2011-06-07 11:48 - 00001116 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2200878598-3108500986-400413442-1000UA.job
2013-11-11 22:33 - 2013-11-11 22:33 - 00000000 ____D C:\ProgramData\Oracle
2013-11-11 22:32 - 2013-11-11 22:35 - 00873384 _____ (Oracle Corporation) C:\Windows\SysWOW64\npdeployJava1.dll
2013-11-11 22:32 - 2013-11-11 22:35 - 00796072 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2013-11-11 22:32 - 2013-11-11 22:32 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-11-11 22:32 - 2012-10-27 12:59 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-11-11 22:32 - 2012-10-27 12:59 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-11-11 22:32 - 2012-10-27 12:59 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-11-11 22:32 - 2011-01-17 22:03 - 00000000 ____D C:\Program Files (x86)\Java
2013-11-11 22:30 - 2013-11-11 20:05 - 00001912 _____ C:\Windows\epplauncher.mif
2013-11-11 19:49 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-11-11 19:22 - 2013-11-11 19:22 - 00000000 _____ C:\Windows\setuperr.log
2013-11-11 19:20 - 2013-11-11 19:00 - 00002579 _____ C:\Users\****\Desktop\Hkey.reg
2013-11-11 18:37 - 2013-11-11 18:37 - 00000193 _____ C:\Windows\wininit.ini
2013-11-11 18:37 - 2013-11-11 18:17 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-11-11 18:17 - 2013-11-11 18:17 - 00001391 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2013-11-11 18:17 - 2013-11-11 18:17 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking
2013-11-11 18:17 - 2013-11-11 18:16 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2013-11-11 18:13 - 2013-11-11 18:13 - 00000000 ____D C:\Users\Temp\AppData\Roaming\Macromedia
2013-11-11 18:12 - 2013-11-11 18:12 - 00000000 ____D C:\Users\Temp\AppData\Roaming\TFPU
2013-11-11 18:12 - 2013-11-11 18:11 - 00000000 ____D C:\Users\Temp\AppData\Local\Toshiba
2013-11-11 18:11 - 2013-11-11 18:11 - 00118048 _____ C:\Users\Temp\AppData\Local\GDIPFONTCACHEV1.DAT
2013-11-11 18:11 - 2013-11-11 18:11 - 00001433 _____ C:\Users\Temp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ___RD C:\Users\Temp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ___RD C:\Users\Temp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ____D C:\Users\Temp\Documents\Bluetooth
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ____D C:\Users\Temp\AppData\Roaming\Steganos
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ____D C:\Users\Temp\AppData\Roaming\Intel Corporation
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ____D C:\Users\Temp\AppData\Roaming\Avira
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ____D C:\Users\Temp\AppData\Roaming\Apple Computer
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ____D C:\Users\Temp\AppData\Roaming\Adobe
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ____D C:\Users\Temp\AppData\Local\VirtualStore
2013-11-11 18:10 - 2013-11-11 18:10 - 00000020 ___SH C:\Users\Temp\ntuser.ini
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Vorlagen
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Startmenü
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Netzwerkumgebung
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Lokale Einstellungen
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Eigene Dateien
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Druckumgebung
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Documents\Eigene Musik
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Documents\Eigene Bilder
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\AppData\Local\Verlauf
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\AppData\Local\Anwendungsdaten
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Anwendungsdaten
2013-11-11 17:13 - 2013-11-11 16:12 - 00000000 ____D C:\Windows\pss
2013-11-11 17:09 - 2013-11-11 17:09 - 00156192 _____ C:\Users\****\Desktop\cc_20131111_170852.reg
2013-11-11 17:07 - 2012-10-07 08:40 - 00000000 ____D C:\Windows\Minidump
2013-11-11 17:07 - 2012-09-26 19:50 - 00000000 ____D C:\Users\****\AppData\Roaming\uTorrent
2013-11-11 17:07 - 2010-12-26 14:17 - 00000000 ____D C:\Users\****\AppData\Roaming\Skype
2013-11-11 17:07 - 2010-12-17 13:42 - 00000000 ____D C:\Windows\Panther
2013-11-11 17:02 - 2013-11-11 17:02 - 00002770 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2013-11-11 17:02 - 2013-11-11 17:02 - 00000834 _____ C:\Users\Public\Desktop\CCleaner.lnk
2013-11-11 17:02 - 2013-11-11 17:02 - 00000000 ____D C:\Program Files\CCleaner
2013-11-11 16:47 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-11-11 16:28 - 2012-09-26 19:55 - 00000000 ____D C:\Users\****\AppData\Local\Conduit
2013-11-11 16:19 - 2011-04-17 07:27 - 00000000 ____D C:\Windows\system32\appmgmt
2013-11-11 16:13 - 2012-05-14 08:52 - 00000000 ____D C:\Program Files\Google
2013-11-11 16:13 - 2012-05-14 08:50 - 00000000 ____D C:\Program Files (x86)\Google
2013-11-11 16:12 - 2010-12-17 13:50 - 00000000 ___RD C:\Users\****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-11-11 16:06 - 2012-05-14 08:50 - 00000000 ____D C:\ProgramData\Google
2013-11-11 16:06 - 2011-04-17 07:23 - 00000000 ____D C:\Users\****\AppData\Local\Google
2013-11-11 16:04 - 2013-09-18 09:36 - 00000000 ____D C:\Program Files (x86)\Movies Toolbar
2013-11-11 16:03 - 2013-03-24 10:06 - 00000000 ____D C:\Program Files (x86)\GbPlugin
2013-11-11 16:02 - 2013-04-09 13:33 - 00000000 ____D C:\ProgramData\Wincert
2013-11-11 16:02 - 2013-04-09 13:32 - 00000000 ____D C:\Program Files (x86)\Search Results Toolbar
2013-11-11 14:26 - 2012-08-02 11:43 - 00003630 _____ C:\Windows\mozy.blk
2013-11-11 14:26 - 2012-08-02 11:43 - 00003498 _____ C:\Windows\mozy.flt
2013-11-11 13:58 - 2010-12-17 16:36 - 00003922 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{3E05B566-424F-4E42-9BD8-AFFA959CC984}
2013-11-11 13:57 - 2013-11-11 13:57 - 00001121 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-11-11 13:57 - 2013-11-11 13:57 - 00000000 ____D C:\Users\****\AppData\Roaming\Malwarebytes
2013-11-11 13:57 - 2013-11-11 13:57 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-11 13:57 - 2013-11-11 13:57 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-11-11 01:38 - 2010-12-17 17:14 - 00000000 __SHD C:\ProgramData\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}
2013-11-10 10:26 - 2013-10-16 21:13 - 95025368 ____T C:\ProgramData\fwl1lbo.pff
2013-11-10 10:26 - 2013-10-16 21:13 - 00000000 _____ C:\ProgramData\fwl1lbo.ctrl
2013-10-21 12:00 - 2011-06-07 11:48 - 00001064 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2200878598-3108500986-400413442-1000Core.job
2013-10-21 11:56 - 2011-06-07 11:48 - 00004084 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2200878598-3108500986-400413442-1000UA
2013-10-21 11:56 - 2011-06-07 11:48 - 00003688 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2200878598-3108500986-400413442-1000Core
2013-10-16 10:18 - 2012-05-03 08:45 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-10-16 10:18 - 2012-05-03 08:45 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-10-16 10:18 - 2011-05-17 04:13 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-10-16 09:48 - 2009-07-14 18:58 - 00659238 _____ C:\Windows\system32\perfh007.dat
2013-10-16 09:48 - 2009-07-14 18:58 - 00132776 _____ C:\Windows\system32\perfc007.dat
2013-10-16 09:48 - 2009-07-14 06:13 - 01512418 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-16 09:41 - 2009-07-14 05:45 - 00427392 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-16 09:35 - 2013-03-14 14:01 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-10-16 09:35 - 2013-03-14 14:01 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-10-15 17:34 - 2010-12-17 17:05 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-10-15 17:26 - 2013-08-31 22:10 - 00000000 ____D C:\Windows\system32\MRT
2013-10-15 17:25 - 2010-12-17 16:21 - 80541720 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
Files to move or delete:
====================
C:\Users\****\AppData\Roaming\skype.ini
C:\ProgramData\fwl1lbo.ctrl
C:\ProgramData\fwl1lbo.pff
C:\Users\****\WinZip155.exe
Some content of TEMP:
====================
C:\Users\****\AppData\Local\Temp\tbuTo0.dll
C:\Users\****\AppData\Local\Temp\UNINSTALL.EXE
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-11-11 19:40
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 10-11-2013 01 Ran by **** at 2013-11-12 11:31:13 Running from C:\Users\****\Desktop Boot Mode: Normal ========================================================== ==================== Security Center ======================== ==================== Installed Programs ====================== µTorrent (HKCU Version: 3.3.1.30017) Acronis*True*Image*Home (x32 Version: 11.0.8010) Adobe Acrobat 5.0 (x32 Version: 5.0) Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.117) Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.117) Adobe Reader X (10.1.8) - Deutsch (x32 Version: 10.1.8) AnyDVD (x32 Version: 6.7.6.0) Apple Application Support (x32 Version: 2.3.6) Apple Mobile Device Support (Version: 7.0.0.117) Apple Software Update (x32 Version: 2.1.3.127) Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (x32 Version: 1.0.0.22) ATI Catalyst Install Manager (Version: 3.0.800.0) AuthenTec Fingerprint Software (Version: 8.5.5.6) Avira Internet Security (x32 Version: 13.0.0.4052) Bluetooth Monitor 4 (x32 Version: 4.05.000) Bluetooth Stack for Windows by Toshiba (Version: v8.00.02(T)) Bonjour (Version: 3.0.0.10) CCleaner (Version: 4.07) Cisco EAP-FAST Module (x32 Version: 2.2.14) Cisco LEAP Module (x32 Version: 1.0.19) Cisco PEAP Module (x32 Version: 1.1.6) Conexant HD Audio (Version: 4.126.0.62) Corel Graphics - Windows Shell Extension (x32 Version: 15.0.0.487) Corel Graphics - Windows Shell Extension (x32 Version: 15.0.487) CorelDRAW Graphics Suite X5 - Capture (x32 Version: 15.0) CorelDRAW Graphics Suite X5 - Common (x32 Version: 15.0) CorelDRAW Graphics Suite X5 - Connect (x32 Version: 15.0) CorelDRAW Graphics Suite X5 - Custom Data (x32 Version: 15.0) CorelDRAW Graphics Suite X5 - DE (x32 Version: 15.0) CorelDRAW Graphics Suite X5 - Draw (x32 Version: 15.0) CorelDRAW Graphics Suite X5 - Filters (x32 Version: 15.0) CorelDRAW Graphics Suite X5 - FontNav (x32 Version: 15.0) CorelDRAW Graphics Suite X5 - IPM (x32 Version: 15.0) CorelDRAW Graphics Suite X5 - PHOTO-PAINT (x32 Version: 15.0) CorelDRAW Graphics Suite X5 - Photozoom Plugin (x32 Version: 15.0) CorelDRAW Graphics Suite X5 - Redist (x32 Version: 15.0) CorelDRAW Graphics Suite X5 - Setup Files (x32 Version: 15.0) CorelDRAW Graphics Suite X5 - VBA (x32 Version: 15.0) CorelDRAW Graphics Suite X5 - VideoBrowser (x32 Version: 15.0) CorelDRAW Graphics Suite X5 - VSTA (x32 Version: 15.0) CorelDRAW Graphics Suite X5 - Windows Shell Extension 64 Bit (Version: 15.0.487) CorelDRAW Graphics Suite X5 - WT (x32 Version: 15.0) CorelDRAW Graphics Suite X5 (x32 Version: 15.0) CorelDRAW(R) Graphics Suite X5 (x32 Version: 15.0.0.486) Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32) Driver Genius Professional Edition (x32 Version: 10.0) Google Talk Plugin (x32 Version: 4.7.0.15362) Hotfix für Microsoft Visual Studio 2007 Tools for Applications - ENU (KB947789) (x32 Version: 1) HP Officejet Pro 8500 A910 - Grundlegende Software für das Gerät (Version: 22.0.334.0) HP Officejet Pro 8500 A910 Hilfe (x32 Version: 140.0.2.2) hp print screen utility (x32) HP Update (x32 Version: 5.002.005.003) I.R.I.S. OCR (x32 Version: 12.3.4) Intel(R) Rapid Storage Technology (x32 Version: 10.1.0.1008) iTunes (Version: 11.1.0.126) Java 7 Update 45 (x32 Version: 7.0.450) Java Auto Updater (x32 Version: 2.1.9.8) JNLP (HKCU) Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300) Marketsplash Schnellzugriffe (x32 Version: 1.0.0.9) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319) Microsoft Office 2010 Service Pack 1 (SP1) (x32) Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Office 64-bit Components 2010 (Version: 14.0.6029.1000) Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Professional 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Proof (English) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Proof (French) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Proof (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.6029.1000) Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Single Image 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.6029.1000) Microsoft Silverlight (Version: 5.1.20913.0) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001) Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (Version: 9.0.30729.5570) Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (x32 Version: 9.0.30729.5570) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219) Microsoft Visual Studio Tools for Applications 2.0 - ENU (x32 Version: 9.0.30729) Microsoft Visual Studio Tools for Applications 2.0 Language Pack - DEU (x32 Version: 9.0.30729) Microsoft Visual Studio Tools for Applications 2.0 Runtime (x32 Version: 9.0.30729) Microsoft Visual Studio Tools for Applications 2.0 Runtime Language Pack - DEU (x32 Version: 9.0.30729) MozyHome (Version: 2.16.0.215) MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0) MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0) My Driver Updater v3.0 (x32 Version: 3.0) Nero 10 Menu TemplatePack Basic (x32 Version: 10.2.10000.0.0) Nero 10 Movie ThemePack Basic (x32 Version: 10.2.10000.0.0) Nero 12 (x32 Version: 12.0.03500) Nero 12 Content Pack (x32 Version: 12.0.00400) Nero Abstract Themes (x32 Version: 12.0.11500) Nero Audio Pack 1 (x32 Version: 11.0.11500.110.0) Nero BackItUp (x32 Version: 12.5.7000) Nero BackItUp 10 (x32 Version: 5.6.11000.11.100) Nero BackItUp 10 Help (CHM) (x32 Version: 10.5.10000) Nero BackItUp Help (CHM) (x32 Version: 12.0.13000) Nero Blu-ray Player (x32 Version: 12.0.20030) Nero Blu-ray Player Help (CHM) (x32 Version: 12.0.9000) Nero Burning ROM (x32 Version: 12.5.6000) Nero Burning ROM 10 (x32 Version: 10.2.11000.12.100) Nero Burning ROM Help (CHM) (x32 Version: 12.0.3000) Nero BurningROM 10 Help (CHM) (x32 Version: 10.5.10100) Nero BurnRights 10 (x32 Version: 4.2.10300.0.102) Nero BurnRights 10 Help (CHM) (x32 Version: 10.5.10000) Nero Cliparts (x32 Version: 12.0.11500) Nero Control Center 10 (x32 Version: 10.2.10600.0.6) Nero ControlCenter (x32 Version: 11.0.15600) Nero ControlCenter 10 Help (CHM) (x32 Version: 10.5.10000) Nero ControlCenter Help (CHM) (x32 Version: 12.0.12000) Nero Core Components (x32 Version: 11.0.21800) Nero Core Components 10 (x32 Version: 2.0.17400.8.2) Nero CoverDesigner 10 (x32 Version: 5.2.10700.7.100) Nero CoverDesigner 10 Help (CHM) (x32 Version: 10.5.10000) Nero Disc Menus 1 (x32 Version: 12.0.11500) Nero Disc Menus 2 (x32 Version: 12.0.11500) Nero Disc Menus 3 (x32 Version: 12.0.11500) Nero Disc Menus Basic (x32 Version: 12.0.11500) Nero DiscSpeed 10 (x32 Version: 6.2.10300.1.100) Nero DiscSpeed 10 Help (CHM) (x32 Version: 10.5.10000) Nero Effects Basic (x32 Version: 12.0.11500) Nero Express (x32 Version: 12.5.7000) Nero Express 10 (x32 Version: 10.2.11100.12.100) Nero Express 10 Help (CHM) (x32 Version: 10.5.10100) Nero Express Help (CHM) (x32 Version: 12.0.13000) Nero Family and Events Themes (x32 Version: 12.0.11500) Nero Football (Soccer) Themes (x32 Version: 12.0.11500) Nero Holiday and Sports Themes (x32 Version: 12.0.11500) Nero Image Samples (x32 Version: 12.0.11500) Nero InfoTool 10 (x32 Version: 7.2.10300.5.100) Nero InfoTool 10 Help (CHM) (x32 Version: 10.5.10000) Nero Kwik Media (x32 Version: 1.18.20100) Nero Kwik Media Help (CHM) (x32 Version: 12.0.12000) Nero Kwik Themes Basic (x32 Version: 12.0.11500) Nero Multimedia Suite 10 (x32 Version: 10.5.10500) Nero PiP Effects 1 (x32 Version: 12.0.11500) Nero PiP Effects Basic (x32 Version: 12.0.11500) Nero Platinum Effects 12 (x32 Version: 12.0.11500) Nero Recode (x32 Version: 12.5.6000) Nero Recode 10 (x32 Version: 4.8.10400.3.100) Nero Recode 10 Help (CHM) (x32 Version: 10.5.10000) Nero Recode Help (CHM) (x32 Version: 12.0.12000) Nero RescueAgent (x32 Version: 12.0.11000) Nero RescueAgent 10 (x32 Version: 3.2.10600.7.100) Nero RescueAgent 10 Help (CHM) (x32 Version: 10.5.10000) Nero RescueAgent Help (CHM) (x32 Version: 12.0.7000) Nero Retro Film Themes (x32 Version: 12.0.11700) Nero SharedVideoCodecs (x32 Version: 1.0.12100.2.0) Nero SoundTrax 10 (x32 Version: 4.8.10200.1.100) Nero SoundTrax 10 Help (CHM) (x32 Version: 10.5.10000) Nero StartSmart 10 (x32 Version: 10.2.11100.10.100) Nero StartSmart 10 Help (CHM) (x32 Version: 10.5.10000) Nero Update (x32 Version: 11.0.11800.31.0) Nero Video (x32 Version: 12.5.4000) Nero Video Help (CHM) (x32 Version: 12.0.12000) Nero Video Samples (x32 Version: 12.0.11500) Nero Video Transitions 1 (x32 Version: 12.0.11500) Nero Vision 10 (x32 Version: 7.2.14700.9.100) Nero Vision 10 Help (CHM) (x32 Version: 10.5.10000) Nero WaveEditor 10 (x32 Version: 5.8.10400.2.100) Nero WaveEditor 10 Help (CHM) (x32 Version: 10.5.10000) NVIDIA Display Control Panel (Version: 6.14.12.5912) NVIDIA Drivers (Version: 1.10.62.40) NVIDIA PhysX (x32 Version: 9.10.0224) O2Micro Flash Memory Card Windows Driver (Version: 2.0.46) O2Micro Flash Memory Card Windows Driver (x32 Version: 2.0.46) pdfforge Toolbar v7.6 (x32 Version: 7.6) Prerequisite installer (x32 Version: 12.0.0003) QuickTime (x32 Version: 7.74.80.86) Realtek WLAN Driver (x32 Version: 2.00.0006) Skype Click to Call (x32 Version: 6.3.11079) Skype™ 6.7 (x32 Version: 6.7.102) Spybot - Search & Destroy (x32 Version: 2.1.21) Steganos Safe 14 (x32 Version: 14.0.4) Studie zur Verbesserung von HP Officejet Pro 8500 A910 Produkten (Version: 22.0.334.0) TFPU (Version: 1.0.0) ThinkPad Wireless LAN Adapter Software (x32 Version: 1.00.0029.2) TOSHIBA Bulletin Board (Version: 1.6.08.64) TOSHIBA Bulletin Board (x32 Version: 1.6.08.64) TOSHIBA ConfigFree (x32 Version: 8.0.30) TOSHIBA Fingerprint Utility (Version: 1.0.2.29) TOSHIBA HDD Protection (Version: 2.2.0.4) TOSHIBA Supervisor Password (Version: 4.02.01.00) TOSHIBA Supervisor Password (x32 Version: 4.02.01.00) TOSHIBA TEMPRO (x32 Version: 3.34) TOSHIBA Web Camera Application (x32 Version: 1.1.1.16) TuneUp Utilities 2011 (x32 Version: 10.0.4600.4) TuneUp Utilities Language Pack (de-DE) (x32 Version: 10.0.4600.4) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2473228) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3) Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (x32) Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2494150) (x32) Update for Microsoft Office 2010 (KB2553065) (x32) Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2553270) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2566458) (x32) Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2687503) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition (x32) Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition (x32) Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition (x32) Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition (x32) Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition (x32) Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (x32) Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition (x32) Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (x32) Update for Microsoft Word 2010 (KB2827323) 32-Bit Edition (x32) Visual Basic for Applications (R) Core - English (x32 Version: 6.4.99.69) Visual Basic for Applications (R) Core - German (x32 Version: 6.4.99.69) Visual Basic for Applications (R) Core (x32 Version: 6.4.99.69) VLC media player 1.0.1 (x32 Version: 1.0.1) Welcome App (Start-up experience) (x32 Version: 12.0.15000) Windows Live ID Sign-in Assistant (Version: 6.500.3165.0) WinZip 15.5 (x32 Version: 15.5.9580) ==================== Restore Points ========================= Could not list Restore Points. Check WMI. ==================== Hosts content: ========================== 2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: {2D91BF06-669E-40A5-A189-8C568B188B08} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.) Task: {2F2260F8-824C-442A-83AD-A53BA17F2879} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe Task: {3F4A0B98-200E-4DD5-A974-357CC5B9A9D1} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-23] (Microsoft Corporation) Task: {44BE5261-FDC1-441D-95D3-B2E80076984C} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2013-07-02] (Oracle Corporation) Task: {48E2E6C1-00EB-4F4A-887A-FB17EFB423BA} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2011 => C:\Program Files (x86)\TuneUp Utilities 2011\OneClick.exe [2011-12-13] (TuneUp Software) Task: {4A89B471-61E9-47DC-915C-4E7BAEDF247E} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc Task: {6F252F5F-E425-462A-A9F2-14FEFA3BA57C} - System32\Tasks\ConfigFree Startup Programs => C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe [2010-05-06] (TOSHIBA CORPORATION) Task: {79D72E36-43DF-4124-B9BB-BAF81D48FA90} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2200878598-3108500986-400413442-1000Core => C:\Users\****\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-07] (Google Inc.) Task: {7AE077AA-D982-4611-9037-4FADAC8B73F5} - System32\Tasks\HP-Online-Aktualisierungsprogramm => C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe [2010-03-12] (Hewlett-Packard) Task: {892A7C19-BBD8-46B9-A909-448B331C8A4F} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe Task: {8D458BD0-289F-4B0B-9123-0A0B985C4B28} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe Task: {9FD95489-814E-4598-94BB-BF2C1BB23F14} - System32\Tasks\Google Updater and Installer => C:\Users\****\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-07] (Google Inc.) Task: {AFAF5612-7138-4A62-A12B-8A87E288D4BD} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2200878598-3108500986-400413442-1000UA => C:\Users\****\AppData\Local\Google\Update\GoogleUpdate.exe [2011-06-07] (Google Inc.) Task: {B2825274-0FF2-4011-8963-57A079B8CE1F} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-04-04] (Adobe Systems Incorporated) Task: {BD4C85D8-FEAE-4100-8DF0-1378F1690569} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-16] (Adobe Systems Incorporated) Task: {DA495C4C-96D1-4E95-BA41-326DA7397F90} - System32\Tasks\HPCustParticipation HP Officejet Pro 8500 A910 => C:\Program Files\HP\HP Officejet Pro 8500 A910\Bin\HPCustPartic.exe [2010-06-14] (Hewlett-Packard Co.) Task: {E0548D08-C2C5-4A63-A6B8-68A8864EFA52} - System32\Tasks\{397A41EF-4B83-4C62-86C9-1A6924D92332} => C:\Program Files (x86)\Skype\\Phone\Skype.exe [2013-07-25] (Skype Technologies S.A.) Task: {EFE8AB58-9451-44FA-88BD-A2CF49C9443D} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-10-22] (Piriform Ltd) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2200878598-3108500986-400413442-1000Core.job => C:\Users\****\AppData\Local\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2200878598-3108500986-400413442-1000UA.job => C:\Users\****\AppData\Local\Google\Update\GoogleUpdate.exe ==================== Loaded Modules (whitelisted) ============= ==================== Alternate Data Streams (whitelisted) ========= AlternateDataStreams: C:\Windows\System32:3E8B0037_Uni.gbp ==================== Safe Mode (whitelisted) =================== ==================== Faulty Device Manager Devices ============= Could not list Devices. Check WMI. ==================== Event log errors: ========================= Application errors: ================== Error: (11/12/2013 11:17:45 AM) (Source: MsiInstaller) (User: ****-PC) Description: Product: pdfforge Toolbar v8.1 -- Error 1714.The older version of pdfforge Toolbar v8.1 cannot be removed. Contact your technical support group. System Error 1612. Error: (11/12/2013 11:12:19 AM) (Source: Avira FireWall) (User: ) Description: Fehler beim Erstellen KDrvLogger::_StartThread Error: (11/12/2013 11:12:19 AM) (Source: Avira FireWall) (User: ) Description: Fehler beim Erstellen AVEvtLog_Init FAILED Versioncheck failed. Error: (11/11/2013 07:54:48 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: loggingserver.exe, Version: 17.0.1.12, Zeitstempel: 0x51d41c91 Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea8e7 Ausnahmecode: 0xc0000005 Fehleroffset: 0x000332b0 ID des fehlerhaften Prozesses: 0xbf4 Startzeit der fehlerhaften Anwendung: 0xloggingserver.exe0 Pfad der fehlerhaften Anwendung: loggingserver.exe1 Pfad des fehlerhaften Moduls: loggingserver.exe2 Berichtskennung: loggingserver.exe3 Error: (11/11/2013 07:54:24 PM) (Source: Avira FireWall) (User: ) Description: Fehler beim Erstellen KDrvLogger::_StartThread Error: (11/11/2013 07:54:24 PM) (Source: Avira FireWall) (User: ) Description: Fehler beim Erstellen AVEvtLog_Init FAILED Versioncheck failed. Error: (11/11/2013 07:41:21 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "NFD,type="win32",version="5.2.0.0"1". Fehler in Manifest- oder Richtliniendatei "NFD,type="win32",version="5.2.0.0"2" in Zeile NFD,type="win32",version="5.2.0.0"3. Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein. Verweis: NFD,type="win32",version="5.2.0.0". Definition: NFD,type="win32",version="5.0.0.0". Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose. Error: (11/11/2013 07:22:42 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: loggingserver.exe, Version: 17.0.1.12, Zeitstempel: 0x51d41c91 Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea8e7 Ausnahmecode: 0xc0000005 Fehleroffset: 0x000332b0 ID des fehlerhaften Prozesses: 0xbf0 Startzeit der fehlerhaften Anwendung: 0xloggingserver.exe0 Pfad der fehlerhaften Anwendung: loggingserver.exe1 Pfad des fehlerhaften Moduls: loggingserver.exe2 Berichtskennung: loggingserver.exe3 Error: (11/11/2013 07:22:11 PM) (Source: Avira FireWall) (User: ) Description: Fehler beim Erstellen KDrvLogger::_StartThread Error: (11/11/2013 07:22:11 PM) (Source: Avira FireWall) (User: ) Description: Fehler beim Erstellen AVEvtLog_Init FAILED Versioncheck failed. System errors: ============= Error: (11/12/2013 11:34:43 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Windows-Verwaltungsinstrumentation" wurde mit folgendem Fehler beendet: %%126 Error: (11/12/2013 11:34:13 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Windows-Verwaltungsinstrumentation" wurde mit folgendem Fehler beendet: %%126 Error: (11/12/2013 11:33:43 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Windows-Verwaltungsinstrumentation" wurde mit folgendem Fehler beendet: %%126 Error: (11/12/2013 11:33:13 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Windows-Verwaltungsinstrumentation" wurde mit folgendem Fehler beendet: %%126 Error: (11/12/2013 11:32:43 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Windows-Verwaltungsinstrumentation" wurde mit folgendem Fehler beendet: %%126 Error: (11/12/2013 11:32:13 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Windows-Verwaltungsinstrumentation" wurde mit folgendem Fehler beendet: %%126 Error: (11/12/2013 11:31:43 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Windows-Verwaltungsinstrumentation" wurde mit folgendem Fehler beendet: %%126 Error: (11/12/2013 11:31:13 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Windows-Verwaltungsinstrumentation" wurde mit folgendem Fehler beendet: %%126 Error: (11/12/2013 11:30:21 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Windows-Verwaltungsinstrumentation" wurde mit folgendem Fehler beendet: %%126 Error: (11/12/2013 11:24:01 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Windows-Verwaltungsinstrumentation" wurde mit folgendem Fehler beendet: %%126 Microsoft Office Sessions: ========================= Error: (11/12/2013 11:17:45 AM) (Source: MsiInstaller)(User: ****-PC) Description: Product: pdfforge Toolbar v8.1 -- Error 1714.The older version of pdfforge Toolbar v8.1 cannot be removed. Contact your technical support group. System Error 1612.(NULL)(NULL)(NULL)(NULL)(NULL) Error: (11/12/2013 11:12:19 AM) (Source: Avira FireWall)(User: ) Description: Fehler beim Erstellen KDrvLogger::_StartThread Error: (11/12/2013 11:12:19 AM) (Source: Avira FireWall)(User: ) Description: Fehler beim Erstellen AVEvtLog_Init FAILED Versioncheck failed. Error: (11/11/2013 07:54:48 PM) (Source: Application Error)(User: ) Description: loggingserver.exe17.0.1.1251d41c91ntdll.dll6.1.7601.18247521ea8e7c0000005000332b0bf401cedf0f77dc2ce3C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\17.0.12\loggingserver.exeC:\Windows\SysWOW64\ntdll.dllbc656f4d-4b02-11e3-bcb8-60eb6983875b Error: (11/11/2013 07:54:24 PM) (Source: Avira FireWall)(User: ) Description: Fehler beim Erstellen KDrvLogger::_StartThread Error: (11/11/2013 07:54:24 PM) (Source: Avira FireWall)(User: ) Description: Fehler beim Erstellen AVEvtLog_Init FAILED Versioncheck failed. Error: (11/11/2013 07:41:21 PM) (Source: SideBySide)(User: ) Description: NFD,type="win32",version="5.2.0.0"NFD,type="win32",version="5.0.0.0"C:\Program Files (x86)\Nero\Nero 10\Nero SoundTrax\NMDllHost.exe.ManifestC:\Program Files (x86)\Nero\Nero 10\Nero SoundTrax\NFD\NFD.MANIFEST3 Error: (11/11/2013 07:22:42 PM) (Source: Application Error)(User: ) Description: loggingserver.exe17.0.1.1251d41c91ntdll.dll6.1.7601.18247521ea8e7c0000005000332b0bf001cedf0afb32d5e5C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\17.0.12\loggingserver.exeC:\Windows\SysWOW64\ntdll.dll4041655f-4afe-11e3-9588-60eb6983875b Error: (11/11/2013 07:22:11 PM) (Source: Avira FireWall)(User: ) Description: Fehler beim Erstellen KDrvLogger::_StartThread Error: (11/11/2013 07:22:11 PM) (Source: Avira FireWall)(User: ) Description: Fehler beim Erstellen AVEvtLog_Init FAILED Versioncheck failed. ==================== Memory info =========================== Percentage of memory in use: 22% Total physical RAM: 8180.48 MB Available physical RAM: 6354.89 MB Total Pagefile: 16359.14 MB Available Pagefile: 14350.51 MB Total Virtual: 8192 MB Available Virtual: 8191.8 MB ==================== Drives ================================ Drive c: (Systemplatte) (Fixed) (Total:465.76 GB) (Free:300.46 GB) NTFS Drive f: (Datenplatte) (Fixed) (Total:465.66 GB) (Free:293.82 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 21FAF9D0) Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=466 GB) - (Type=07 NTFS) ======================================================== Disk: 1 (Size: 466 GB) (Disk ID: 3488D94C) Partition 1: (Not Active) - (Size=466 GB) - (Type=07 NTFS) ==================== End Of Log ============================ Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-11-12 12:11:34
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk1\DR1 -> \Device\Ide\IAAStorageDevice-2 ST950042 rev.0001 465,76GB
Running: 36mjusbb.exe; Driver: C:\Users\****\AppData\Local\Temp\kwldypog.sys
---- User code sections - GMER 2.1 ----
.text C:\PROGRA~2\GbPlugin\GbpSv.exe[1108] C:\Windows\syswow64\kernel32.dll!FreeLibrary 0000000076b73468 5 bytes JMP 0000000174dc844e
.text C:\PROGRA~2\GbPlugin\GbpSv.exe[1108] C:\Windows\syswow64\kernel32.dll!FreeLibraryAndExitThread 0000000076b8d51a 5 bytes JMP 0000000174dc83c6
.text C:\PROGRA~2\GbPlugin\GbpSv.exe[1108] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000076991465 2 bytes [99, 76]
.text C:\PROGRA~2\GbPlugin\GbpSv.exe[1108] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000769914bb 2 bytes [99, 76]
.text ... * 2
.text C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe[2180] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076991465 2 bytes [99, 76]
.text C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe[2180] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000769914bb 2 bytes [99, 76]
.text ... * 2
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2332] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000076991465 2 bytes [99, 76]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2332] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000769914bb 2 bytes [99, 76]
.text ... * 2
.text C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe[3548] C:\Windows\SysWOW64\ksuser.dll!KsCreatePin + 35 00000000731811a8 2 bytes [18, 73]
.text C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe[3548] C:\Windows\SysWOW64\ksuser.dll!KsCreateAllocator + 21 00000000731813a8 2 bytes [18, 73]
.text C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe[3548] C:\Windows\SysWOW64\ksuser.dll!KsCreateClock + 21 0000000073181422 2 bytes [18, 73]
.text C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe[3548] C:\Windows\SysWOW64\ksuser.dll!KsCreateTopologyNode + 19 0000000073181498 2 bytes [18, 73]
.text C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe[3548] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdWaitForVerticalBlank + 195 0000000073161b41 2 bytes [16, 73]
.text C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe[3548] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdWaitForVerticalBlank + 362 0000000073161be8 2 bytes [16, 73]
.text C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe[3548] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdWaitForVerticalBlank + 418 0000000073161c20 2 bytes [16, 73]
.text C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe[3548] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdWaitForVerticalBlank + 596 0000000073161cd2 2 bytes [16, 73]
.text C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe[3548] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdWaitForVerticalBlank + 628 0000000073161cf2 2 bytes [16, 73]
.text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[1632] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076991465 2 bytes [99, 76]
.text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[1632] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000769914bb 2 bytes [99, 76]
.text ... * 2
.text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[1864] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076991465 2 bytes [99, 76]
.text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[1864] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000769914bb 2 bytes [99, 76]
.text ... * 2
.text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe[4220] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076991465 2 bytes [99, 76]
.text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe[4220] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000769914bb 2 bytes [99, 76]
.text ... * 2
---- Threads - GMER 2.1 ----
Thread C:\Windows\System32\svchost.exe [4580:3240] 000007feeead9688
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\e839df5563ee
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\e839df5563ee (not active ControlSet)
Reg HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted@F:\Install\Adobe Reader\x00a09\Setup.exe 1
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk1\DR1 unknown MBR code
---- EOF - GMER 2.1 ----
Vielen lieben Dank schon mal im Voraus, Sho PS. Beim oberflächlichen Durchsehen der Logs stieß ich auf µTorrent - bitte um Entschuldigung, hatte es gar nicht bemerkt. Soll ich es noch deinstallieren? |
|
12.11.2013, 17:50
| #2 |
| /// TB-Ausbilder   | Win7: kein Sicherheitscenter nach BKA-Trojaner Hallo,
__________________ja da wurde ein Windows-Dienst in Mitleidenschaft gezogen.. Mach bitte Folgendes: Schritt 1 Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter S2 Winmgmt; C:\PROGRA~3\fwl1lbo.pzz [x]
2013-10-16 21:13 - 2013-11-10 10:26 - 95025368 ____T C:\ProgramData\fwl1lbo.pff
2013-10-16 21:13 - 2013-11-10 10:26 - 00000000 _____ C:\ProgramData\fwl1lbo.ctrl
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Starte danach den Rechner neu auf. Schritt 2 Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Schritt 3 Starte noch einmal FRST.
__________________ |
|
12.11.2013, 18:35
| #3 |
| | Win7: kein Sicherheitscenter nach BKA-Trojaner Vielen Dank für die schnelle Hilfe. Hier die Logs:
__________________FRST Fixlog: Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 10-11-2013 01
Ran by **** at 2013-11-12 18:07:21 Run:1
Running from C:\Users\****\Desktop
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
S2 Winmgmt; C:\PROGRA~3\fwl1lbo.pzz [x]
2013-10-16 21:13 - 2013-11-10 10:26 - 95025368 ____T C:\ProgramData\fwl1lbo.pff
2013-10-16 21:13 - 2013-11-10 10:26 - 00000000 _____ C:\ProgramData\fwl1lbo.ctrl
*****************
Winmgmt => Service restored successfully.
"C:\ProgramData\fwl1lbo.pff" => File/Directory not found.
C:\ProgramData\fwl1lbo.ctrl => Moved successfully.
==== End of Fixlog ====
Code:
ATTFilter # AdwCleaner v3.012 - Bericht erstellt am 12/11/2013 um 18:16:39
# Updated 11/11/2013 von Xplode
# Betriebssystem : Windows 7 Ultimate Service Pack 1 (64 bits)
# Benutzername : **** - ****-PC
# Gestartet von : C:\Users\****\Desktop\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
Dienst Gelöscht : Application Updater
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\Browser Manager
Ordner Gelöscht : C:\ProgramData\wincert
Ordner Gelöscht : C:\Program Files (x86)\Application Updater
Ordner Gelöscht : C:\Program Files (x86)\Conduit
Ordner Gelöscht : C:\Program Files (x86)\driver-soft
Ordner Gelöscht : C:\Program Files (x86)\Movies Toolbar
Ordner Gelöscht : C:\Program Files (x86)\pdfforge Toolbar
Ordner Gelöscht : C:\Program Files (x86)\Search Results Toolbar
Ordner Gelöscht : C:\Program Files (x86)\Common Files\spigot
Ordner Gelöscht : C:\Users\****\AppData\Local\Conduit
Ordner Gelöscht : C:\Users\****\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\****\AppData\LocalLow\pdfforge
Ordner Gelöscht : C:\Users\****\AppData\LocalLow\PriceGong
Ordner Gelöscht : C:\Users\****\AppData\LocalLow\Search Settings
Ordner Gelöscht : C:\Users\Temp\AppData\LocalLow\AVG Secure Search
Ordner Gelöscht : C:\Users\Temp\AppData\LocalLow\pdfforge
Datei Gelöscht : C:\Users\****\AppData\Local\Temp\Uninstall.exe
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKCU\Software\Google\Chrome\Extensions\leocdeigfnkaojcapikdjcdbedcjmffc
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\leocdeigfnkaojcapikdjcdbedcjmffc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Applications\ilividsetup.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BingBar_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\iLividMediaBar_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\iLividMediaBar_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetup_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetup_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\uTorrentBar_DEAutoUpdateHelper_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\uTorrentBar_DEAutoUpdateHelper_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\uTorrentBar_DEToolbarHelper_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\uTorrentBar_DEToolbarHelper_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitguard.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bprotect.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browserdefender.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browserprotect.exe
Wert Gelöscht : HKLM\SYSTEM\ControlSet001\Control\Session Manager\AppCertDlls [x64]
Wert Gelöscht : HKLM\SYSTEM\ControlSet001\Control\Session Manager\AppCertDlls [x86]
Wert Gelöscht : HKLM\SYSTEM\ControlSet002\Control\Session Manager\AppCertDlls [x64]
Wert Gelöscht : HKLM\SYSTEM\ControlSet002\Control\Session Manager\AppCertDlls [x86]
Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [My Driver Updater]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{B922D405-6D13-4A2B-AE89-08A030DA4402}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B922D405-6D13-4A2B-AE89-08A030DA4402}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B922D405-6D13-4A2B-AE89-08A030DA4402}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{B922D405-6D13-4A2B-AE89-08A030DA4402}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{377E5D4D-77E5-476A-8716-7E70A9272DA0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{377E5D4D-77E5-476A-8716-7E70A9272DA0}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{B922D405-6D13-4A2B-AE89-08A030DA4402}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{B922D405-6D13-4A2B-AE89-08A030DA4402}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
Schlüssel Gelöscht : HKCU\Software\APN DTX
Schlüssel Gelöscht : HKCU\Software\ilivid
Schlüssel Gelöscht : HKCU\Software\pdfforge
Schlüssel Gelöscht : HKCU\Software\Search Settings
Schlüssel Gelöscht : HKCU\Software\StartSearch
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\pdfforge
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\PriceGong
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Search Settings
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\smartbar
Schlüssel Gelöscht : HKLM\Software\Application Updater
Schlüssel Gelöscht : HKLM\Software\Conduit
Schlüssel Gelöscht : HKLM\Software\iLividSRTB
Schlüssel Gelöscht : HKLM\Software\pdfforge
Schlüssel Gelöscht : HKLM\Software\Search Settings
Daten Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~3\Wincert\WIN64C~1.DLL
Daten Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - c:\progra~2\movies~1\datamngr\x64\mgrldr.dll
***** [ Browser ] *****
-\\ Internet Explorer v10.0.9200.16720
-\\ Mozilla Firefox v
*************************
AdwCleaner[R0].txt - [8953 octets] - [12/11/2013 18:15:20]
AdwCleaner[S0].txt - [8132 octets] - [12/11/2013 18:16:39]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [8192 octets] ##########
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-11-2013 01
Ran by **** (administrator) on ****-PC on 12-11-2013 18:21:41
Running from C:\Users\****\Desktop
Windows 7 Ultimate Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AuthenTec, Inc.) C:\Program Files\Fingerprint Sensor\ATService.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(GAS Tecnologia) C:\PROGRA~2\GbPlugin\GbpSv.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(O2Micro International) C:\Windows\system32\DRIVERS\o2flash.exe
(Protexis Inc.) c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
(Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe
(TOSHIBA Corporation) C:\Windows\system32\ThpSrv.exe
() C:\Program Files (x86)\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesApp64.exe
(Microsoft Corporation) c:\Program Files\Microsoft Security Client\NisSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe
(TOSHIBA) C:\Program Files\TOSHIBA\TFPU\TFPUPWDBank.exe
(TOSHIBA Corporation) C:\Windows\System32\ThpSrv.exe
(Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(SlySoft, Inc.) C:\Program Files (x86)\SlySoft\AnyDVD\AnyDVDtray.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Steganos Software GmbH) C:\Program Files (x86)\Steganos Safe 14\SteganosBrowserMonitor.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\Bluetooth Monitor\BtMon2.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\Bluetooth Monitor\BtMon64.exe
(Mozy, Inc.) C:\Program Files\MozyHome\mozystat.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe
(Acronis) C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe
(Acronis) C:\Program Files (x86)\Acronis\TrueImageHome\TimounterMonitor.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
() C:\Program Files (x86)\SlySoft\AnyDVD\ADvdDiscHlp64.exe
(Steganos Software GmbH) C:\Program Files (x86)\Steganos Safe 14\SteganosHotKeyService.exe
(Steganos Software GmbH) C:\Program Files (x86)\Steganos Safe 14\fredirstarter.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\tosBtProc.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Mozy, Inc.) C:\Program Files\MozyHome\mozybackup.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Mozy, Inc.) C:\Program Files\MozyHome\mozybackup.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [TosNC] - C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe [595816 2010-04-23] (TOSHIBA Corporation)
HKLM\...\Run: [TFPUPWDBankService] - C:\Program Files\TOSHIBA\TFPU\TFPUPWDBank.exe [925104 2010-03-02] (TOSHIBA)
HKLM\...\Run: [TFPUService] - C:\Program Files\TOSHIBA\TFPU\TFPUTaskMonitor.exe [793008 2010-03-02] (TOSHIBA)
HKLM\...\Run: [ThpSrv] - C:\Windows\system32\thpsrv /logon
HKLM\...\Run: [SmartAudio] - C:\Program Files\CONEXANT\SAII\SAIICpl.exe [307768 2010-04-28] ()
HKLM\...\Run: [Toshiba TEMPRO] - C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe [1050072 2010-10-26] (Toshiba Europe GmbH)
HKLM\...\Run: [Acronis Scheduler2 Service] - C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [140568 2007-08-31] (Acronis)
HKLM\...\Run: [Logitech Download Assistant] - C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [1266912 2013-10-23] (Microsoft Corporation)
HKCU\...\Run: [AnyDVD] - C:\Program Files (x86)\SlySoft\AnyDVD\AnyDVDtray.exe [4763256 2010-12-17] (SlySoft, Inc.)
HKCU\...\Run: [SAFE14 Browser Monitor] - C:\Program Files (x86)\Steganos Safe 14\SteganosBrowserMonitor.exe [71168 2012-11-28] (Steganos Software GmbH)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2010-11-05] (Intel Corporation)
HKLM-x32\...\Run: [TWebCamera] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe [2454840 2010-05-01] (TOSHIBA CORPORATION.)
HKLM-x32\...\Run: [TrueImageMonitor.exe] - C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe [2622232 2007-08-31] (Acronis)
HKLM-x32\...\Run: [AcronisTimounterMonitor] - C:\Program Files (x86)\Acronis\TrueImageHome\TimounterMonitor.exe [907040 2007-08-31] (Acronis)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-04] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SAFE14 HotKeys] - C:\Program Files (x86)\Steganos Safe 14\SteganosHotKeyService.exe [85504 2012-11-28] (Steganos Software GmbH)
HKLM-x32\...\Run: [SAFE14 File Redirection Starter] - C:\Program Files (x86)\Steganos Safe 14\fredirstarter.exe [17408 2012-11-28] (Steganos Software GmbH)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [SDTray] - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)
AppInit_DLLs: [0 ] ()
Lsa: [Authentication Packages] msv1_0 relog_ap
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xC939DB442CA4CB01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
SearchScopes: HKLM-x32 - Yandex URL = hxxp://yandex.ru/yandsearch?clid=39942&text={searchTerms}
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - A55766DDBED142D08744997BABF88302 URL = hxxp://www.google.de/search?q={searchTerms}&rlz=1I7ADRA_deCH483
SearchScopes: HKCU - Moikrug URL = hxxp://moikrug.ru/persons/?clid=39942&charset=utf-8&keywords={searchTerms}&submitted=1
SearchScopes: HKCU - Yandex URL = hxxp://yandex.ru/yandsearch?clid=39942&text={searchTerms}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {621291BE-6E45-4CCF-B87B-8D7CF9BE7869} URL = hxxp://ch.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=302398&p={searchTerms}
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll No File
BHO-x32: TFPUPWDBankBHO Class - {030AC7B6-E7EC-40F1-8FB2-C0FD344DE0B9} - C:\Program Files\TOSHIBA\TFPU\x86\TFPUPWDBankBHO.dll (TODO: <Company name>)
BHO-x32: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: GbIehObj Class - {C41A1C0E-EA6C-11D4-B1B8-444553540008} - C:\Program Files (x86)\GbPlugin\gbiehuni.dll (Banco Itaú Unibanco)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - No Name - {91397D20-1446-11D4-8AF4-0040CA1127B6} - No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
ShellExecuteHooks-x32: GbPluginObj Class - {E37CB5F0-51F5-4395-A808-5FA49E399008} - C:\Program Files (x86)\GbPlugin\gbiehuni.dll [1502264 2013-09-25] (Banco Itaú Unibanco)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Windows\SysWOW64\npdeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @Nero.com/KM - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin - C:\Users\****\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin HKCU: @talk.google.com/O1DPlugin - C:\Users\****\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
FF Plugin HKCU: @talk.google.com/O3DPlugin - C:\Users\****\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\****\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\****\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF HKLM\...\Firefox\Extensions: [{C1CA7765-44E4-452e-9D00-A04F3D434281}] -
FF HKLM-x32\...\Firefox\Extensions: [{C1CA7765-44E4-452e-9D00-A04F3D434281}] -
==================== Services (Whitelisted) =================
S2 AntiVirFirewallService; C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe [655928 2013-09-04] (Avira Operations GmbH & Co. KG)
S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [622648 2013-09-04] (Avira Operations GmbH & Co. KG)
S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-04] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-04] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-04] (Avira Operations GmbH & Co. KG)
R2 GbpSv; C:\PROGRA~2\GbPlugin\GbpSv.exe [451640 2013-09-25] (GAS Tecnologia)
R2 mozybackup; C:\Program Files\MozyHome\mozybackup.exe [54672 2012-08-02] (Mozy, Inc.)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2013-10-23] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [348376 2013-10-23] (Microsoft Corporation)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1817560 2013-05-16] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1033688 2013-05-16] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2013-05-15] (Safer-Networking Ltd.)
R2 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [124368 2010-10-26] (Toshiba Europe GmbH)
R2 TryAndDecideService; C:\Program Files (x86)\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe [498872 2007-08-31] ()
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe [2028864 2011-12-13] (TuneUp Software)
==================== Drivers (Whitelisted) ====================
R3 AnyDVD; C:\Windows\System32\Drivers\AnyDVD.sys [125512 2010-12-01] (SlySoft, Inc.)
R3 AnyDVD; C:\Windows\SysWow64\Drivers\AnyDVD.sys [125512 2010-12-01] (SlySoft, Inc.)
R3 avfwim; C:\Windows\System32\DRIVERS\avfwim.sys [114608 2013-02-18] (Avira GmbH)
R1 avfwot; C:\Windows\System32\DRIVERS\avfwot.sys [141376 2013-02-18] (Avira GmbH)
R1 avfwot; C:\Windows\SysWow64\DRIVERS\avfwot.sys [131336 2011-06-28] (Avira GmbH)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-04] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-09-04] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-04-05] (Avira Operations GmbH & Co. KG)
R1 mozyFilter; C:\Windows\System32\DRIVERS\mozy.sys [67368 2012-08-02] (Mozy, Inc.)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [248240 2013-09-27] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [134944 2013-09-27] (Microsoft Corporation)
R3 O2SDGRDR; C:\Windows\System32\DRIVERS\o2sdgx64.sys [49568 2009-08-18] (O2Micro )
S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R1 SLEE_18_DRIVER; C:\Windows\Sleen1864.sys [108648 2012-07-24] (Softwareentwicklung Remus - ArchiCrypt - )
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesDriver64.sys [11856 2010-10-07] (TuneUp Software)
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [x]
S3 tsusbhub; system32\drivers\tsusbhub.sys [x]
S3 VGPU; System32\drivers\rdvgkmd.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-11-12 18:19 - 2013-11-12 18:19 - 00008300 _____ C:\Users\****\Desktop\AdwCleaner[S0].txt
2013-11-12 18:15 - 2013-11-12 18:16 - 00000000 ____D C:\AdwCleaner
2013-11-12 18:13 - 2013-11-12 18:13 - 01085542 _____ C:\Users\****\Desktop\adwcleaner.exe
2013-11-12 12:22 - 2013-11-12 12:22 - 00000000 ____D C:\Program Files\Microsoft Security Client
2013-11-12 12:22 - 2013-11-12 12:22 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2013-11-12 12:21 - 2013-11-12 12:21 - 13697720 _____ (Microsoft Corporation) C:\Users\****\Downloads\mseinstall.exe
2013-11-12 12:11 - 2013-11-12 16:08 - 00006795 _____ C:\Users\****\Desktop\gmer.log
2013-11-12 11:41 - 2013-11-12 11:41 - 00377856 _____ C:\Users\****\Desktop\36mjusbb.exe
2013-11-12 11:31 - 2013-11-12 16:07 - 00026851 _____ C:\Users\****\Desktop\Addition.txt
2013-11-12 11:29 - 2013-11-12 11:29 - 01957590 _____ (Farbar) C:\Users\****\Desktop\FRST64.exe
2013-11-12 11:29 - 2013-11-12 11:29 - 00000000 ____D C:\FRST
2013-11-12 11:27 - 2013-11-12 11:28 - 00000470 _____ C:\Users\****\Desktop\defogger_disable.log
2013-11-12 11:27 - 2013-11-12 11:27 - 00000000 _____ C:\Users\****\defogger_reenable
2013-11-12 11:24 - 2013-11-12 11:24 - 00050477 _____ C:\Users\****\Desktop\Defogger.exe
2013-11-11 22:35 - 2013-11-11 22:32 - 00873384 _____ (Oracle Corporation) C:\Windows\SysWOW64\npdeployJava1.dll
2013-11-11 22:35 - 2013-11-11 22:32 - 00796072 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2013-11-11 22:33 - 2013-11-11 22:33 - 00000000 ____D C:\ProgramData\Oracle
2013-11-11 22:32 - 2013-11-11 22:32 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-11-11 20:05 - 2013-11-12 12:23 - 00001912 _____ C:\Windows\epplauncher.mif
2013-11-11 19:22 - 2013-11-12 18:19 - 00000336 _____ C:\Windows\setupact.log
2013-11-11 19:22 - 2013-11-11 19:22 - 00000000 _____ C:\Windows\setuperr.log
2013-11-11 19:00 - 2013-11-11 19:20 - 00002579 _____ C:\Users\****\Desktop\Hkey.reg
2013-11-11 18:37 - 2013-11-11 18:37 - 00000193 _____ C:\Windows\wininit.ini
2013-11-11 18:17 - 2013-11-11 18:37 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-11-11 18:17 - 2013-11-11 18:17 - 00001391 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2013-11-11 18:17 - 2013-11-11 18:17 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking
2013-11-11 18:17 - 2009-01-25 13:14 - 00017272 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2013-11-11 18:16 - 2013-11-11 18:17 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2013-11-11 18:13 - 2013-11-11 18:13 - 00000000 ____D C:\Users\Temp\AppData\Roaming\Macromedia
2013-11-11 18:12 - 2013-11-11 18:12 - 00000000 ____D C:\Users\Temp\AppData\Roaming\TFPU
2013-11-11 18:11 - 2013-11-11 18:12 - 00000000 ____D C:\Users\Temp\AppData\Local\Toshiba
2013-11-11 18:11 - 2013-11-11 18:11 - 00118048 _____ C:\Users\Temp\AppData\Local\GDIPFONTCACHEV1.DAT
2013-11-11 18:11 - 2013-11-11 18:11 - 00001433 _____ C:\Users\Temp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ___RD C:\Users\Temp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ___RD C:\Users\Temp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ____D C:\Users\Temp\Documents\Bluetooth
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ____D C:\Users\Temp\AppData\Roaming\Steganos
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ____D C:\Users\Temp\AppData\Roaming\Intel Corporation
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ____D C:\Users\Temp\AppData\Roaming\Avira
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ____D C:\Users\Temp\AppData\Roaming\Apple Computer
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ____D C:\Users\Temp\AppData\Roaming\Adobe
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ____D C:\Users\Temp\AppData\Local\VirtualStore
2013-11-11 18:10 - 2013-11-11 18:10 - 00000020 ___SH C:\Users\Temp\ntuser.ini
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Vorlagen
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Startmenü
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Netzwerkumgebung
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Lokale Einstellungen
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Eigene Dateien
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Druckumgebung
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Documents\Eigene Musik
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Documents\Eigene Bilder
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\AppData\Local\Verlauf
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\AppData\Local\Anwendungsdaten
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Anwendungsdaten
2013-11-11 18:10 - 2011-06-19 02:20 - 00000000 ____D C:\Users\Temp\Documents\Visual Studio 2008
2013-11-11 18:10 - 2011-06-19 02:20 - 00000000 ____D C:\Users\Temp\AppData\Local\Microsoft Help
2013-11-11 18:10 - 2009-07-14 05:54 - 00000000 ___RD C:\Users\Temp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-11-11 18:10 - 2009-07-14 05:49 - 00000000 ___RD C:\Users\Temp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2013-11-11 17:09 - 2013-11-11 17:09 - 00156192 _____ C:\Users\****\Desktop\cc_20131111_170852.reg
2013-11-11 17:02 - 2013-11-11 17:02 - 00002770 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2013-11-11 17:02 - 2013-11-11 17:02 - 00000834 _____ C:\Users\Public\Desktop\CCleaner.lnk
2013-11-11 17:02 - 2013-11-11 17:02 - 00000000 ____D C:\Program Files\CCleaner
2013-11-11 16:12 - 2013-11-11 17:13 - 00000000 ____D C:\Windows\pss
2013-11-11 13:57 - 2013-11-11 13:57 - 00001121 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-11-11 13:57 - 2013-11-11 13:57 - 00000000 ____D C:\Users\****\AppData\Roaming\Malwarebytes
2013-11-11 13:57 - 2013-11-11 13:57 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-11 13:57 - 2013-11-11 13:57 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-11-11 13:57 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-10-15 17:31 - 2013-09-23 00:28 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-10-15 17:31 - 2013-09-23 00:28 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-10-15 17:31 - 2013-09-23 00:27 - 14335488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-10-15 17:31 - 2013-09-23 00:27 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-10-15 17:31 - 2013-09-23 00:27 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-10-15 17:31 - 2013-09-23 00:27 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-10-15 17:31 - 2013-09-23 00:27 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-10-15 17:31 - 2013-09-23 00:27 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-10-15 17:31 - 2013-09-23 00:27 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-10-15 17:31 - 2013-09-23 00:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-10-15 17:31 - 2013-09-23 00:27 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-10-15 17:31 - 2013-09-23 00:27 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-10-15 17:31 - 2013-09-23 00:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-10-15 17:31 - 2013-09-22 23:55 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-10-15 17:31 - 2013-09-22 23:55 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-10-15 17:31 - 2013-09-22 23:55 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-10-15 17:31 - 2013-09-22 23:54 - 19252224 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-10-15 17:31 - 2013-09-22 23:54 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-10-15 17:31 - 2013-09-22 23:54 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-10-15 17:31 - 2013-09-22 23:54 - 02647552 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-10-15 17:31 - 2013-09-22 23:54 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-10-15 17:31 - 2013-09-22 23:54 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-10-15 17:31 - 2013-09-22 23:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-10-15 17:31 - 2013-09-22 23:54 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-10-15 17:31 - 2013-09-22 23:54 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-10-15 17:31 - 2013-09-22 23:54 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-10-15 17:31 - 2013-09-22 23:54 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-10-15 17:31 - 2013-09-21 04:38 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-10-15 17:31 - 2013-09-21 04:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-10-15 17:31 - 2013-09-21 03:48 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-10-15 17:31 - 2013-09-21 03:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-10-15 17:03 - 2013-09-14 02:10 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-10-15 17:03 - 2013-09-08 03:30 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-10-15 17:03 - 2013-09-08 03:27 - 00327168 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2013-10-15 17:03 - 2013-09-08 03:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswsock.dll
2013-10-15 17:03 - 2013-08-28 02:21 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-10-15 17:03 - 2013-07-12 11:41 - 00185344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys
2013-10-15 17:03 - 2013-07-12 11:41 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
2013-10-15 17:03 - 2013-07-12 11:40 - 00109824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBAUDIO.sys
2013-10-15 17:03 - 2013-07-04 13:57 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2013-10-15 17:03 - 2013-07-04 13:50 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2013-10-15 17:03 - 2013-07-04 13:50 - 00102400 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2013-10-15 17:03 - 2013-07-04 12:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll
2013-10-15 17:03 - 2013-07-04 12:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll
2013-10-15 17:03 - 2013-07-04 12:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2013-10-15 17:03 - 2013-07-04 11:11 - 00140800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2013-10-15 17:03 - 2013-07-03 05:40 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys
2013-10-15 17:03 - 2013-07-03 05:05 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2013-10-15 17:03 - 2013-07-03 05:05 - 00032896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2013-10-15 17:03 - 2013-06-25 23:55 - 00785624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2013-10-15 17:03 - 2013-06-06 06:50 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2013-10-15 17:03 - 2013-06-06 06:49 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2013-10-15 17:03 - 2013-06-06 06:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2013-10-15 17:03 - 2013-06-06 06:47 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2013-10-15 17:03 - 2013-06-06 05:57 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2013-10-15 17:03 - 2013-06-06 05:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2013-10-15 17:03 - 2013-06-06 05:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2013-10-15 17:03 - 2013-06-06 04:30 - 00368128 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-10-15 17:03 - 2013-06-06 04:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2013-10-15 17:03 - 2013-06-06 04:01 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2013-10-15 17:02 - 2013-08-29 03:17 - 05549504 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-10-15 17:02 - 2013-08-29 03:16 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-10-15 17:02 - 2013-08-29 03:16 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2013-10-15 17:02 - 2013-08-29 03:16 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-10-15 17:02 - 2013-08-29 03:13 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2013-10-15 17:02 - 2013-08-29 02:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-10-15 17:02 - 2013-08-29 02:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-10-15 17:02 - 2013-08-29 02:50 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-10-15 17:02 - 2013-08-29 02:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2013-10-15 17:02 - 2013-08-29 02:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-10-15 17:02 - 2013-08-29 02:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2013-10-15 17:02 - 2013-08-29 01:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-10-15 17:02 - 2013-08-29 01:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-10-15 17:02 - 2013-08-29 01:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-10-15 17:02 - 2013-08-29 01:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-10-15 17:02 - 2013-08-28 02:12 - 00461312 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll
2013-10-15 17:02 - 2013-08-01 13:09 - 00983488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-10-15 17:02 - 2013-07-20 11:33 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-15 17:02 - 2013-07-20 11:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
==================== One Month Modified Files and Folders =======
2013-11-12 18:19 - 2013-11-12 18:19 - 00008300 _____ C:\Users\****\Desktop\AdwCleaner[S0].txt
2013-11-12 18:19 - 2013-11-11 19:22 - 00000336 _____ C:\Windows\setupact.log
2013-11-12 18:19 - 2013-04-20 13:21 - 00031088 _____ (GbPlugin NDIS Device Driver) C:\Windows\SysWOW64\Drivers\gbpndisrd.sys
2013-11-12 18:19 - 2013-04-20 13:21 - 00010266 _____ C:\Windows\SysWOW64\Drivers\ndisrd.cat
2013-11-12 18:19 - 2013-04-20 13:21 - 00001402 _____ C:\Windows\SysWOW64\Drivers\gas.cer
2013-11-12 18:19 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-12 18:17 - 2010-12-17 13:50 - 01564934 _____ C:\Windows\WindowsUpdate.log
2013-11-12 18:17 - 2009-07-14 05:45 - 00013440 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-12 18:17 - 2009-07-14 05:45 - 00013440 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-12 18:16 - 2013-11-12 18:15 - 00000000 ____D C:\AdwCleaner
2013-11-12 18:13 - 2013-11-12 18:13 - 01085542 _____ C:\Users\****\Desktop\adwcleaner.exe
2013-11-12 18:01 - 2011-06-07 11:48 - 00001116 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2200878598-3108500986-400413442-1000UA.job
2013-11-12 17:18 - 2012-05-03 08:45 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-12 16:08 - 2013-11-12 12:11 - 00006795 _____ C:\Users\****\Desktop\gmer.log
2013-11-12 16:07 - 2013-11-12 11:31 - 00026851 _____ C:\Users\****\Desktop\Addition.txt
2013-11-12 14:59 - 2013-03-24 10:06 - 00000000 ____D C:\ProgramData\GbPlugin
2013-11-12 14:46 - 2010-12-17 16:36 - 00003922 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{3E05B566-424F-4E42-9BD8-AFFA959CC984}
2013-11-12 14:09 - 2012-08-02 11:43 - 00005840 _____ C:\Windows\mozy.flt
2013-11-12 14:09 - 2012-08-02 11:43 - 00004384 _____ C:\Windows\mozy.blk
2013-11-12 13:02 - 2012-09-26 10:58 - 00000000 ____D C:\Users\****\AppData\Roaming\Mozilla
2013-11-12 13:00 - 2011-06-07 11:48 - 00001064 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2200878598-3108500986-400413442-1000Core.job
2013-11-12 12:23 - 2013-11-11 20:05 - 00001912 _____ C:\Windows\epplauncher.mif
2013-11-12 12:22 - 2013-11-12 12:22 - 00000000 ____D C:\Program Files\Microsoft Security Client
2013-11-12 12:22 - 2013-11-12 12:22 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2013-11-12 12:21 - 2013-11-12 12:21 - 13697720 _____ (Microsoft Corporation) C:\Users\****\Downloads\mseinstall.exe
2013-11-12 12:09 - 2010-12-18 08:24 - 00000000 ____D C:\Users\****\Desktop\Tools
2013-11-12 11:41 - 2013-11-12 11:41 - 00377856 _____ C:\Users\****\Desktop\36mjusbb.exe
2013-11-12 11:29 - 2013-11-12 11:29 - 01957590 _____ (Farbar) C:\Users\****\Desktop\FRST64.exe
2013-11-12 11:29 - 2013-11-12 11:29 - 00000000 ____D C:\FRST
2013-11-12 11:28 - 2013-11-12 11:27 - 00000470 _____ C:\Users\****\Desktop\defogger_disable.log
2013-11-12 11:27 - 2013-11-12 11:27 - 00000000 _____ C:\Users\****\defogger_reenable
2013-11-12 11:27 - 2010-12-17 13:50 - 00000000 ____D C:\Users\****
2013-11-12 11:24 - 2013-11-12 11:24 - 00050477 _____ C:\Users\****\Desktop\Defogger.exe
2013-11-11 22:33 - 2013-11-11 22:33 - 00000000 ____D C:\ProgramData\Oracle
2013-11-11 22:32 - 2013-11-11 22:35 - 00873384 _____ (Oracle Corporation) C:\Windows\SysWOW64\npdeployJava1.dll
2013-11-11 22:32 - 2013-11-11 22:35 - 00796072 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2013-11-11 22:32 - 2013-11-11 22:32 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-11-11 22:32 - 2012-10-27 12:59 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-11-11 22:32 - 2012-10-27 12:59 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-11-11 22:32 - 2012-10-27 12:59 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-11-11 22:32 - 2011-01-17 22:03 - 00000000 ____D C:\Program Files (x86)\Java
2013-11-11 19:49 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-11-11 19:22 - 2013-11-11 19:22 - 00000000 _____ C:\Windows\setuperr.log
2013-11-11 19:20 - 2013-11-11 19:00 - 00002579 _____ C:\Users\****\Desktop\Hkey.reg
2013-11-11 18:37 - 2013-11-11 18:37 - 00000193 _____ C:\Windows\wininit.ini
2013-11-11 18:37 - 2013-11-11 18:17 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-11-11 18:17 - 2013-11-11 18:17 - 00001391 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2013-11-11 18:17 - 2013-11-11 18:17 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking
2013-11-11 18:17 - 2013-11-11 18:16 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2013-11-11 18:13 - 2013-11-11 18:13 - 00000000 ____D C:\Users\Temp\AppData\Roaming\Macromedia
2013-11-11 18:12 - 2013-11-11 18:12 - 00000000 ____D C:\Users\Temp\AppData\Roaming\TFPU
2013-11-11 18:12 - 2013-11-11 18:11 - 00000000 ____D C:\Users\Temp\AppData\Local\Toshiba
2013-11-11 18:11 - 2013-11-11 18:11 - 00118048 _____ C:\Users\Temp\AppData\Local\GDIPFONTCACHEV1.DAT
2013-11-11 18:11 - 2013-11-11 18:11 - 00001433 _____ C:\Users\Temp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ___RD C:\Users\Temp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ___RD C:\Users\Temp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ____D C:\Users\Temp\Documents\Bluetooth
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ____D C:\Users\Temp\AppData\Roaming\Steganos
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ____D C:\Users\Temp\AppData\Roaming\Intel Corporation
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ____D C:\Users\Temp\AppData\Roaming\Avira
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ____D C:\Users\Temp\AppData\Roaming\Apple Computer
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ____D C:\Users\Temp\AppData\Roaming\Adobe
2013-11-11 18:11 - 2013-11-11 18:11 - 00000000 ____D C:\Users\Temp\AppData\Local\VirtualStore
2013-11-11 18:10 - 2013-11-11 18:10 - 00000020 ___SH C:\Users\Temp\ntuser.ini
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Vorlagen
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Startmenü
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Netzwerkumgebung
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Lokale Einstellungen
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Eigene Dateien
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Druckumgebung
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Documents\Eigene Musik
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Documents\Eigene Bilder
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\AppData\Local\Verlauf
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\AppData\Local\Anwendungsdaten
2013-11-11 18:10 - 2013-11-11 18:10 - 00000000 _SHDL C:\Users\Temp\Anwendungsdaten
2013-11-11 17:13 - 2013-11-11 16:12 - 00000000 ____D C:\Windows\pss
2013-11-11 17:09 - 2013-11-11 17:09 - 00156192 _____ C:\Users\****\Desktop\cc_20131111_170852.reg
2013-11-11 17:07 - 2012-10-07 08:40 - 00000000 ____D C:\Windows\Minidump
2013-11-11 17:07 - 2012-09-26 19:50 - 00000000 ____D C:\Users\****\AppData\Roaming\uTorrent
2013-11-11 17:07 - 2010-12-26 14:17 - 00000000 ____D C:\Users\****\AppData\Roaming\Skype
2013-11-11 17:07 - 2010-12-17 13:42 - 00000000 ____D C:\Windows\Panther
2013-11-11 17:02 - 2013-11-11 17:02 - 00002770 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2013-11-11 17:02 - 2013-11-11 17:02 - 00000834 _____ C:\Users\Public\Desktop\CCleaner.lnk
2013-11-11 17:02 - 2013-11-11 17:02 - 00000000 ____D C:\Program Files\CCleaner
2013-11-11 16:47 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-11-11 16:19 - 2011-04-17 07:27 - 00000000 ____D C:\Windows\system32\appmgmt
2013-11-11 16:13 - 2012-05-14 08:52 - 00000000 ____D C:\Program Files\Google
2013-11-11 16:13 - 2012-05-14 08:50 - 00000000 ____D C:\Program Files (x86)\Google
2013-11-11 16:12 - 2010-12-17 13:50 - 00000000 ___RD C:\Users\****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-11-11 16:06 - 2012-05-14 08:50 - 00000000 ____D C:\ProgramData\Google
2013-11-11 16:06 - 2011-04-17 07:23 - 00000000 ____D C:\Users\****\AppData\Local\Google
2013-11-11 16:03 - 2013-03-24 10:06 - 00000000 ____D C:\Program Files (x86)\GbPlugin
2013-11-11 13:57 - 2013-11-11 13:57 - 00001121 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-11-11 13:57 - 2013-11-11 13:57 - 00000000 ____D C:\Users\****\AppData\Roaming\Malwarebytes
2013-11-11 13:57 - 2013-11-11 13:57 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-11 13:57 - 2013-11-11 13:57 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-11-11 01:38 - 2010-12-17 17:14 - 00000000 __SHD C:\ProgramData\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}
2013-10-21 11:56 - 2011-06-07 11:48 - 00004084 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2200878598-3108500986-400413442-1000UA
2013-10-21 11:56 - 2011-06-07 11:48 - 00003688 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2200878598-3108500986-400413442-1000Core
2013-10-16 10:18 - 2012-05-03 08:45 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-10-16 10:18 - 2012-05-03 08:45 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-10-16 10:18 - 2011-05-17 04:13 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-10-16 09:48 - 2009-07-14 18:58 - 00659238 _____ C:\Windows\system32\perfh007.dat
2013-10-16 09:48 - 2009-07-14 18:58 - 00132776 _____ C:\Windows\system32\perfc007.dat
2013-10-16 09:48 - 2009-07-14 06:13 - 01512418 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-16 09:41 - 2009-07-14 05:45 - 00427392 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-16 09:35 - 2013-03-14 14:01 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-10-16 09:35 - 2013-03-14 14:01 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-10-15 17:34 - 2010-12-17 17:05 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-10-15 17:26 - 2013-08-31 22:10 - 00000000 ____D C:\Windows\system32\MRT
2013-10-15 17:25 - 2010-12-17 16:21 - 80541720 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
Files to move or delete:
====================
C:\Users\****\AppData\Roaming\skype.ini
C:\Users\****\WinZip155.exe
Some content of TEMP:
====================
C:\Users\****\AppData\Local\Temp\Quarantine.exe
C:\Users\****\AppData\Local\Temp\tbuTo0.dll
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-11-11 19:40
==================== End Of Log ============================
Gruß, Sho |
|
13.11.2013, 02:41
| #4 |
| /// TB-Ausbilder | Win7: kein Sicherheitscenter nach BKA-Trojaner Wie läuft der Rechner jetzt? Schritt 1
Schritt 2 ESET Online Scanner
__________________ cheers, Leo |
|
13.11.2013, 19:57
| #5 |
| | Win7: kein Sicherheitscenter nach BKA-Trojaner Sorry, hatte den Tag über zu tun. Hier die neuen Logs. MBAM: Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.11.13.06 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16721 **** :: ****-PC [Administrator] 13.11.2013 17:14:48 mbam-log-2013-11-13 (17-14-48).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 237830 Laufzeit: 7 Minute(n), 55 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=b454c6a980cead489624b0df3533019d
# engine=15871
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-11-13 06:40:16
# local_time=2013-11-13 07:40:16 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776574 100 94 165622 135997866 0 0
# scanned=202184
# found=2
# cleaned=0
# scan_time=7822
sh=C845D784AECF0F62FABEB3F3FEFBC68BDF3B1C8E ft=1 fh=2eba741a08871571 vn="a variant of Win32/Adware.SpeedingUpMyPC.C application" ac=I fn="C:\Program Files (x86)\Large Software\My Driver Updater\MDUSmartScan.exe"
sh=0E44D89B38A6FD0F6555365F7A39E7921CDA3B4D ft=1 fh=b16957d648f3e2d6 vn="a variant of Win32/Adware.SpeedingUpMyPC.C application" ac=I fn="C:\Users\****\Downloads\mydriverupdater7.exe"
Gruß, Sho |
|
13.11.2013, 22:54
| #6 |
| /// TB-Ausbilder | Win7: kein Sicherheitscenter nach BKA-Trojaner ok. Downloade dir bitte  Farbar Service Scanner
Poste bitte den Inhalt hier.
__________________ --> Win7: kein Sicherheitscenter nach BKA-Trojaner |
|
13.11.2013, 23:01
| #7 |
| | Win7: kein Sicherheitscenter nach BKA-Trojaner FSS: Code:
ATTFilter Farbar Service Scanner Version: 10-11-2013
Ran by **** (administrator) on 13-11-2013 at 22:59:48
Running from "C:\Users\****\Desktop"
Microsoft Windows 7 Ultimate Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************
Internet Services:
============
Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.
Windows Firewall:
=============
Firewall Disabled Policy:
==================
System Restore:
============
System Restore Disabled Policy:
========================
Action Center:
============
Windows Update:
============
Windows Autoupdate Disabled Policy:
============================
Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.
Windows Defender Disabled Policy:
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1
Other Services:
==============
File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys
[2013-10-15 17:03] - [2013-09-14 02:10] - 0497152 ____A (Microsoft Corporation) 314C17917AC8523EC77A710215012A65
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys
[2013-10-15 17:03] - [2013-09-08 03:30] - 1903552 ____A (Microsoft Corporation) 40AF23633D197905F03AB5628C558C51
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\System32\ipnathlp.dll => MD5 is legit
C:\Windows\System32\iphlpsvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
**** End of log ****
|
|
14.11.2013, 13:16
| #8 |
| /// TB-Ausbilder | Win7: kein Sicherheitscenter nach BKA-Trojaner Ist die Lage danach unverändert? Downloade dir bitte Windows Repair (all in one) und entpacke das Archiv auf den Desktop.
__________________ cheers, Leo |
|
14.11.2013, 14:45
| #9 |
| | Win7: kein Sicherheitscenter nach BKA-Trojaner Hab's durchlaufen lassen. Situation ist unverändert; System läuft, Sicherheitscenter auch, Avira nicht (MSE läuft ersatzweise). |
|
14.11.2013, 15:54
| #10 |
| /// TB-Ausbilder | Win7: kein Sicherheitscenter nach BKA-Trojaner Kannst du Avira normal deinstallieren?
__________________ cheers, Leo |
|
14.11.2013, 17:32
| #11 |
| | Win7: kein Sicherheitscenter nach BKA-Trojaner Ist deinstalliert. |
|
14.11.2013, 21:12
| #12 |
| /// TB-Ausbilder | Win7: kein Sicherheitscenter nach BKA-Trojaner Läuft sonst alles wieder normal, oder bestehen noch Probleme?
__________________ cheers, Leo |
|
14.11.2013, 21:42
| #13 |
| | Win7: kein Sicherheitscenter nach BKA-Trojaner Ansonsten läuft scheinbar alles normal. Soll ich dann Avira neu installieren? Ist halt der Rechner meines Vaters, und er hat Geld dafür gelöhnt. Vielen Dank auf jeden Fall, Sho |
|
14.11.2013, 22:00
| #14 |
| /// TB-Ausbilder | Win7: kein Sicherheitscenter nach BKA-Trojaner Ja die Neu-Installation kannst du versuchen. Aber zwei Antivirenprogramme sollten dann nicht parallel laufen.
__________________ cheers, Leo |
|
14.11.2013, 22:05
| #15 |
| | Win7: kein Sicherheitscenter nach BKA-Trojaner Nee, das ist schon klar; hatte MSE halt laufen, weil von Avira kein Mucks kam. Soll ich noch nach etwas Ausschau halten oder einen Scan durchführen? Gruß, Sho |
|
| Themen zu Win7: kein Sicherheitscenter nach BKA-Trojaner |
| antivir, ausgelastet, avira, browser, desktop, device driver, excel, failed, farbar, farbar recovery scan tool, fehlermeldung, flash player, google, helper, internet, kaspersky, malware, mozilla, msiinstaller, officejet, pdfforge toolbar, plug-in, programm, refresh, registry, richtlinie, rundll, safer networking, scan, secure search, security, server, software, svchost.exe, system error, vtoolbarupdater, win32/reveton.v, wlan, yandex |
Linear-Darstellung
