| |
| |||||||
Log-Analyse und Auswertung: wie entferne ich unter Windows 7 Postbankrojaner ?Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
27.11.2013, 13:54
| #1 |
| |  wie entferne ich unter Windows 7 Postbankrojaner ? Hallo! Ich habe mir einen Trojaner der Postbank eingefangen. Habe die folgenden Logs gemacht. Was kann / muss ich tun, um diesen Trojaner wieder los zu werden. Habe in den LOGS meinen Namen durch EULE ersetzt. Ich benutze diesen PC für mein Online Banking. Ist dies nach einer Säuberung wieder gefahrlos möglich? Vielen Dank für eure Hilfe vorab! und einen liebe Gruß Marc FRST LOG: Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 24-11-2013 Ran by Eule (administrator) on Eule-PC on 25-11-2013 12:56:53 Running from C:\Users\Eule\Desktop Microsoft Windows 7 Professional Service Pack 1 (X86) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) =================== (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Nero AG) C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe (Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe (Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe () C:\Program Files\Tobit Radio.fx\Server\rfx-server.exe (Fujitsu Technology Solutions) C:\Program Files\Fujitsu\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe (Fujitsu Technology Solutions) C:\Program Files\Fujitsu\DeskViewBasic\DeskViewBasicService.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Inventec Corp.) C:\Program Files\Fujitsu\Wireless_Utility\Wireless Selector.exe (Research In Motion Limited) C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe (Research In Motion Limited) C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe (Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe (APN LLC.) C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe (Microsoft Corporation) C:\Windows\System32\taskmgr.exe (Microsoft Corporation) C:\Windows\System32\LogonUI.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1545512 2009-07-20] (Synaptics Incorporated) HKLM\...\Run: [DeskViewBasic] - C:\Program Files\Fujitsu\DeskViewBasic\DeskViewBasic.exe [182784 2009-08-19] (Fujitsu Technology Solutions) HKLM\...\Run: [Wireless_Selector] - C:\Program Files\Fujitsu\Wireless_Utility\Wireless Selector.exe [327680 2009-05-14] (Inventec Corp.) HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7514656 2009-05-22] (Realtek Semiconductor) HKLM\...\Run: [NvCplDaemon] - RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup HKLM\...\Run: [RIMBBLaunchAgent.exe] - C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe [443408 2013-09-09] (Research In Motion Limited) HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [948440 2013-10-23] (Microsoft Corporation) HKLM\...\Run: [BCSSync] - C:\Program Files\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation) HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated) HKLM\...\Run: [Windows Mobile-based device management] - C:\Windows\WindowsMobile\wmdcBase.exe [648072 2007-05-31] (Microsoft Corporation) HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [683576 2013-10-31] (Avira Operations GmbH & Co. KG) HKLM\...\Run: [ApnTBMon] - C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1673680 2013-10-23] (APN) HKCU\...\Run: [ISUSPM] - C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe [218032 2006-09-11] (Macrovision Corporation) HKCU\...\Run: [GoogleDriveSync] - C:\Program Files\Google\Drive\googledrivesync.exe [20133824 2013-09-25] (Google) HKCU\...\Run: [tuswrwpl] - regsvr32.exe /s "C:\ProgramData\tuswrwpl.dat" BootExecute: autocheck autochk * sdnclean.exe ==================== Internet (Whitelisted) ==================== ProxyServer: :0 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://aartemis.com/?type=hp&ts=1385378153&from=cor&uid=HitachiXHTS545016B9A300_090904PB5B01QCC9SXXGX HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.aartemis.com/web/?type=ds&ts=1385378153&from=cor&uid=HitachiXHTS545016B9A300_090904PB5B01QCC9SXXGX&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://aartemis.com/?type=hp&ts=1385378153&from=cor&uid=HitachiXHTS545016B9A300_090904PB5B01QCC9SXXGX HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://aartemis.com/?type=hp&ts=1385378153&from=cor&uid=HitachiXHTS545016B9A300_090904PB5B01QCC9SXXGX HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.aartemis.com/web/?type=ds&ts=1385378153&from=cor&uid=HitachiXHTS545016B9A300_090904PB5B01QCC9SXXGX&q={searchTerms} SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.aartemis.com/web/?type=ds&ts=1385378153&from=cor&uid=HitachiXHTS545016B9A300_090904PB5B01QCC9SXXGX&q={searchTerms} SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.aartemis.com/web/?type=ds&ts=1385378153&from=cor&uid=HitachiXHTS545016B9A300_090904PB5B01QCC9SXXGX&q={searchTerms} SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = BHO: AC-Pro - {0FB6A909-6086-458F-BD92-1F8EE10042A0} - C:\Program Files\AutocompletePro\AutocompletePro.dll (SimplyGen) BHO: Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.) BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.) Tcpip\Parameters: [DhcpNameServer] 10.4.59.1 FireFox: ======== FF ProfilePath: C:\Users\Eule\AppData\Roaming\Mozilla\Firefox\Profiles\zh7u3f8r.default FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_117.dll () FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin: @RIM.com/WebSLLauncher,version=1.0 - C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll () FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.) FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Extension: AutocompletePro - Your handy search suggestions tool - C:\Users\Eule\AppData\Roaming\Mozilla\Firefox\Profiles\zh7u3f8r.default\Extensions\support@predictad.com FF Extension: toolbar_AVIRA-V7 - C:\Users\Eule\AppData\Roaming\Mozilla\Firefox\Profiles\zh7u3f8r.default\Extensions\toolbar_AVIRA-V7@apn.ask.com.xpi Chrome: ======= CHR HomePage: hxxp://www.spiegel.de/ CHR DefaultSearchURL: (Google) - {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google  riginalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms} CHR HKLM\...\Chrome\Extension: [aaaaacalgebmfelllfiaoknifldpngjh] - C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\CRX\ToolbarCR.crx CHR HKLM\...\Chrome\Extension: [defdhglnppeioeflggkmglipcecffkhk] - C:\Program Files\AutocompletePro\chrome\autocompleteprochrome.crx ========================== Services (Whitelisted) ================= R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440376 2013-10-31] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440376 2013-10-31] (Avira Operations GmbH & Co. KG) R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe [1164360 2013-10-31] (Avira Operations GmbH & Co. KG) R2 APNMCP; C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2013-10-23] (APN LLC.) R3 BlackBerry Device Manager; C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe [585728 2013-09-09] (Research In Motion Limited) R2 DeskViewBasicService; C:\Program Files\Fujitsu\DeskViewBasic\DeskViewBasicService.exe [34816 2009-08-19] (Fujitsu Technology Solutions) R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [22208 2013-10-23] (Microsoft Corporation) R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [280288 2013-10-23] (Microsoft Corporation) R2 Radio.fx; C:\Program Files\Tobit Radio.fx\Server\rfx-server.exe [3673944 2011-11-18] () R2 TestHandler; C:\Program Files\Fujitsu\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe [341264 2009-02-19] (Fujitsu Technology Solutions) S2 RoxLiveShare9; "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe" [x] ==================== Drivers (Whitelisted) ==================== R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-10-31] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [137208 2013-10-31] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-31] (Avira Operations GmbH & Co. KG) R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [67680 2013-10-31] (Avira Operations GmbH & Co. KG) S3 BthAvrcp; C:\Windows\System32\DRIVERS\BthAvrcp.sys [22528 2009-08-13] (CSR, plc) S3 DTVFW; C:\Windows\System32\DRIVERS\dtvfw.sys [22016 2005-05-12] (LITE-ON) R3 FSCSLII; C:\Windows\System32\DRIVERS\FSCSLII.sys [16384 2009-05-18] (Fujitsu) R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [214696 2013-09-27] (Microsoft Corporation) R1 MpKslf5029df0; C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{696B7E90-DB80-43A7-A355-727E39677A06}\MpKslf5029df0.sys [40392 2013-11-22] (Microsoft Corporation) S3 rimvndis; C:\Windows\System32\Drivers\rimvndis6.sys [14336 2013-08-15] (Research in Motion Limited) S3 s0016bus; C:\Windows\System32\DRIVERS\s0016bus.sys [89256 2008-05-16] (MCCI Corporation) S3 s0016mdfl; C:\Windows\System32\DRIVERS\s0016mdfl.sys [15016 2008-05-16] (MCCI Corporation) S3 s0016mdm; C:\Windows\System32\DRIVERS\s0016mdm.sys [120744 2008-05-16] (MCCI Corporation) S3 s0016mgmt; C:\Windows\System32\DRIVERS\s0016mgmt.sys [114216 2008-05-16] (MCCI Corporation) S3 s0016nd5; C:\Windows\System32\DRIVERS\s0016nd5.sys [25512 2008-05-16] (MCCI Corporation) S3 s0016obex; C:\Windows\System32\DRIVERS\s0016obex.sys [110632 2008-05-16] (MCCI Corporation) S3 s0016unic; C:\Windows\System32\DRIVERS\s0016unic.sys [115752 2008-05-16] (MCCI Corporation) S1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-10-31] (Avira GmbH) S3 usbdtv; C:\Windows\System32\Drivers\usbdtv.sys [31232 2005-06-07] (LITE-ON) S3 usbrndis6; C:\Windows\System32\DRIVERS\usb80236.sys [15872 2013-02-12] (Microsoft Corporation) S3 pccsmcfd; system32\DRIVERS\pccsmcfd.sys [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-11-25 12:56 - 2013-11-25 12:57 - 00012627 _____ C:\Users\Eule\Desktop\FRST.txt 2013-11-25 12:56 - 2013-11-25 12:56 - 00000000 ____D C:\FRST 2013-11-25 12:55 - 2013-11-25 12:55 - 01091583 _____ (Farbar) C:\Users\Eule\Desktop\FRST.exe 2013-11-25 12:23 - 2013-11-25 12:23 - 00000000 ____D C:\Users\Eule\Documents\PC Speed Maximizer 2013-11-25 12:14 - 2013-11-25 12:14 - 00001145 _____ C:\Users\Eule\Desktop\Continue Zip Extractor Installation.lnk 2013-11-22 12:49 - 2013-11-22 12:49 - 00000000 ____D C:\Users\Eule\AppData\Roaming\Avira 2013-11-22 12:48 - 2013-11-22 12:48 - 00000000 ____D C:\ProgramData\AskPartnerNetwork 2013-11-22 12:48 - 2013-11-22 12:48 - 00000000 ____D C:\Program Files\AskPartnerNetwork 2013-11-22 12:48 - 2013-05-31 20:51 - 00489392 _____ (Ask Partner Network) C:\Users\Eule\Documents\APNSetup1.exe 2013-11-22 12:46 - 2013-11-22 12:46 - 00002018 _____ C:\Users\Public\Desktop\Avira Control Center.lnk 2013-11-22 12:46 - 2013-10-31 19:25 - 00137208 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys 2013-11-22 12:46 - 2013-10-31 19:25 - 00090400 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys 2013-11-22 12:46 - 2013-10-31 19:25 - 00067680 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys 2013-11-22 12:46 - 2013-10-31 19:25 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys 2013-11-22 12:46 - 2013-10-31 19:25 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys 2013-11-22 12:45 - 2013-11-22 12:45 - 00000000 ____D C:\ProgramData\Avira 2013-11-22 12:45 - 2013-11-22 12:45 - 00000000 ____D C:\Program Files\Avira 2013-11-22 12:39 - 2013-11-22 12:44 - 126764512 _____ C:\Users\Eule\Desktop\avira_free_antivirus_de.exe 2013-11-22 12:14 - 2013-11-22 12:40 - 00000000 ____D C:\Users\Eule\AppData\Roaming\Nico Mak Computing 2013-11-22 12:13 - 2013-11-22 12:13 - 04892480 _____ (WinZip International LLC ) C:\Users\Eule\Desktop\wzmp_8.exe 2013-11-22 12:02 - 2013-11-22 12:02 - 02209056 _____ C:\Users\Eule\Downloads\avira-eu-cleaner_de.exe 2013-11-22 12:01 - 2013-11-22 12:01 - 00002033 _____ C:\Users\Eule\Desktop\Entfernen des Avira EU-Cleaners.lnk 2013-11-22 12:01 - 2013-11-22 12:01 - 00001977 _____ C:\Users\Eule\Desktop\Avira EU-Cleaner.lnk 2013-11-21 23:32 - 2013-11-21 23:32 - 00000000 ____D C:\Users\Eule\AppData\Roaming\Research In Motion 2013-11-21 23:30 - 2013-11-21 23:30 - 00002195 _____ C:\Users\Public\Desktop\BlackBerry Desktop Software.lnk 2013-11-20 14:14 - 2013-11-20 14:14 - 17142784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 11220992 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 04240384 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2013-11-20 14:14 - 2013-11-20 14:14 - 02166272 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 01926656 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2013-11-20 14:14 - 2013-11-20 14:14 - 01818112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 01156608 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 01051136 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00703488 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2013-11-20 14:14 - 2013-11-20 14:14 - 00645120 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat 2013-11-20 14:14 - 2013-11-20 14:14 - 00610304 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00553472 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00523776 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\html.iec 2013-11-20 14:14 - 2013-11-20 14:14 - 00244736 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00238288 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00233472 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00208896 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2013-11-20 14:14 - 2013-11-20 14:14 - 00208384 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00182272 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00151552 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe 2013-11-20 14:14 - 2013-11-20 14:14 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe 2013-11-20 14:14 - 2013-11-20 14:14 - 00127488 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2013-11-20 14:14 - 2013-11-20 14:14 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2013-11-20 14:14 - 2013-11-20 14:14 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00083456 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe 2013-11-20 14:14 - 2013-11-20 14:14 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe 2013-11-20 14:14 - 2013-11-20 14:14 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx 2013-11-20 14:14 - 2013-11-20 14:14 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe 2013-11-20 14:14 - 2013-11-20 14:14 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe 2013-11-20 14:14 - 2013-11-20 14:14 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2013-11-20 14:12 - 2013-11-20 14:17 - 00009945 _____ C:\Windows\IE11_main.log 2013-11-20 13:02 - 2013-11-21 23:21 - 00258048 _____ C:\ProgramData\tuswrwpl.dat 2013-11-20 12:29 - 2013-11-25 12:31 - 00000000 ____D C:\Program Files\7-Zip 2013-11-18 11:26 - 2013-11-21 14:39 - 00000000 ____D C:\Windows\rescache 2013-11-14 10:51 - 2013-11-14 13:43 - 03865088 _____ C:\Users\Eule\Desktop\Präsentation LVR.ppt 2013-11-13 13:26 - 2013-11-13 13:26 - 00083456 _____ C:\Users\Eule\Documents\Zeitstrahl Pro 4.ppt 2013-11-13 12:36 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll 2013-11-13 12:36 - 2013-10-04 02:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll 2013-11-13 12:36 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll 2013-11-13 12:36 - 2013-09-25 03:01 - 00136640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2013-11-13 12:36 - 2013-09-25 03:01 - 00067520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys 2013-11-13 12:36 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2013-11-13 12:36 - 2013-09-25 02:57 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll 2013-11-13 12:36 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll 2013-11-13 12:36 - 2013-09-25 02:56 - 01038848 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2013-11-13 12:36 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll 2013-11-13 12:36 - 2013-09-25 01:49 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe 2013-11-13 12:36 - 2013-09-25 01:49 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll 2013-11-13 12:36 - 2013-07-04 13:16 - 00369848 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys 2013-11-13 12:35 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll 2013-11-13 12:35 - 2013-10-12 03:01 - 00679424 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL 2013-11-13 12:35 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL 2013-11-13 12:35 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll 2013-11-13 12:35 - 2013-10-03 02:58 - 00305152 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll 2013-11-13 12:10 - 2013-11-22 08:54 - 00009616 _____ C:\Windows\setupact.log 2013-11-13 12:10 - 2013-11-13 12:10 - 00000000 _____ C:\Windows\setuperr.log ==================== One Month Modified Files and Folders ======= 2013-11-25 12:58 - 2011-07-21 13:43 - 00001096 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2013-11-25 12:57 - 2013-11-25 12:56 - 00012627 _____ C:\Users\Eule\Desktop\FRST.txt 2013-11-25 12:56 - 2013-11-25 12:56 - 00000000 ____D C:\FRST 2013-11-25 12:56 - 2009-11-07 01:18 - 01049534 _____ C:\Windows\WindowsUpdate.log 2013-11-25 12:55 - 2013-11-25 12:55 - 01091583 _____ (Farbar) C:\Users\Eule\Desktop\FRST.exe 2013-11-25 12:47 - 2009-07-14 05:34 - 00009712 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-11-25 12:47 - 2009-07-14 05:34 - 00009712 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-11-25 12:31 - 2013-11-20 12:29 - 00000000 ____D C:\Program Files\7-Zip 2013-11-25 12:23 - 2013-11-25 12:23 - 00000000 ____D C:\Users\Eule\Documents\PC Speed Maximizer 2013-11-25 12:16 - 2009-11-06 16:36 - 00001619 _____ C:\Users\Eule\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2013-11-25 12:14 - 2013-11-25 12:14 - 00001145 _____ C:\Users\Eule\Desktop\Continue Zip Extractor Installation.lnk 2013-11-25 12:00 - 2012-04-16 12:02 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-11-25 11:08 - 2011-07-21 13:43 - 00001092 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2013-11-25 11:00 - 2013-05-27 07:45 - 00000000 ____D C:\Program Files\File Type Assistant 2013-11-22 12:49 - 2013-11-22 12:49 - 00000000 ____D C:\Users\Eule\AppData\Roaming\Avira 2013-11-22 12:48 - 2013-11-22 12:48 - 00000000 ____D C:\ProgramData\AskPartnerNetwork 2013-11-22 12:48 - 2013-11-22 12:48 - 00000000 ____D C:\Program Files\AskPartnerNetwork 2013-11-22 12:46 - 2013-11-22 12:46 - 00002018 _____ C:\Users\Public\Desktop\Avira Control Center.lnk 2013-11-22 12:45 - 2013-11-22 12:45 - 00000000 ____D C:\ProgramData\Avira 2013-11-22 12:45 - 2013-11-22 12:45 - 00000000 ____D C:\Program Files\Avira 2013-11-22 12:44 - 2013-11-22 12:39 - 126764512 _____ C:\Users\Eule\Desktop\avira_free_antivirus_de.exe 2013-11-22 12:40 - 2013-11-22 12:14 - 00000000 ____D C:\Users\Eule\AppData\Roaming\Nico Mak Computing 2013-11-22 12:13 - 2013-11-22 12:13 - 04892480 _____ (WinZip International LLC ) C:\Users\Eule\Desktop\wzmp_8.exe 2013-11-22 12:02 - 2013-11-22 12:02 - 02209056 _____ C:\Users\Eule\Downloads\avira-eu-cleaner_de.exe 2013-11-22 12:01 - 2013-11-22 12:01 - 00002033 _____ C:\Users\Eule\Desktop\Entfernen des Avira EU-Cleaners.lnk 2013-11-22 12:01 - 2013-11-22 12:01 - 00001977 _____ C:\Users\Eule\Desktop\Avira EU-Cleaner.lnk 2013-11-22 08:58 - 2009-08-21 07:35 - 01507340 _____ C:\Windows\system32\PerfStringBackup.INI 2013-11-22 08:55 - 2013-04-12 18:12 - 00000000 ___RD C:\Users\Eule\Google Drive 2013-11-22 08:54 - 2013-11-13 12:10 - 00009616 _____ C:\Windows\setupact.log 2013-11-22 08:54 - 2009-07-14 05:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2013-11-21 23:43 - 2011-06-10 07:55 - 00008624 _____ C:\Users\Eule\AppData\Roaming\Rim.DesktopHelper.Exception.log 2013-11-21 23:43 - 2010-08-18 11:35 - 00054772 _____ C:\Users\Eule\AppData\Roaming\Rim.Desktop.Exception.log 2013-11-21 23:32 - 2013-11-21 23:32 - 00000000 ____D C:\Users\Eule\AppData\Roaming\Research In Motion 2013-11-21 23:32 - 2010-12-22 12:19 - 00000000 ____D C:\Users\Eule\AppData\Local\Research In Motion 2013-11-21 23:31 - 2010-08-18 11:22 - 00021897 _____ C:\Users\Eule\AppData\Roaming\Rim.Desktop.HttpServerSetup.log 2013-11-21 23:30 - 2013-11-21 23:30 - 00002195 _____ C:\Users\Public\Desktop\BlackBerry Desktop Software.lnk 2013-11-21 23:30 - 2012-08-02 08:36 - 00000000 ____D C:\ProgramData\Research In Motion 2013-11-21 23:30 - 2012-02-15 15:42 - 00000000 ____D C:\Program Files\Common Files\XCPCSync.OEM 2013-11-21 23:29 - 2010-08-15 13:48 - 00000000 ____D C:\Program Files\Research In Motion 2013-11-21 23:29 - 2010-08-15 13:48 - 00000000 ____D C:\Program Files\Common Files\Research In Motion 2013-11-21 23:21 - 2013-11-20 13:02 - 00258048 _____ C:\ProgramData\tuswrwpl.dat 2013-11-21 23:15 - 2012-02-15 15:46 - 00014476 _____ C:\Users\Eule\AppData\Roaming\Rim.Transcoder.Exception.log 2013-11-21 22:34 - 2011-09-11 12:56 - 00000000 ____D C:\Users\Eule\AppData\Local\Downloaded Installations 2013-11-21 14:39 - 2013-11-18 11:26 - 00000000 ____D C:\Windows\rescache 2013-11-20 14:19 - 2013-10-11 12:54 - 00001712 _____ C:\Windows\PFRO.log 2013-11-20 14:19 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\system32\de-DE 2013-11-20 14:18 - 2011-02-08 19:58 - 00001912 _____ C:\Windows\epplauncher.mif 2013-11-20 14:17 - 2013-11-20 14:12 - 00009945 _____ C:\Windows\IE11_main.log 2013-11-20 14:17 - 2011-02-08 19:56 - 00000000 ____D C:\Program Files\Microsoft Security Client 2013-11-20 14:14 - 2013-11-20 14:14 - 17142784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 11220992 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 04240384 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2013-11-20 14:14 - 2013-11-20 14:14 - 02166272 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 01926656 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2013-11-20 14:14 - 2013-11-20 14:14 - 01818112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 01156608 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 01051136 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00703488 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2013-11-20 14:14 - 2013-11-20 14:14 - 00645120 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat 2013-11-20 14:14 - 2013-11-20 14:14 - 00610304 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00553472 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00523776 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\html.iec 2013-11-20 14:14 - 2013-11-20 14:14 - 00244736 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00238288 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00233472 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00208896 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2013-11-20 14:14 - 2013-11-20 14:14 - 00208384 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00182272 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00151552 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe 2013-11-20 14:14 - 2013-11-20 14:14 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe 2013-11-20 14:14 - 2013-11-20 14:14 - 00127488 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2013-11-20 14:14 - 2013-11-20 14:14 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2013-11-20 14:14 - 2013-11-20 14:14 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00083456 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe 2013-11-20 14:14 - 2013-11-20 14:14 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe 2013-11-20 14:14 - 2013-11-20 14:14 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx 2013-11-20 14:14 - 2013-11-20 14:14 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll 2013-11-20 14:14 - 2013-11-20 14:14 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe 2013-11-20 14:14 - 2013-11-20 14:14 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe 2013-11-20 14:14 - 2013-11-20 14:14 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2013-11-20 11:56 - 2013-04-29 12:49 - 00000000 ____D C:\Users\Eule\Documents\DDPB 2013-11-19 11:21 - 2009-11-06 17:07 - 00230048 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe 2013-11-14 13:43 - 2013-11-14 10:51 - 03865088 _____ C:\Users\Eule\Desktop\Präsentation LVR.ppt 2013-11-14 11:20 - 2012-02-27 11:22 - 00023552 _____ C:\Users\Eule\Documents\Codes für alles.xls 2013-11-14 09:15 - 2012-04-16 12:02 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe 2013-11-14 09:15 - 2011-06-28 07:00 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl 2013-11-14 09:15 - 2009-11-06 16:35 - 00000000 ____D C:\Users\Eule\AppData\Local\Adobe 2013-11-14 09:10 - 2009-08-07 14:43 - 00000000 ____D C:\Windows\Panther 2013-11-13 13:47 - 2009-08-21 07:31 - 00000000 ____D C:\ProgramData\Microsoft Help 2013-11-13 13:45 - 2010-11-16 08:53 - 00000000 ____D C:\Windows\WindowsMobile 2013-11-13 13:41 - 2013-07-19 08:43 - 00000000 ____D C:\Windows\system32\MRT 2013-11-13 13:38 - 2009-11-26 09:21 - 80340640 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2013-11-13 13:26 - 2013-11-13 13:26 - 00083456 _____ C:\Users\Eule\Documents\Zeitstrahl Pro 4.ppt 2013-11-13 12:38 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\Microsoft.NET 2013-11-13 12:10 - 2013-11-13 12:10 - 00000000 _____ C:\Windows\setuperr.log 2013-11-12 16:08 - 2009-07-14 03:04 - 00000499 _____ C:\Windows\win.ini 2013-11-12 11:14 - 2011-03-09 10:20 - 00000000 ____D C:\Users\Eule\Desktop\Privat 2013-11-05 08:49 - 2013-04-15 09:17 - 00000000 ____D C:\Users\Eule\Desktop\BUT 2013-10-31 19:25 - 2013-11-22 12:46 - 00137208 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys 2013-10-31 19:25 - 2013-11-22 12:46 - 00090400 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys 2013-10-31 19:25 - 2013-11-22 12:46 - 00067680 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys 2013-10-31 19:25 - 2013-11-22 12:46 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys 2013-10-31 19:25 - 2013-11-22 12:46 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys 2013-10-30 11:07 - 2013-04-08 10:59 - 00000000 _____ C:\Users\Eule\Documents\RIMPTG Files to move or delete: ==================== C:\ProgramData\tuswrwpl.dat Some content of TEMP: ==================== C:\Users\Eule\AppData\Local\Temp\2SKKKKKKK.exe C:\Users\Eule\AppData\Local\Temp\89.4239114108929_Update.exe C:\Users\Eule\AppData\Local\Temp\avgnt.exe C:\Users\Eule\AppData\Local\Temp\ICReinstall_ZipExtractorSetup.exe C:\Users\Eule\AppData\Local\Temp\pcspeedmaxsetup.exe ==================== Bamital & volsnap Check ================= C:\Windows\explorer.exe => MD5 is legit C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-11-20 10:54 ==================== End Of Log ============================ LOG von FRST Addition: Additional scan result of Farbar Recovery Scan Tool (x86) Version: 24-11-2013 Ran by Eule at 2013-11-25 12:58:53 Running from C:\Users\Eule\Desktop Boot Mode: Normal ========================================================== ==================== Security Center ======================== AV: Microsoft Security Essentials (Enabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F} AV: Avira Desktop (Enabled - Out of date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C} AS: Avira Desktop (Enabled - Out of date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691} AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: Microsoft Security Essentials (Enabled - Up to date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2} ==================== Installed Programs ====================== Activation Assistant for the 2007 Microsoft Office suites Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0) Adobe Flash Player 11 ActiveX (Version: 11.9.900.152) Adobe Flash Player 11 Plugin (Version: 11.9.900.117) Adobe Reader XI (11.0.05) - Deutsch (Version: 11.0.05) Advertising Center (Version: 0.0.0.1) AutocompletePro Avira Free Antivirus (Version: 14.0.1.719) Avira SearchFree Toolbar (Version: 12.6.0.1900) BlackBerry Desktop Software 7.1 (Version: 7.1.0.41) BlackBerry Device Software Updater (Version: 8.0.0.41) CANON iMAGE GATEWAY Task for ZoomBrowser EX (Version: 1.5.0.3) Canon Internet Library for ZoomBrowser EX (Version: 1.6.1.6) Canon MP Navigator EX 2.0 Canon RAW Image Task for ZoomBrowser EX (Version: 3.2.0.10) Canon Utilities CameraWindow (Version: 7.1.0.2) Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX (Version: 6.4.2.16) Canon Utilities Digital Photo Professional 3.3 (Version: 3.3.1.1) Canon Utilities EOS Utility (Version: 2.3.1.3) Canon Utilities MyCamera (Version: 6.4.0.5) Canon Utilities Original Data Security Tools (Version: 1.3.0.0) Canon Utilities PhotoStitch (Version: 3.1.21.45) Canon Utilities Picture Style Editor (Version: 1.2.0.1) Canon Utilities RemoteCapture Task for ZoomBrowser EX (Version: 1.7.1.9) Canon Utilities WFT-E1/E2/E3 Utility (Version: 3.2.1.1) Canon Utilities ZoomBrowser EX (Version: 6.1.1.21) Canon ZoomBrowser EX Memory Card Utility (Version: 1.1.0.8) CCleaner (Version: 4.02) Compatibility Pack for the 2007 Office system (Version: 12.0.6612.1000) DDPB (Version: 1.0.9) Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition EOS USB WIA Driver (Version: 6.0.1.5) File Type Assistant (Version: 2013.4.8.0) Google Calendar Sync Google Drive (Version: 1.12.5329.1887) Google Update Helper (Version: 1.3.21.165) ImagXpress (Version: 7.0.74.0) Java(TM) 6 Update 25 (Version: 6.0.250) MATHEARBEIT Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319) Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319) Microsoft Antimalware Service DE-DE Language Pack (Version: 3.0.8402.2) Microsoft Application Error Reporting (Version: 12.0.6012.5000) Microsoft Office 2003 Primary Interop Assemblies (Version: 11.0.6553.0) Microsoft Office File Validation Add-In (Version: 14.0.5130.5003) Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1) Microsoft Office Outlook 2010 (Version: 14.0.7015.1000) Microsoft Office Outlook Connector (Version: 14.0.6123.5001) Microsoft Office Outlook MUI (German) 2010 (Version: 14.0.7015.1000) Microsoft Office Professional Edition 2003 (Version: 11.0.8173.0) Microsoft Office Proof (English) 2010 (Version: 14.0.7015.1000) Microsoft Office Proof (French) 2010 (Version: 14.0.7015.1000) Microsoft Office Proof (German) 2010 (Version: 14.0.7015.1000) Microsoft Office Proof (Italian) 2010 (Version: 14.0.7015.1000) Microsoft Office Proofing (German) 2010 (Version: 14.0.7015.1000) Microsoft Office Shared MUI (German) 2010 (Version: 14.0.7015.1000) Microsoft Outlook 2010 (Version: 14.0.7015.1000) Microsoft Security Client (Version: 4.4.0304.0) Microsoft Security Client DE-DE Language Pack (Version: 2.1.1116.0) Microsoft Security Essentials (Version: 4.4.304.0) Microsoft Silverlight (Version: 5.1.20913.0) Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053) Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001) Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (Version: 9.0.30729.5570) Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (Version: 9.0.21022) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (Version: 10.0.40219) Microsoft-Maus- und Tastatur-Center (Version: 2.2.173.0) MSVC80_x86_v2 (Version: 1.0.3.0) MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0) MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0) Nero 9 Essentials Nero BurnRights (Version: 3.4.10.100) Nero BurnRights Help (Version: 3.4.4.100) Nero ControlCenter (Version: 9.0.0.1) Nero CoverDesigner (Version: 4.4.9.203) Nero CoverDesigner Help (Version: 4.4.6.100) Nero DiscSpeed (Version: 5.4.7.202) Nero DiscSpeed Help (Version: 5.4.4.100) Nero DriveSpeed (Version: 4.4.10.100) Nero DriveSpeed Help (Version: 4.4.4.100) Nero InfoTool (Version: 6.4.7.204) Nero InfoTool Help (Version: 6.4.4.100) Nero Installer (Version: 4.4.8.1) Nero StartSmart (Version: 9.4.11.207) Nero StartSmart Help (Version: 9.4.1.100) Nero StartSmart OEM (Version: 9.4.10.100) neroxml (Version: 1.0.0) NVIDIA Drivers (Version: 1.4) Print To Go 2.0 (Version: 2.0.110.0) PVSonyDll (Version: 1.00.0001) Realtek High Definition Audio Driver (Version: 6.0.1.5859) Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition Synaptics Pointing Device Driver (Version: 13.2.6.1) SystemDiagnostics (Version: 2.04.0006) TuneUp Utilities Language Pack (de-DE) (Version: 12.0.2120.5) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (Version: 3) Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition Update for Microsoft Word 2010 (KB2827323) 32-Bit Edition WDR RadioRecorder Wireless_Utility (Version: 2.04.0716) Wireless_Utility (Version: 2.05.1005) ==================== Restore Points ========================= ==================== Hosts content: ========================== 2009-07-14 03:04 - 2009-06-10 22:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: {06F17F61-E4C2-4A8C-A6FA-C59A86537961} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-11-14] (Adobe Systems Incorporated) Task: {0C49DCC8-7754-44B5-B6A8-01FC8B64E99E} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2010-11-20] (Microsoft Corporation) Task: {11965860-D81D-420D-9628-4B66EB978307} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-11] (Microsoft Corporation) Task: {12104A29-5A58-49D6-A71A-284E741304D0} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-05-24] (Piriform Ltd) Task: {1E236167-7D16-4050-B19F-12017F591295} - System32\Tasks\DSite => C:\Users\Eule\AppData\Roaming\DSite\UPDATE~1\UPDATE~1.EXE Task: {29AA1A91-D99B-4DB8-A052-BE33E19D4C15} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\MouseKeyboardCenter.exe [2013-05-13] (Microsoft) Task: {2B8132BC-1162-468D-98C8-34E9B1CACA05} - System32\Tasks\ProgramUpdateCheck => C:\Program Files\File Type Assistant\tsassist.exe [2013-04-08] (Trusted Software ApS) Task: {2DA0CD1A-4379-4431-BCC0-B1C61A883F07} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc Task: {3C6D24A5-3E5F-4823-98A6-1542C7AE438A} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2013-05-13] (Microsoft Corporation) Task: {43DC421F-F021-453B-9EB0-1CD67BEA3568} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2013-05-13] (Microsoft Corporation) Task: {43E054FD-A8C0-4DBC-BAA6-652BCA52C633} - System32\Tasks\DealPly => C:\Users\Eule\AppData\Roaming\DealPly\UPDATE~1\UPDATE~1.EXE Task: {6BFBB788-A6F6-4AAB-89C0-07B145A8C649} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2011-07-21] (Google Inc.) Task: {6C1791F2-ADA9-45E4-8BED-E8BE8752B4E6} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2011-07-21] (Google Inc.) Task: {78CA2345-BB58-4C2A-8452-9894D455E09C} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2013-05-13] (Microsoft Corporation) Task: {83D077C3-C880-4DD6-BBAA-7A54DA7C3DC9} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2013-05-13] (Microsoft Corporation) Task: {C1C231DE-994F-4A4C-B830-3C8A41DCA8F8} - System32\Tasks\0 => Iexplore.exe Task: {C1DF6582-979F-48B4-9C5A-BAF7B7343E8E} - System32\Tasks\4675 => C:\Users\Eule\AppData\Local\Temp\launchie.vbsC:\Users\Eule\AppData\Local\Temp\launchie.vbs //B Task: {D57E33A8-3888-4899-8F37-D4B1D09B1381} - System32\Tasks\ProgramRefresh-ATFST => C:\Program Files\File Type Assistant\TSASetup.exe [2013-04-08] ( ) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe ==================== Loaded Modules (whitelisted) ============= ==================== Alternate Data Streams (whitelisted) ========= ==================== Safe Mode (whitelisted) =================== ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (11/25/2013 00:28:16 PM) (Source: Application Hang) (User: ) Description: Programm ZipExtractorSetup.exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: df4 Startzeit: 01cee9cf8a323f70 Endzeit: 47 Anwendungspfad: C:\Users\Eule\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F3EAZ9T5\ZipExtractorSetup.exe Berichts-ID: Error: (11/25/2013 00:15:38 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3. Das erforderliche "name"-Attribut fehlt im assemblyIdentity-Element. Error: (11/25/2013 10:56:46 AM) (Source: Windows Backup) (User: ) Description: Die Sicherung wurde aufgrund eines Fehlers beim Schreiben am Sicherungsspeicherort "F:\" nicht abgeschlossen. Fehler: "Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)" Error: (11/25/2013 10:53:58 AM) (Source: VSS) (User: ) Description: Volumeschattenkopie-Dienstfehler: Unerwarteter Fehler "DeviceIoControl(\\?\Volume{889d8ee5-cb32-11de-b03d-806e6f6e6963} - 00000120,0x0053c008,00D41FB8,0,00D42FC0,4096,[0])". hr = 0x80070079, Das Zeitlimit für die Semaphore wurde erreicht. . Vorgang: EndPrepareSnapshots wird verarbeitet Kontext: Ausführungskontext: System Provider Error: (11/22/2013 10:58:01 AM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1". Die abhängige Assemblierung "Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". Error: (11/21/2013 10:37:17 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: BbDevMgr.exe, Version: 4.2.0.33, Zeitstempel: 0x51cc5527 Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea91c Ausnahmecode: 0xc0000005 Fehleroffset: 0x0003224d ID des fehlerhaften Prozesses: 0xed4 Startzeit der fehlerhaften Anwendung: 0xBbDevMgr.exe0 Pfad der fehlerhaften Anwendung: BbDevMgr.exe1 Pfad des fehlerhaften Moduls: BbDevMgr.exe2 Berichtskennung: BbDevMgr.exe3 Error: (11/21/2013 09:44:06 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: RIMDeviceManager.exe, Version: 7.0.0.59, Zeitstempel: 0x520beea8 Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000 Ausnahmecode: 0xc0000005 Fehleroffset: 0x00ba34f0 ID des fehlerhaften Prozesses: 0x14c4 Startzeit der fehlerhaften Anwendung: 0xRIMDeviceManager.exe0 Pfad der fehlerhaften Anwendung: RIMDeviceManager.exe1 Pfad des fehlerhaften Moduls: RIMDeviceManager.exe2 Berichtskennung: RIMDeviceManager.exe3 Error: (11/21/2013 01:39:26 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1". Die abhängige Assemblierung "Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". Error: (11/21/2013 00:12:53 PM) (Source: Application Hang) (User: ) Description: Programm iexplore.exe, Version 11.0.9600.16428 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 7dc Startzeit: 01cee6aa32337140 Endzeit: 0 Anwendungspfad: C:\Program Files\Internet Explorer\iexplore.exe Berichts-ID: Error: (11/20/2013 10:55:34 AM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1". Die abhängige Assemblierung "Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". System errors: ============= Error: (11/25/2013 11:17:33 AM) (Source: Service Control Manager) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows-Fehlerberichterstattungsdienst erreicht. Error: (11/25/2013 11:13:15 AM) (Source: Microsoft Antimalware) (User: ) Description: Beim Aktualisieren der Signaturen wurde von %NT-AUTORITÄT60 ein Fehler festgestellt. Neue Signaturversion: Vorherige Signaturversion: 1.163.340.0 Aktualisierungsquelle: %NT-AUTORITÄT59 Aktualisierungsphase: 4.4.0304.00 Quellpfad: 4.4.0304.01 Signaturtyp: %NT-AUTORITÄT602 Aktualisierungstyp: %NT-AUTORITÄT604 Benutzer: NT-AUTORITÄT\SYSTEM Aktuelle Modulversion: %NT-AUTORITÄT605 Vorherige Modulversion: %NT-AUTORITÄT606 Fehlercode: %NT-AUTORITÄT607 Fehlerbeschreibung: %NT-AUTORITÄT608 Error: (11/25/2013 10:53:50 AM) (Source: Service Control Manager) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst AntiVirSchedulerService erreicht. Error: (11/25/2013 10:53:47 AM) (Source: volsnap) (User: ) Description: Die Schattenkopie des erstellten Volumes "C:" konnte nicht installiert werden. Error: (11/21/2013 11:17:58 PM) (Source: Service Control Manager) (User: ) Description: Dienst "BlackBerry Device Manager" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Error: (11/21/2013 09:34:27 PM) (Source: bowser) (User: ) Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "PLAYBOOK-5D2B", der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{4F8CABAA-F522-4CE4-97D3-14CC-Transport zu sein scheint. Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen. Error: (11/21/2013 00:13:09 PM) (Source: Schannel) (User: NT-AUTORITÄT) Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252. Error: (11/20/2013 02:16:52 PM) (Source: bowser) (User: ) Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "PLAYBOOK-5D2B", der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{4F8CABAA-F522-4CE4-97D3-14CC-Transport zu sein scheint. Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen. Error: (11/20/2013 01:39:33 PM) (Source: bowser) (User: ) Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "PLAYBOOK-5D2B", der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{4F8CABAA-F522-4CE4-97D3-14CC-Transport zu sein scheint. Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen. Error: (11/20/2013 11:59:30 AM) (Source: bowser) (User: ) Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "PLAYBOOK-5D2B", der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{4F8CABAA-F522-4CE4-97D3-14CC-Transport zu sein scheint. Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen. Microsoft Office Sessions: ========================= Error: (11/25/2013 00:28:16 PM) (Source: Application Hang)(User: ) Description: ZipExtractorSetup.exe0.0.0.0df401cee9cf8a323f7047C:\Users\Eule\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F3EAZ9T5\ZipExtractorSetup.exe Error: (11/25/2013 00:15:38 PM) (Source: SideBySide)(User: ) Description: assemblyIdentitynameC:\Users\Eule\AppData\Local\Temp\89.4239114108929_Update.exeC:\Users\Eule\AppData\Local\Temp\89.4239114108929_Update.exe3 Error: (11/25/2013 10:56:46 AM) (Source: Windows Backup)(User: ) Description: F:\Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006) Error: (11/25/2013 10:53:58 AM) (Source: VSS)(User: ) Description: DeviceIoControl(\\?\Volume{889d8ee5-cb32-11de-b03d-806e6f6e6963} - 00000120,0x0053c008,00D41FB8,0,00D42FC0,4096,[0])0x80070079, Das Zeitlimit für die Semaphore wurde erreicht. Vorgang: EndPrepareSnapshots wird verarbeitet Kontext: Ausführungskontext: System Provider Error: (11/22/2013 10:58:01 AM) (Source: SideBySide)(User: ) Description: Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"C:\Program Files\Research In Motion\BlackBerry Desktop\MailServerMAPIProxy64.exe Error: (11/21/2013 10:37:17 PM) (Source: Application Error)(User: ) Description: BbDevMgr.exe4.2.0.3351cc5527ntdll.dll6.1.7601.18247521ea91cc00000050003224ded401cee6fb53c646b0C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exeC:\Windows\SYSTEM32\ntdll.dll1778e170-52f5-11e3-b93c-00158352d18e Error: (11/21/2013 09:44:06 PM) (Source: Application Error)(User: ) Description: RIMDeviceManager.exe7.0.0.59520beea8unknown0.0.0.000000000c000000500ba34f014c401cee6f853163fc0C:\Program Files\Common Files\Research In Motion\RIMDeviceManager\RIMDeviceManager.exeunknowna99cef40-52ed-11e3-8408-001e330efe24 Error: (11/21/2013 01:39:26 PM) (Source: SideBySide)(User: ) Description: Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"C:\Program Files\Research In Motion\BlackBerry Desktop\MailServerMAPIProxy64.exe Error: (11/21/2013 00:12:53 PM) (Source: Application Hang)(User: ) Description: iexplore.exe11.0.9600.164287dc01cee6aa323371400C:\Program Files\Internet Explorer\iexplore.exe Error: (11/20/2013 10:55:34 AM) (Source: SideBySide)(User: ) Description: Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"C:\Program Files\Research In Motion\BlackBerry Desktop\MailServerMAPIProxy64.exe ==================== Memory info =========================== Percentage of memory in use: 63% Total physical RAM: 1534.42 MB Available physical RAM: 553.29 MB Total Pagefile: 3068.84 MB Available Pagefile: 1570.09 MB Total Virtual: 2047.88 MB Available Virtual: 1890.91 MB ==================== Drives ================================ Drive c: (System) (Fixed) (Total:50 GB) (Free:15.06 GB) NTFS ==>[System with boot components (obtained from reading drive)] Drive d: (Data) (Fixed) (Total:97.04 GB) (Free:29.99 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 149 GB) (Disk ID: D22F9EB7) Partition 1: (Active) - (Size=2 GB) - (Type=27) Partition 2: (Not Active) - (Size=50 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=97 GB) - (Type=07 NTFS) ==================== End Of Log ============================ LOG von Gmer: MER 2.1.19163 - hxxp://www.gmer.net Rootkit scan 2013-11-25 14:08:22 Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 Hitachi_HTS545016B9A300 rev.PBBOC64G 149,05GB Running: gmer_2.1.19163.exe; Driver: C:\Users\Eule\AppData\Local\Temp\pwtoqpow.sys ---- System - GMER 2.1 ---- SSDT 89137A56 ZwCreateSection SSDT 89137A60 ZwRequestWaitReplyPort SSDT 89137A5B ZwSetContextThread SSDT 89137A65 ZwSetSecurityObject SSDT 89137A6A ZwSystemDebugControl SSDT 891379F7 ZwTerminateProcess ---- Kernel code sections - GMER 2.1 ---- .text ntkrnlpa.exe!ZwRollbackEnlistment + 142D 83244A15 1 Byte [06] .text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 8327E212 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3} .text ntkrnlpa.exe!KeRemoveQueueEx + 11F7 8328558C 4 Bytes [56, 7A, 13, 89] .text ntkrnlpa.exe!KeRemoveQueueEx + 1553 832858E8 4 Bytes [60, 7A, 13, 89] .text ntkrnlpa.exe!KeRemoveQueueEx + 1597 8328592C 4 Bytes [5B, 7A, 13, 89] .text ntkrnlpa.exe!KeRemoveQueueEx + 1613 832859A8 4 Bytes [65, 7A, 13, 89] .text ntkrnlpa.exe!KeRemoveQueueEx + 1667 832859FC 4 Bytes [6A, 7A, 13, 89] .text ... ---- User code sections - GMER 2.1 ---- .text C:\Windows\system32\taskeng.exe[448] kernel32.dll!CreateProcessW 779D204D 5 Bytes JMP 01BD747A .text C:\Windows\system32\taskeng.exe[448] kernel32.dll!CreateProcessA 779D2082 5 Bytes JMP 01BD74CF .text C:\Windows\system32\taskeng.exe[448] ADVAPI32.dll!CreateProcessAsUserW 7766C532 5 Bytes JMP 01BD7524 .text C:\Windows\system32\taskeng.exe[448] ADVAPI32.dll!CreateProcessAsUserA 776A2642 5 Bytes JMP 01BD757C .text C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[1204] kernel32.dll!CreateProcessW 779D204D 5 Bytes JMP 020E747A .text C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[1204] kernel32.dll!CreateProcessA 779D2082 5 Bytes JMP 020E74CF .text C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[1204] ADVAPI32.dll!CreateProcessAsUserW 7766C532 5 Bytes JMP 020E7524 .text C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[1204] ADVAPI32.dll!CreateProcessAsUserA 776A2642 5 Bytes JMP 020E757C .text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[1332] kernel32.dll!CreateProcessW 779D204D 5 Bytes JMP 01F3747A .text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[1332] kernel32.dll!CreateProcessA 779D2082 5 Bytes JMP 01F374CF .text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[1332] ADVAPI32.dll!CreateProcessAsUserW 7766C532 5 Bytes JMP 01F37524 .text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[1332] ADVAPI32.dll!CreateProcessAsUserA 776A2642 5 Bytes JMP 01F3757C .text C:\Windows\system32\Dwm.exe[1692] kernel32.dll!CreateProcessW 779D204D 5 Bytes JMP 01D1747A .text C:\Windows\system32\Dwm.exe[1692] kernel32.dll!CreateProcessA 779D2082 5 Bytes JMP 01D174CF .text C:\Windows\system32\Dwm.exe[1692] ADVAPI32.dll!CreateProcessAsUserW 7766C532 5 Bytes JMP 01D17524 .text C:\Windows\system32\Dwm.exe[1692] ADVAPI32.dll!CreateProcessAsUserA 776A2642 5 Bytes JMP 01D1757C .text C:\Windows\Explorer.EXE[1724] kernel32.dll!CreateProcessW 779D204D 5 Bytes JMP 080D747A .text C:\Windows\Explorer.EXE[1724] kernel32.dll!CreateProcessA 779D2082 5 Bytes JMP 080D74CF .text C:\Windows\Explorer.EXE[1724] ADVAPI32.dll!CreateProcessAsUserW 7766C532 5 Bytes JMP 080D7524 .text C:\Windows\Explorer.EXE[1724] ADVAPI32.dll!CreateProcessAsUserA 776A2642 5 Bytes JMP 080D757C .text C:\Windows\system32\taskhost.exe[1772] kernel32.dll!CreateProcessW 779D204D 5 Bytes JMP 02D6747A .text C:\Windows\system32\taskhost.exe[1772] kernel32.dll!CreateProcessA 779D2082 5 Bytes JMP 02D674CF .text C:\Windows\system32\taskhost.exe[1772] ADVAPI32.dll!CreateProcessAsUserW 7766C532 5 Bytes JMP 02D67524 .text C:\Windows\system32\taskhost.exe[1772] ADVAPI32.dll!CreateProcessAsUserA 776A2642 5 Bytes JMP 02D6757C .text C:\Program Files\Tobit Radio.fx\Server\rfx-server.exe[1856] kernel32.dll!SetUnhandledExceptionFilter 77A1F4EB 5 Bytes JMP 00641870 C:\Program Files\Tobit Radio.fx\Server\rfx-server.exe .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2468] kernel32.dll!CreateProcessW 779D204D 5 Bytes JMP 016E747A .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2468] kernel32.dll!CreateProcessA 779D2082 5 Bytes JMP 016E74CF .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2468] ADVAPI32.dll!CreateProcessAsUserW 7766C532 5 Bytes JMP 016E7524 .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2468] ADVAPI32.dll!CreateProcessAsUserA 776A2642 5 Bytes JMP 016E757C .text C:\Program Files\Fujitsu\Wireless_Utility\Wireless Selector.exe[2604] kernel32.dll!CreateProcessW 779D204D 5 Bytes JMP 0179747A .text C:\Program Files\Fujitsu\Wireless_Utility\Wireless Selector.exe[2604] kernel32.dll!CreateProcessA 779D2082 5 Bytes JMP 017974CF .text C:\Program Files\Fujitsu\Wireless_Utility\Wireless Selector.exe[2604] ADVAPI32.dll!CreateProcessAsUserW 7766C532 5 Bytes JMP 01797524 .text C:\Program Files\Fujitsu\Wireless_Utility\Wireless Selector.exe[2604] ADVAPI32.dll!CreateProcessAsUserA 776A2642 5 Bytes JMP 0179757C .text C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe[2664] kernel32.dll!CreateProcessW 779D204D 5 Bytes JMP 0224747A .text C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe[2664] kernel32.dll!CreateProcessA 779D2082 5 Bytes JMP 022474CF .text C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe[2664] ADVAPI32.dll!CreateProcessAsUserW 7766C532 5 Bytes JMP 02247524 .text C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe[2664] ADVAPI32.dll!CreateProcessAsUserA 776A2642 5 Bytes JMP 0224757C .text C:\Program Files\Microsoft Security Client\msseces.exe[2832] kernel32.dll!CreateProcessW 779D204D 5 Bytes JMP 028B747A .text C:\Program Files\Microsoft Security Client\msseces.exe[2832] kernel32.dll!CreateProcessA 779D2082 5 Bytes JMP 028B74CF .text C:\Program Files\Microsoft Security Client\msseces.exe[2832] ADVAPI32.dll!CreateProcessAsUserW 7766C532 5 Bytes JMP 028B7524 .text C:\Program Files\Microsoft Security Client\msseces.exe[2832] ADVAPI32.dll!CreateProcessAsUserA 776A2642 5 Bytes JMP 028B757C .text C:\Program Files\Internet Explorer\iexplore.exe[2900] kernel32.dll!CreateProcessW 779D204D 5 Bytes JMP 00A0747A .text C:\Program Files\Internet Explorer\iexplore.exe[2900] kernel32.dll!CreateProcessA 779D2082 5 Bytes JMP 00A074CF .text C:\Program Files\Internet Explorer\iexplore.exe[2900] advapi32.DLL!CreateProcessAsUserW 7766C532 5 Bytes JMP 00A07524 .text C:\Program Files\Internet Explorer\iexplore.exe[2900] advapi32.DLL!CreateProcessAsUserA 776A2642 5 Bytes JMP 00A0757C .text C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!InternetReadFileExA 77792055 5 Bytes JMP 00A06B62 .text C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!InternetWriteFile 777C46D9 5 Bytes JMP 00A03D24 .text C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!HttpEndRequestA 777C4B75 5 Bytes JMP 00A04272 .text C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!HttpSendRequestExW 777C5E07 5 Bytes JMP 00A06F17 .text C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!InternetQueryOptionA 777DDC3E 5 Bytes JMP 00A04560 .text C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!InternetSetOptionA 777DF69A 5 Bytes JMP 00A0463E .text C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!InternetSetOptionW 777DFA34 5 Bytes JMP 00A0466D .text C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!InternetQueryOptionW 777E03CD 5 Bytes JMP 00A0458F .text C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!HttpOpenRequestW 777E2957 5 Bytes JMP 00A0442C .text C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!InternetCloseHandle 777E5B7F 5 Bytes JMP 00A06886 .text C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!HttpQueryInfoA 777E72A0 5 Bytes JMP 00A03BE4 .text C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!InternetConnectW 777E8F57 5 Bytes JMP 00A06941 .text C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!InternetReadFile 777F4390 5 Bytes JMP 00A06B15 .text C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!InternetQueryDataAvailable 777F8461 5 Bytes JMP 00A06988 .text C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!HttpSendRequestW 777F8DD0 5 Bytes JMP 00A06DF1 .text C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!HttpSendRequestA 7780F6FA 5 Bytes JMP 00A06D7F .text C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!InternetConnectA 7785D336 5 Bytes JMP 00A068FA .text C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!HttpEndRequestW 7787F5B8 5 Bytes JMP 00A0429F .text C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!HttpSendRequestExA 7787F671 5 Bytes JMP 00A06E63 .text C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!HttpOpenRequestA 7787FA9D 5 Bytes JMP 00A043CA ---- Devices - GMER 2.1 ---- AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager@PendingFileRenameOperations ?????????????????????????????7??????????????????????????????????????????CD/DVD File System Reader???HidUsb?ll???????????? ??????????????????Tcpip6??NNEL?Tcpip6??????????????-?????????????? #??????????????? ???????????????????r?1????????????????????? ?????????????????????1????????????????????HID\VID_04F3&PID_01A4&REV_0100&MI_01&Col01?HID\VID_04F3&PID_01A4&MI_01&Col01?HID_DEVICE_SYSTEM_MOUSE?HID_DEV ICE_UP:0001_U:0002?HID_DEVICE????a??@hidserv.inf,%mfgname%;Microsoft????6.1.7601.18199????????(??????&??????HID-konformes Ger?t??????????????/???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&?? ?&???&???&???&???&???&???&???&???&????AFD NetBIOS [\Device\NetBT_Tcpip6_{58B45821-E940-47B3-8D???????????F?????????????e 2??hidserv.inf:Microsoft.NTx86:HIDSystemConsumerDevice:6.1.7600.16385:hid_device_up:000c_u:0001?2????????????????????????????????????????????????????? ?#????0?????????????????????????????????????????i????????B?? Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\00158352d18e Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\00158352d18e@1474111c2257 0xCA 0x3A 0x91 0xB4 ... Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\00158352d18e@70d4f230f561 0x55 0x13 0x23 0x52 ... Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\00158352d18e (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\00158352d18e@1474111c2257 0xCA 0x3A 0x91 0xB4 ... Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\00158352d18e@70d4f230f561 0x55 0x13 0x23 0x52 ... ---- EOF - GMER 2.1 ---- |
| Themen zu wie entferne ich unter Windows 7 Postbankrojaner ? |
| adobe, antivir, antivirus, avira, avira searchfree toolbar, computer, continue, defender, device driver, entfernen, error, fehler, flash player, homepage, icreinstall, mozilla, nicht installiert, ntdll.dll, plug-in, postbanktrojaner windows7, programm, realtek, registry, richtlinie, rundll, security, server, services.exe, svchost.exe, system, taskhost.exe, trojaner, usb, warnung, windows |
Baum-Darstellung