Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung
wie entferne ich unter Windows 7 Postbankrojaner ?

wie entferne ich unter Windows 7 Postbankrojaner ?


Log-Analyse und Auswertung: wie entferne ich unter Windows 7 Postbankrojaner ?

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML.

Antwort
Alt 27.11.2013, 13:54   #1
Marc11
 
wie entferne ich unter Windows 7 Postbankrojaner ? - Standard

wie entferne ich unter Windows 7 Postbankrojaner ?


Hallo!
Ich habe mir einen Trojaner der Postbank eingefangen. Habe die folgenden Logs gemacht. Was kann / muss ich tun, um diesen Trojaner wieder los zu werden.

Habe in den LOGS meinen Namen durch EULE ersetzt.
Ich benutze diesen PC für mein Online Banking. Ist dies nach einer Säuberung wieder gefahrlos möglich?
Vielen Dank für eure Hilfe vorab! und einen liebe Gruß

Marc


FRST LOG:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 24-11-2013
Ran by Eule (administrator) on Eule-PC on 25-11-2013 12:56:53
Running from C:\Users\Eule\Desktop
Microsoft Windows 7 Professional Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Nero AG) C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
() C:\Program Files\Tobit Radio.fx\Server\rfx-server.exe
(Fujitsu Technology Solutions) C:\Program Files\Fujitsu\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe
(Fujitsu Technology Solutions) C:\Program Files\Fujitsu\DeskViewBasic\DeskViewBasicService.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Inventec Corp.) C:\Program Files\Fujitsu\Wireless_Utility\Wireless Selector.exe
(Research In Motion Limited) C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Research In Motion Limited) C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe
(APN LLC.) C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe
(Microsoft Corporation) C:\Windows\System32\taskmgr.exe
(Microsoft Corporation) C:\Windows\System32\LogonUI.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1545512 2009-07-20] (Synaptics Incorporated)
HKLM\...\Run: [DeskViewBasic] - C:\Program Files\Fujitsu\DeskViewBasic\DeskViewBasic.exe [182784 2009-08-19] (Fujitsu Technology Solutions)
HKLM\...\Run: [Wireless_Selector] - C:\Program Files\Fujitsu\Wireless_Utility\Wireless Selector.exe [327680 2009-05-14] (Inventec Corp.)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7514656 2009-05-22] (Realtek Semiconductor)
HKLM\...\Run: [NvCplDaemon] - RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [RIMBBLaunchAgent.exe] - C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe [443408 2013-09-09] (Research In Motion Limited)
HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [948440 2013-10-23] (Microsoft Corporation)
HKLM\...\Run: [BCSSync] - C:\Program Files\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [Windows Mobile-based device management] - C:\Windows\WindowsMobile\wmdcBase.exe [648072 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [683576 2013-10-31] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [ApnTBMon] - C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1673680 2013-10-23] (APN)
HKCU\...\Run: [ISUSPM] - C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe [218032 2006-09-11] (Macrovision Corporation)
HKCU\...\Run: [GoogleDriveSync] - C:\Program Files\Google\Drive\googledrivesync.exe [20133824 2013-09-25] (Google)
HKCU\...\Run: [tuswrwpl] - regsvr32.exe /s "C:\ProgramData\tuswrwpl.dat"
BootExecute: autocheck autochk * sdnclean.exe

==================== Internet (Whitelisted) ====================

ProxyServer: :0
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://aartemis.com/?type=hp&ts=1385378153&from=cor&uid=HitachiXHTS545016B9A300_090904PB5B01QCC9SXXGX
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.aartemis.com/web/?type=ds&ts=1385378153&from=cor&uid=HitachiXHTS545016B9A300_090904PB5B01QCC9SXXGX&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://aartemis.com/?type=hp&ts=1385378153&from=cor&uid=HitachiXHTS545016B9A300_090904PB5B01QCC9SXXGX
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://aartemis.com/?type=hp&ts=1385378153&from=cor&uid=HitachiXHTS545016B9A300_090904PB5B01QCC9SXXGX
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.aartemis.com/web/?type=ds&ts=1385378153&from=cor&uid=HitachiXHTS545016B9A300_090904PB5B01QCC9SXXGX&q={searchTerms}
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.aartemis.com/web/?type=ds&ts=1385378153&from=cor&uid=HitachiXHTS545016B9A300_090904PB5B01QCC9SXXGX&q={searchTerms}
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.aartemis.com/web/?type=ds&ts=1385378153&from=cor&uid=HitachiXHTS545016B9A300_090904PB5B01QCC9SXXGX&q={searchTerms}
SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
BHO: AC-Pro - {0FB6A909-6086-458F-BD92-1F8EE10042A0} - C:\Program Files\AutocompletePro\AutocompletePro.dll (SimplyGen)
BHO: Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
Tcpip\Parameters: [DhcpNameServer] 10.4.59.1

FireFox:
========
FF ProfilePath: C:\Users\Eule\AppData\Roaming\Mozilla\Firefox\Profiles\zh7u3f8r.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @RIM.com/WebSLLauncher,version=1.0 - C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: AutocompletePro - Your handy search suggestions tool - C:\Users\Eule\AppData\Roaming\Mozilla\Firefox\Profiles\zh7u3f8r.default\Extensions\support@predictad.com
FF Extension: toolbar_AVIRA-V7 - C:\Users\Eule\AppData\Roaming\Mozilla\Firefox\Profiles\zh7u3f8r.default\Extensions\toolbar_AVIRA-V7@apn.ask.com.xpi

Chrome:
=======
CHR HomePage: hxxp://www.spiegel.de/
CHR DefaultSearchURL: (Google) - {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{googleriginalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR HKLM\...\Chrome\Extension: [aaaaacalgebmfelllfiaoknifldpngjh] - C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\CRX\ToolbarCR.crx
CHR HKLM\...\Chrome\Extension: [defdhglnppeioeflggkmglipcecffkhk] - C:\Program Files\AutocompletePro\chrome\autocompleteprochrome.crx

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440376 2013-10-31] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440376 2013-10-31] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe [1164360 2013-10-31] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2013-10-23] (APN LLC.)
R3 BlackBerry Device Manager; C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe [585728 2013-09-09] (Research In Motion Limited)
R2 DeskViewBasicService; C:\Program Files\Fujitsu\DeskViewBasic\DeskViewBasicService.exe [34816 2009-08-19] (Fujitsu Technology Solutions)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [22208 2013-10-23] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [280288 2013-10-23] (Microsoft Corporation)
R2 Radio.fx; C:\Program Files\Tobit Radio.fx\Server\rfx-server.exe [3673944 2011-11-18] ()
R2 TestHandler; C:\Program Files\Fujitsu\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe [341264 2009-02-19] (Fujitsu Technology Solutions)
S2 RoxLiveShare9; "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe" [x]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-10-31] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [137208 2013-10-31] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-31] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [67680 2013-10-31] (Avira Operations GmbH & Co. KG)
S3 BthAvrcp; C:\Windows\System32\DRIVERS\BthAvrcp.sys [22528 2009-08-13] (CSR, plc)
S3 DTVFW; C:\Windows\System32\DRIVERS\dtvfw.sys [22016 2005-05-12] (LITE-ON)
R3 FSCSLII; C:\Windows\System32\DRIVERS\FSCSLII.sys [16384 2009-05-18] (Fujitsu)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [214696 2013-09-27] (Microsoft Corporation)
R1 MpKslf5029df0; C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{696B7E90-DB80-43A7-A355-727E39677A06}\MpKslf5029df0.sys [40392 2013-11-22] (Microsoft Corporation)
S3 rimvndis; C:\Windows\System32\Drivers\rimvndis6.sys [14336 2013-08-15] (Research in Motion Limited)
S3 s0016bus; C:\Windows\System32\DRIVERS\s0016bus.sys [89256 2008-05-16] (MCCI Corporation)
S3 s0016mdfl; C:\Windows\System32\DRIVERS\s0016mdfl.sys [15016 2008-05-16] (MCCI Corporation)
S3 s0016mdm; C:\Windows\System32\DRIVERS\s0016mdm.sys [120744 2008-05-16] (MCCI Corporation)
S3 s0016mgmt; C:\Windows\System32\DRIVERS\s0016mgmt.sys [114216 2008-05-16] (MCCI Corporation)
S3 s0016nd5; C:\Windows\System32\DRIVERS\s0016nd5.sys [25512 2008-05-16] (MCCI Corporation)
S3 s0016obex; C:\Windows\System32\DRIVERS\s0016obex.sys [110632 2008-05-16] (MCCI Corporation)
S3 s0016unic; C:\Windows\System32\DRIVERS\s0016unic.sys [115752 2008-05-16] (MCCI Corporation)
S1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-10-31] (Avira GmbH)
S3 usbdtv; C:\Windows\System32\Drivers\usbdtv.sys [31232 2005-06-07] (LITE-ON)
S3 usbrndis6; C:\Windows\System32\DRIVERS\usb80236.sys [15872 2013-02-12] (Microsoft Corporation)
S3 pccsmcfd; system32\DRIVERS\pccsmcfd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-11-25 12:56 - 2013-11-25 12:57 - 00012627 _____ C:\Users\Eule\Desktop\FRST.txt
2013-11-25 12:56 - 2013-11-25 12:56 - 00000000 ____D C:\FRST
2013-11-25 12:55 - 2013-11-25 12:55 - 01091583 _____ (Farbar) C:\Users\Eule\Desktop\FRST.exe
2013-11-25 12:23 - 2013-11-25 12:23 - 00000000 ____D C:\Users\Eule\Documents\PC Speed Maximizer
2013-11-25 12:14 - 2013-11-25 12:14 - 00001145 _____ C:\Users\Eule\Desktop\Continue Zip Extractor Installation.lnk
2013-11-22 12:49 - 2013-11-22 12:49 - 00000000 ____D C:\Users\Eule\AppData\Roaming\Avira
2013-11-22 12:48 - 2013-11-22 12:48 - 00000000 ____D C:\ProgramData\AskPartnerNetwork
2013-11-22 12:48 - 2013-11-22 12:48 - 00000000 ____D C:\Program Files\AskPartnerNetwork
2013-11-22 12:48 - 2013-05-31 20:51 - 00489392 _____ (Ask Partner Network) C:\Users\Eule\Documents\APNSetup1.exe
2013-11-22 12:46 - 2013-11-22 12:46 - 00002018 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-11-22 12:46 - 2013-10-31 19:25 - 00137208 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-11-22 12:46 - 2013-10-31 19:25 - 00090400 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-11-22 12:46 - 2013-10-31 19:25 - 00067680 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-11-22 12:46 - 2013-10-31 19:25 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-11-22 12:46 - 2013-10-31 19:25 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
2013-11-22 12:45 - 2013-11-22 12:45 - 00000000 ____D C:\ProgramData\Avira
2013-11-22 12:45 - 2013-11-22 12:45 - 00000000 ____D C:\Program Files\Avira
2013-11-22 12:39 - 2013-11-22 12:44 - 126764512 _____ C:\Users\Eule\Desktop\avira_free_antivirus_de.exe
2013-11-22 12:14 - 2013-11-22 12:40 - 00000000 ____D C:\Users\Eule\AppData\Roaming\Nico Mak Computing
2013-11-22 12:13 - 2013-11-22 12:13 - 04892480 _____ (WinZip International LLC ) C:\Users\Eule\Desktop\wzmp_8.exe
2013-11-22 12:02 - 2013-11-22 12:02 - 02209056 _____ C:\Users\Eule\Downloads\avira-eu-cleaner_de.exe
2013-11-22 12:01 - 2013-11-22 12:01 - 00002033 _____ C:\Users\Eule\Desktop\Entfernen des Avira EU-Cleaners.lnk
2013-11-22 12:01 - 2013-11-22 12:01 - 00001977 _____ C:\Users\Eule\Desktop\Avira EU-Cleaner.lnk
2013-11-21 23:32 - 2013-11-21 23:32 - 00000000 ____D C:\Users\Eule\AppData\Roaming\Research In Motion
2013-11-21 23:30 - 2013-11-21 23:30 - 00002195 _____ C:\Users\Public\Desktop\BlackBerry Desktop Software.lnk
2013-11-20 14:14 - 2013-11-20 14:14 - 17142784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 11220992 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 04240384 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-20 14:14 - 2013-11-20 14:14 - 02166272 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 01926656 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-11-20 14:14 - 2013-11-20 14:14 - 01818112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 01156608 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 01051136 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00703488 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00645120 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-11-20 14:14 - 2013-11-20 14:14 - 00610304 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00553472 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00523776 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-11-20 14:14 - 2013-11-20 14:14 - 00244736 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00238288 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00233472 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00208896 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00208384 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00182272 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00151552 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00127488 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00083456 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-11-20 14:14 - 2013-11-20 14:14 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-11-20 14:12 - 2013-11-20 14:17 - 00009945 _____ C:\Windows\IE11_main.log
2013-11-20 13:02 - 2013-11-21 23:21 - 00258048 _____ C:\ProgramData\tuswrwpl.dat
2013-11-20 12:29 - 2013-11-25 12:31 - 00000000 ____D C:\Program Files\7-Zip
2013-11-18 11:26 - 2013-11-21 14:39 - 00000000 ____D C:\Windows\rescache
2013-11-14 10:51 - 2013-11-14 13:43 - 03865088 _____ C:\Users\Eule\Desktop\Präsentation LVR.ppt
2013-11-13 13:26 - 2013-11-13 13:26 - 00083456 _____ C:\Users\Eule\Documents\Zeitstrahl Pro 4.ppt
2013-11-13 12:36 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll
2013-11-13 12:36 - 2013-10-04 02:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2013-11-13 12:36 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll
2013-11-13 12:36 - 2013-09-25 03:01 - 00136640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-11-13 12:36 - 2013-09-25 03:01 - 00067520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2013-11-13 12:36 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-11-13 12:36 - 2013-09-25 02:57 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2013-11-13 12:36 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2013-11-13 12:36 - 2013-09-25 02:56 - 01038848 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-11-13 12:36 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2013-11-13 12:36 - 2013-09-25 01:49 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2013-11-13 12:36 - 2013-09-25 01:49 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2013-11-13 12:36 - 2013-07-04 13:16 - 00369848 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-11-13 12:35 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2013-11-13 12:35 - 2013-10-12 03:01 - 00679424 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2013-11-13 12:35 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2013-11-13 12:35 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-11-13 12:35 - 2013-10-03 02:58 - 00305152 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2013-11-13 12:10 - 2013-11-22 08:54 - 00009616 _____ C:\Windows\setupact.log
2013-11-13 12:10 - 2013-11-13 12:10 - 00000000 _____ C:\Windows\setuperr.log

==================== One Month Modified Files and Folders =======

2013-11-25 12:58 - 2011-07-21 13:43 - 00001096 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-25 12:57 - 2013-11-25 12:56 - 00012627 _____ C:\Users\Eule\Desktop\FRST.txt
2013-11-25 12:56 - 2013-11-25 12:56 - 00000000 ____D C:\FRST
2013-11-25 12:56 - 2009-11-07 01:18 - 01049534 _____ C:\Windows\WindowsUpdate.log
2013-11-25 12:55 - 2013-11-25 12:55 - 01091583 _____ (Farbar) C:\Users\Eule\Desktop\FRST.exe
2013-11-25 12:47 - 2009-07-14 05:34 - 00009712 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-25 12:47 - 2009-07-14 05:34 - 00009712 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-25 12:31 - 2013-11-20 12:29 - 00000000 ____D C:\Program Files\7-Zip
2013-11-25 12:23 - 2013-11-25 12:23 - 00000000 ____D C:\Users\Eule\Documents\PC Speed Maximizer
2013-11-25 12:16 - 2009-11-06 16:36 - 00001619 _____ C:\Users\Eule\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-11-25 12:14 - 2013-11-25 12:14 - 00001145 _____ C:\Users\Eule\Desktop\Continue Zip Extractor Installation.lnk
2013-11-25 12:00 - 2012-04-16 12:02 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-25 11:08 - 2011-07-21 13:43 - 00001092 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-25 11:00 - 2013-05-27 07:45 - 00000000 ____D C:\Program Files\File Type Assistant
2013-11-22 12:49 - 2013-11-22 12:49 - 00000000 ____D C:\Users\Eule\AppData\Roaming\Avira
2013-11-22 12:48 - 2013-11-22 12:48 - 00000000 ____D C:\ProgramData\AskPartnerNetwork
2013-11-22 12:48 - 2013-11-22 12:48 - 00000000 ____D C:\Program Files\AskPartnerNetwork
2013-11-22 12:46 - 2013-11-22 12:46 - 00002018 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-11-22 12:45 - 2013-11-22 12:45 - 00000000 ____D C:\ProgramData\Avira
2013-11-22 12:45 - 2013-11-22 12:45 - 00000000 ____D C:\Program Files\Avira
2013-11-22 12:44 - 2013-11-22 12:39 - 126764512 _____ C:\Users\Eule\Desktop\avira_free_antivirus_de.exe
2013-11-22 12:40 - 2013-11-22 12:14 - 00000000 ____D C:\Users\Eule\AppData\Roaming\Nico Mak Computing
2013-11-22 12:13 - 2013-11-22 12:13 - 04892480 _____ (WinZip International LLC ) C:\Users\Eule\Desktop\wzmp_8.exe
2013-11-22 12:02 - 2013-11-22 12:02 - 02209056 _____ C:\Users\Eule\Downloads\avira-eu-cleaner_de.exe
2013-11-22 12:01 - 2013-11-22 12:01 - 00002033 _____ C:\Users\Eule\Desktop\Entfernen des Avira EU-Cleaners.lnk
2013-11-22 12:01 - 2013-11-22 12:01 - 00001977 _____ C:\Users\Eule\Desktop\Avira EU-Cleaner.lnk
2013-11-22 08:58 - 2009-08-21 07:35 - 01507340 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-22 08:55 - 2013-04-12 18:12 - 00000000 ___RD C:\Users\Eule\Google Drive
2013-11-22 08:54 - 2013-11-13 12:10 - 00009616 _____ C:\Windows\setupact.log
2013-11-22 08:54 - 2009-07-14 05:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-21 23:43 - 2011-06-10 07:55 - 00008624 _____ C:\Users\Eule\AppData\Roaming\Rim.DesktopHelper.Exception.log
2013-11-21 23:43 - 2010-08-18 11:35 - 00054772 _____ C:\Users\Eule\AppData\Roaming\Rim.Desktop.Exception.log
2013-11-21 23:32 - 2013-11-21 23:32 - 00000000 ____D C:\Users\Eule\AppData\Roaming\Research In Motion
2013-11-21 23:32 - 2010-12-22 12:19 - 00000000 ____D C:\Users\Eule\AppData\Local\Research In Motion
2013-11-21 23:31 - 2010-08-18 11:22 - 00021897 _____ C:\Users\Eule\AppData\Roaming\Rim.Desktop.HttpServerSetup.log
2013-11-21 23:30 - 2013-11-21 23:30 - 00002195 _____ C:\Users\Public\Desktop\BlackBerry Desktop Software.lnk
2013-11-21 23:30 - 2012-08-02 08:36 - 00000000 ____D C:\ProgramData\Research In Motion
2013-11-21 23:30 - 2012-02-15 15:42 - 00000000 ____D C:\Program Files\Common Files\XCPCSync.OEM
2013-11-21 23:29 - 2010-08-15 13:48 - 00000000 ____D C:\Program Files\Research In Motion
2013-11-21 23:29 - 2010-08-15 13:48 - 00000000 ____D C:\Program Files\Common Files\Research In Motion
2013-11-21 23:21 - 2013-11-20 13:02 - 00258048 _____ C:\ProgramData\tuswrwpl.dat
2013-11-21 23:15 - 2012-02-15 15:46 - 00014476 _____ C:\Users\Eule\AppData\Roaming\Rim.Transcoder.Exception.log
2013-11-21 22:34 - 2011-09-11 12:56 - 00000000 ____D C:\Users\Eule\AppData\Local\Downloaded Installations
2013-11-21 14:39 - 2013-11-18 11:26 - 00000000 ____D C:\Windows\rescache
2013-11-20 14:19 - 2013-10-11 12:54 - 00001712 _____ C:\Windows\PFRO.log
2013-11-20 14:19 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\system32\de-DE
2013-11-20 14:18 - 2011-02-08 19:58 - 00001912 _____ C:\Windows\epplauncher.mif
2013-11-20 14:17 - 2013-11-20 14:12 - 00009945 _____ C:\Windows\IE11_main.log
2013-11-20 14:17 - 2011-02-08 19:56 - 00000000 ____D C:\Program Files\Microsoft Security Client
2013-11-20 14:14 - 2013-11-20 14:14 - 17142784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 11220992 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 04240384 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-20 14:14 - 2013-11-20 14:14 - 02166272 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 01926656 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-11-20 14:14 - 2013-11-20 14:14 - 01818112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 01156608 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 01051136 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00703488 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00645120 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-11-20 14:14 - 2013-11-20 14:14 - 00610304 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00553472 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00523776 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-11-20 14:14 - 2013-11-20 14:14 - 00244736 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00238288 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00233472 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00208896 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00208384 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00182272 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00151552 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00127488 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00083456 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-11-20 14:14 - 2013-11-20 14:14 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-11-20 11:56 - 2013-04-29 12:49 - 00000000 ____D C:\Users\Eule\Documents\DDPB
2013-11-19 11:21 - 2009-11-06 17:07 - 00230048 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2013-11-14 13:43 - 2013-11-14 10:51 - 03865088 _____ C:\Users\Eule\Desktop\Präsentation LVR.ppt
2013-11-14 11:20 - 2012-02-27 11:22 - 00023552 _____ C:\Users\Eule\Documents\Codes für alles.xls
2013-11-14 09:15 - 2012-04-16 12:02 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-11-14 09:15 - 2011-06-28 07:00 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-11-14 09:15 - 2009-11-06 16:35 - 00000000 ____D C:\Users\Eule\AppData\Local\Adobe
2013-11-14 09:10 - 2009-08-07 14:43 - 00000000 ____D C:\Windows\Panther
2013-11-13 13:47 - 2009-08-21 07:31 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-11-13 13:45 - 2010-11-16 08:53 - 00000000 ____D C:\Windows\WindowsMobile
2013-11-13 13:41 - 2013-07-19 08:43 - 00000000 ____D C:\Windows\system32\MRT
2013-11-13 13:38 - 2009-11-26 09:21 - 80340640 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-11-13 13:26 - 2013-11-13 13:26 - 00083456 _____ C:\Users\Eule\Documents\Zeitstrahl Pro 4.ppt
2013-11-13 12:38 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-11-13 12:10 - 2013-11-13 12:10 - 00000000 _____ C:\Windows\setuperr.log
2013-11-12 16:08 - 2009-07-14 03:04 - 00000499 _____ C:\Windows\win.ini
2013-11-12 11:14 - 2011-03-09 10:20 - 00000000 ____D C:\Users\Eule\Desktop\Privat
2013-11-05 08:49 - 2013-04-15 09:17 - 00000000 ____D C:\Users\Eule\Desktop\BUT
2013-10-31 19:25 - 2013-11-22 12:46 - 00137208 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-10-31 19:25 - 2013-11-22 12:46 - 00090400 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-10-31 19:25 - 2013-11-22 12:46 - 00067680 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-10-31 19:25 - 2013-11-22 12:46 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-10-31 19:25 - 2013-11-22 12:46 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
2013-10-30 11:07 - 2013-04-08 10:59 - 00000000 _____ C:\Users\Eule\Documents\RIMPTG

Files to move or delete:
====================
C:\ProgramData\tuswrwpl.dat


Some content of TEMP:
====================
C:\Users\Eule\AppData\Local\Temp\2SKKKKKKK.exe
C:\Users\Eule\AppData\Local\Temp\89.4239114108929_Update.exe
C:\Users\Eule\AppData\Local\Temp\avgnt.exe
C:\Users\Eule\AppData\Local\Temp\ICReinstall_ZipExtractorSetup.exe
C:\Users\Eule\AppData\Local\Temp\pcspeedmaxsetup.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-11-20 10:54

==================== End Of Log ============================


LOG von FRST Addition:
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 24-11-2013
Ran by Eule at 2013-11-25 12:58:53
Running from C:\Users\Eule\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Microsoft Security Essentials (Enabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F}
AV: Avira Desktop (Enabled - Out of date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Out of date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Microsoft Security Essentials (Enabled - Up to date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}

==================== Installed Programs ======================

Activation Assistant for the 2007 Microsoft Office suites
Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0)
Adobe Flash Player 11 ActiveX (Version: 11.9.900.152)
Adobe Flash Player 11 Plugin (Version: 11.9.900.117)
Adobe Reader XI (11.0.05) - Deutsch (Version: 11.0.05)
Advertising Center (Version: 0.0.0.1)
AutocompletePro
Avira Free Antivirus (Version: 14.0.1.719)
Avira SearchFree Toolbar (Version: 12.6.0.1900)
BlackBerry Desktop Software 7.1 (Version: 7.1.0.41)
BlackBerry Device Software Updater (Version: 8.0.0.41)
CANON iMAGE GATEWAY Task for ZoomBrowser EX (Version: 1.5.0.3)
Canon Internet Library for ZoomBrowser EX (Version: 1.6.1.6)
Canon MP Navigator EX 2.0
Canon RAW Image Task for ZoomBrowser EX (Version: 3.2.0.10)
Canon Utilities CameraWindow (Version: 7.1.0.2)
Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX (Version: 6.4.2.16)
Canon Utilities Digital Photo Professional 3.3 (Version: 3.3.1.1)
Canon Utilities EOS Utility (Version: 2.3.1.3)
Canon Utilities MyCamera (Version: 6.4.0.5)
Canon Utilities Original Data Security Tools (Version: 1.3.0.0)
Canon Utilities PhotoStitch (Version: 3.1.21.45)
Canon Utilities Picture Style Editor (Version: 1.2.0.1)
Canon Utilities RemoteCapture Task for ZoomBrowser EX (Version: 1.7.1.9)
Canon Utilities WFT-E1/E2/E3 Utility (Version: 3.2.1.1)
Canon Utilities ZoomBrowser EX (Version: 6.1.1.21)
Canon ZoomBrowser EX Memory Card Utility (Version: 1.1.0.8)
CCleaner (Version: 4.02)
Compatibility Pack for the 2007 Office system (Version: 12.0.6612.1000)
DDPB (Version: 1.0.9)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition
EOS USB WIA Driver (Version: 6.0.1.5)
File Type Assistant (Version: 2013.4.8.0)
Google Calendar Sync
Google Drive (Version: 1.12.5329.1887)
Google Update Helper (Version: 1.3.21.165)
ImagXpress (Version: 7.0.74.0)
Java(TM) 6 Update 25 (Version: 6.0.250)
MATHEARBEIT
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Antimalware Service DE-DE Language Pack (Version: 3.0.8402.2)
Microsoft Application Error Reporting (Version: 12.0.6012.5000)
Microsoft Office 2003 Primary Interop Assemblies (Version: 11.0.6553.0)
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003)
Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1)
Microsoft Office Outlook 2010 (Version: 14.0.7015.1000)
Microsoft Office Outlook Connector (Version: 14.0.6123.5001)
Microsoft Office Outlook MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Professional Edition 2003 (Version: 11.0.8173.0)
Microsoft Office Proof (English) 2010 (Version: 14.0.7015.1000)
Microsoft Office Proof (French) 2010 (Version: 14.0.7015.1000)
Microsoft Office Proof (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Proof (Italian) 2010 (Version: 14.0.7015.1000)
Microsoft Office Proofing (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Shared MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Outlook 2010 (Version: 14.0.7015.1000)
Microsoft Security Client (Version: 4.4.0304.0)
Microsoft Security Client DE-DE Language Pack (Version: 2.1.1116.0)
Microsoft Security Essentials (Version: 4.4.304.0)
Microsoft Silverlight (Version: 5.1.20913.0)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft-Maus- und Tastatur-Center (Version: 2.2.173.0)
MSVC80_x86_v2 (Version: 1.0.3.0)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
Nero 9 Essentials
Nero BurnRights (Version: 3.4.10.100)
Nero BurnRights Help (Version: 3.4.4.100)
Nero ControlCenter (Version: 9.0.0.1)
Nero CoverDesigner (Version: 4.4.9.203)
Nero CoverDesigner Help (Version: 4.4.6.100)
Nero DiscSpeed (Version: 5.4.7.202)
Nero DiscSpeed Help (Version: 5.4.4.100)
Nero DriveSpeed (Version: 4.4.10.100)
Nero DriveSpeed Help (Version: 4.4.4.100)
Nero InfoTool (Version: 6.4.7.204)
Nero InfoTool Help (Version: 6.4.4.100)
Nero Installer (Version: 4.4.8.1)
Nero StartSmart (Version: 9.4.11.207)
Nero StartSmart Help (Version: 9.4.1.100)
Nero StartSmart OEM (Version: 9.4.10.100)
neroxml (Version: 1.0.0)
NVIDIA Drivers (Version: 1.4)
Print To Go 2.0 (Version: 2.0.110.0)
PVSonyDll (Version: 1.00.0001)
Realtek High Definition Audio Driver (Version: 6.0.1.5859)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition
Synaptics Pointing Device Driver (Version: 13.2.6.1)
SystemDiagnostics (Version: 2.04.0006)
TuneUp Utilities Language Pack (de-DE) (Version: 12.0.2120.5)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (Version: 3)
Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition
Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition
Update for Microsoft Word 2010 (KB2827323) 32-Bit Edition
WDR RadioRecorder
Wireless_Utility (Version: 2.04.0716)
Wireless_Utility (Version: 2.05.1005)

==================== Restore Points =========================


==================== Hosts content: ==========================

2009-07-14 03:04 - 2009-06-10 22:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {06F17F61-E4C2-4A8C-A6FA-C59A86537961} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-11-14] (Adobe Systems Incorporated)
Task: {0C49DCC8-7754-44B5-B6A8-01FC8B64E99E} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2010-11-20] (Microsoft Corporation)
Task: {11965860-D81D-420D-9628-4B66EB978307} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-11] (Microsoft Corporation)
Task: {12104A29-5A58-49D6-A71A-284E741304D0} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-05-24] (Piriform Ltd)
Task: {1E236167-7D16-4050-B19F-12017F591295} - System32\Tasks\DSite => C:\Users\Eule\AppData\Roaming\DSite\UPDATE~1\UPDATE~1.EXE
Task: {29AA1A91-D99B-4DB8-A052-BE33E19D4C15} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\MouseKeyboardCenter.exe [2013-05-13] (Microsoft)
Task: {2B8132BC-1162-468D-98C8-34E9B1CACA05} - System32\Tasks\ProgramUpdateCheck => C:\Program Files\File Type Assistant\tsassist.exe [2013-04-08] (Trusted Software ApS)
Task: {2DA0CD1A-4379-4431-BCC0-B1C61A883F07} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {3C6D24A5-3E5F-4823-98A6-1542C7AE438A} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2013-05-13] (Microsoft Corporation)
Task: {43DC421F-F021-453B-9EB0-1CD67BEA3568} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2013-05-13] (Microsoft Corporation)
Task: {43E054FD-A8C0-4DBC-BAA6-652BCA52C633} - System32\Tasks\DealPly => C:\Users\Eule\AppData\Roaming\DealPly\UPDATE~1\UPDATE~1.EXE
Task: {6BFBB788-A6F6-4AAB-89C0-07B145A8C649} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2011-07-21] (Google Inc.)
Task: {6C1791F2-ADA9-45E4-8BED-E8BE8752B4E6} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2011-07-21] (Google Inc.)
Task: {78CA2345-BB58-4C2A-8452-9894D455E09C} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2013-05-13] (Microsoft Corporation)
Task: {83D077C3-C880-4DD6-BBAA-7A54DA7C3DC9} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2013-05-13] (Microsoft Corporation)
Task: {C1C231DE-994F-4A4C-B830-3C8A41DCA8F8} - System32\Tasks\0 => Iexplore.exe
Task: {C1DF6582-979F-48B4-9C5A-BAF7B7343E8E} - System32\Tasks\4675 => C:\Users\Eule\AppData\Local\Temp\launchie.vbsC:\Users\Eule\AppData\Local\Temp\launchie.vbs //B
Task: {D57E33A8-3888-4899-8F37-D4B1D09B1381} - System32\Tasks\ProgramRefresh-ATFST => C:\Program Files\File Type Assistant\TSASetup.exe [2013-04-08] ( )
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============


==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (11/25/2013 00:28:16 PM) (Source: Application Hang) (User: )
Description: Programm ZipExtractorSetup.exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: df4

Startzeit: 01cee9cf8a323f70

Endzeit: 47

Anwendungspfad: C:\Users\Eule\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F3EAZ9T5\ZipExtractorSetup.exe

Berichts-ID:

Error: (11/25/2013 00:15:38 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Das erforderliche "name"-Attribut fehlt im assemblyIdentity-Element.

Error: (11/25/2013 10:56:46 AM) (Source: Windows Backup) (User: )
Description: Die Sicherung wurde aufgrund eines Fehlers beim Schreiben am Sicherungsspeicherort "F:\" nicht abgeschlossen. Fehler: "Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)"

Error: (11/25/2013 10:53:58 AM) (Source: VSS) (User: )
Description: Volumeschattenkopie-Dienstfehler: Unerwarteter Fehler "DeviceIoControl(\\?\Volume{889d8ee5-cb32-11de-b03d-806e6f6e6963} - 00000120,0x0053c008,00D41FB8,0,00D42FC0,4096,[0])". hr = 0x80070079, Das Zeitlimit für die Semaphore wurde erreicht.
.


Vorgang:
EndPrepareSnapshots wird verarbeitet

Kontext:
Ausführungskontext: System Provider

Error: (11/22/2013 10:58:01 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1".
Die abhängige Assemblierung "Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (11/21/2013 10:37:17 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: BbDevMgr.exe, Version: 4.2.0.33, Zeitstempel: 0x51cc5527
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea91c
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0003224d
ID des fehlerhaften Prozesses: 0xed4
Startzeit der fehlerhaften Anwendung: 0xBbDevMgr.exe0
Pfad der fehlerhaften Anwendung: BbDevMgr.exe1
Pfad des fehlerhaften Moduls: BbDevMgr.exe2
Berichtskennung: BbDevMgr.exe3

Error: (11/21/2013 09:44:06 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: RIMDeviceManager.exe, Version: 7.0.0.59, Zeitstempel: 0x520beea8
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00ba34f0
ID des fehlerhaften Prozesses: 0x14c4
Startzeit der fehlerhaften Anwendung: 0xRIMDeviceManager.exe0
Pfad der fehlerhaften Anwendung: RIMDeviceManager.exe1
Pfad des fehlerhaften Moduls: RIMDeviceManager.exe2
Berichtskennung: RIMDeviceManager.exe3

Error: (11/21/2013 01:39:26 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1".
Die abhängige Assemblierung "Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (11/21/2013 00:12:53 PM) (Source: Application Hang) (User: )
Description: Programm iexplore.exe, Version 11.0.9600.16428 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 7dc

Startzeit: 01cee6aa32337140

Endzeit: 0

Anwendungspfad: C:\Program Files\Internet Explorer\iexplore.exe

Berichts-ID:

Error: (11/20/2013 10:55:34 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1".
Die abhängige Assemblierung "Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".


System errors:
=============
Error: (11/25/2013 11:17:33 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows-Fehlerberichterstattungsdienst erreicht.

Error: (11/25/2013 11:13:15 AM) (Source: Microsoft Antimalware) (User: )
Description: Beim Aktualisieren der Signaturen wurde von %NT-AUTORITÄT60 ein Fehler festgestellt.

Neue Signaturversion:

Vorherige Signaturversion: 1.163.340.0

Aktualisierungsquelle: %NT-AUTORITÄT59

Aktualisierungsphase: 4.4.0304.00

Quellpfad: 4.4.0304.01

Signaturtyp: %NT-AUTORITÄT602

Aktualisierungstyp: %NT-AUTORITÄT604

Benutzer: NT-AUTORITÄT\SYSTEM

Aktuelle Modulversion: %NT-AUTORITÄT605

Vorherige Modulversion: %NT-AUTORITÄT606

Fehlercode: %NT-AUTORITÄT607

Fehlerbeschreibung: %NT-AUTORITÄT608

Error: (11/25/2013 10:53:50 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst AntiVirSchedulerService erreicht.

Error: (11/25/2013 10:53:47 AM) (Source: volsnap) (User: )
Description: Die Schattenkopie des erstellten Volumes "C:" konnte nicht installiert werden.

Error: (11/21/2013 11:17:58 PM) (Source: Service Control Manager) (User: )
Description: Dienst "BlackBerry Device Manager" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (11/21/2013 09:34:27 PM) (Source: bowser) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "PLAYBOOK-5D2B",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{4F8CABAA-F522-4CE4-97D3-14CC-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.

Error: (11/21/2013 00:13:09 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.

Error: (11/20/2013 02:16:52 PM) (Source: bowser) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "PLAYBOOK-5D2B",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{4F8CABAA-F522-4CE4-97D3-14CC-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.

Error: (11/20/2013 01:39:33 PM) (Source: bowser) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "PLAYBOOK-5D2B",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{4F8CABAA-F522-4CE4-97D3-14CC-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.

Error: (11/20/2013 11:59:30 AM) (Source: bowser) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "PLAYBOOK-5D2B",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{4F8CABAA-F522-4CE4-97D3-14CC-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.


Microsoft Office Sessions:
=========================
Error: (11/25/2013 00:28:16 PM) (Source: Application Hang)(User: )
Description: ZipExtractorSetup.exe0.0.0.0df401cee9cf8a323f7047C:\Users\Eule\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F3EAZ9T5\ZipExtractorSetup.exe

Error: (11/25/2013 00:15:38 PM) (Source: SideBySide)(User: )
Description: assemblyIdentitynameC:\Users\Eule\AppData\Local\Temp\89.4239114108929_Update.exeC:\Users\Eule\AppData\Local\Temp\89.4239114108929_Update.exe3

Error: (11/25/2013 10:56:46 AM) (Source: Windows Backup)(User: )
Description: F:\Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)

Error: (11/25/2013 10:53:58 AM) (Source: VSS)(User: )
Description: DeviceIoControl(\\?\Volume{889d8ee5-cb32-11de-b03d-806e6f6e6963} - 00000120,0x0053c008,00D41FB8,0,00D42FC0,4096,[0])0x80070079, Das Zeitlimit für die Semaphore wurde erreicht.


Vorgang:
EndPrepareSnapshots wird verarbeitet

Kontext:
Ausführungskontext: System Provider

Error: (11/22/2013 10:58:01 AM) (Source: SideBySide)(User: )
Description: Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"C:\Program Files\Research In Motion\BlackBerry Desktop\MailServerMAPIProxy64.exe

Error: (11/21/2013 10:37:17 PM) (Source: Application Error)(User: )
Description: BbDevMgr.exe4.2.0.3351cc5527ntdll.dll6.1.7601.18247521ea91cc00000050003224ded401cee6fb53c646b0C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exeC:\Windows\SYSTEM32\ntdll.dll1778e170-52f5-11e3-b93c-00158352d18e

Error: (11/21/2013 09:44:06 PM) (Source: Application Error)(User: )
Description: RIMDeviceManager.exe7.0.0.59520beea8unknown0.0.0.000000000c000000500ba34f014c401cee6f853163fc0C:\Program Files\Common Files\Research In Motion\RIMDeviceManager\RIMDeviceManager.exeunknowna99cef40-52ed-11e3-8408-001e330efe24

Error: (11/21/2013 01:39:26 PM) (Source: SideBySide)(User: )
Description: Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"C:\Program Files\Research In Motion\BlackBerry Desktop\MailServerMAPIProxy64.exe

Error: (11/21/2013 00:12:53 PM) (Source: Application Hang)(User: )
Description: iexplore.exe11.0.9600.164287dc01cee6aa323371400C:\Program Files\Internet Explorer\iexplore.exe

Error: (11/20/2013 10:55:34 AM) (Source: SideBySide)(User: )
Description: Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"C:\Program Files\Research In Motion\BlackBerry Desktop\MailServerMAPIProxy64.exe


==================== Memory info ===========================

Percentage of memory in use: 63%
Total physical RAM: 1534.42 MB
Available physical RAM: 553.29 MB
Total Pagefile: 3068.84 MB
Available Pagefile: 1570.09 MB
Total Virtual: 2047.88 MB
Available Virtual: 1890.91 MB

==================== Drives ================================

Drive c: (System) (Fixed) (Total:50 GB) (Free:15.06 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Data) (Fixed) (Total:97.04 GB) (Free:29.99 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 149 GB) (Disk ID: D22F9EB7)
Partition 1: (Active) - (Size=2 GB) - (Type=27)
Partition 2: (Not Active) - (Size=50 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=97 GB) - (Type=07 NTFS)

==================== End Of Log ============================



LOG von Gmer:
MER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-11-25 14:08:22
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 Hitachi_HTS545016B9A300 rev.PBBOC64G 149,05GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Eule\AppData\Local\Temp\pwtoqpow.sys


---- System - GMER 2.1 ----

SSDT 89137A56 ZwCreateSection
SSDT 89137A60 ZwRequestWaitReplyPort
SSDT 89137A5B ZwSetContextThread
SSDT 89137A65 ZwSetSecurityObject
SSDT 89137A6A ZwSystemDebugControl
SSDT 891379F7 ZwTerminateProcess

---- Kernel code sections - GMER 2.1 ----

.text ntkrnlpa.exe!ZwRollbackEnlistment + 142D 83244A15 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 8327E212 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text ntkrnlpa.exe!KeRemoveQueueEx + 11F7 8328558C 4 Bytes [56, 7A, 13, 89]
.text ntkrnlpa.exe!KeRemoveQueueEx + 1553 832858E8 4 Bytes [60, 7A, 13, 89]
.text ntkrnlpa.exe!KeRemoveQueueEx + 1597 8328592C 4 Bytes [5B, 7A, 13, 89]
.text ntkrnlpa.exe!KeRemoveQueueEx + 1613 832859A8 4 Bytes [65, 7A, 13, 89]
.text ntkrnlpa.exe!KeRemoveQueueEx + 1667 832859FC 4 Bytes [6A, 7A, 13, 89]
.text ...

---- User code sections - GMER 2.1 ----

.text C:\Windows\system32\taskeng.exe[448] kernel32.dll!CreateProcessW 779D204D 5 Bytes JMP 01BD747A
.text C:\Windows\system32\taskeng.exe[448] kernel32.dll!CreateProcessA 779D2082 5 Bytes JMP 01BD74CF
.text C:\Windows\system32\taskeng.exe[448] ADVAPI32.dll!CreateProcessAsUserW 7766C532 5 Bytes JMP 01BD7524
.text C:\Windows\system32\taskeng.exe[448] ADVAPI32.dll!CreateProcessAsUserA 776A2642 5 Bytes JMP 01BD757C
.text C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[1204] kernel32.dll!CreateProcessW 779D204D 5 Bytes JMP 020E747A
.text C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[1204] kernel32.dll!CreateProcessA 779D2082 5 Bytes JMP 020E74CF
.text C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[1204] ADVAPI32.dll!CreateProcessAsUserW 7766C532 5 Bytes JMP 020E7524
.text C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[1204] ADVAPI32.dll!CreateProcessAsUserA 776A2642 5 Bytes JMP 020E757C
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[1332] kernel32.dll!CreateProcessW 779D204D 5 Bytes JMP 01F3747A
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[1332] kernel32.dll!CreateProcessA 779D2082 5 Bytes JMP 01F374CF
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[1332] ADVAPI32.dll!CreateProcessAsUserW 7766C532 5 Bytes JMP 01F37524
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[1332] ADVAPI32.dll!CreateProcessAsUserA 776A2642 5 Bytes JMP 01F3757C
.text C:\Windows\system32\Dwm.exe[1692] kernel32.dll!CreateProcessW 779D204D 5 Bytes JMP 01D1747A
.text C:\Windows\system32\Dwm.exe[1692] kernel32.dll!CreateProcessA 779D2082 5 Bytes JMP 01D174CF
.text C:\Windows\system32\Dwm.exe[1692] ADVAPI32.dll!CreateProcessAsUserW 7766C532 5 Bytes JMP 01D17524
.text C:\Windows\system32\Dwm.exe[1692] ADVAPI32.dll!CreateProcessAsUserA 776A2642 5 Bytes JMP 01D1757C
.text C:\Windows\Explorer.EXE[1724] kernel32.dll!CreateProcessW 779D204D 5 Bytes JMP 080D747A
.text C:\Windows\Explorer.EXE[1724] kernel32.dll!CreateProcessA 779D2082 5 Bytes JMP 080D74CF
.text C:\Windows\Explorer.EXE[1724] ADVAPI32.dll!CreateProcessAsUserW 7766C532 5 Bytes JMP 080D7524
.text C:\Windows\Explorer.EXE[1724] ADVAPI32.dll!CreateProcessAsUserA 776A2642 5 Bytes JMP 080D757C
.text C:\Windows\system32\taskhost.exe[1772] kernel32.dll!CreateProcessW 779D204D 5 Bytes JMP 02D6747A
.text C:\Windows\system32\taskhost.exe[1772] kernel32.dll!CreateProcessA 779D2082 5 Bytes JMP 02D674CF
.text C:\Windows\system32\taskhost.exe[1772] ADVAPI32.dll!CreateProcessAsUserW 7766C532 5 Bytes JMP 02D67524
.text C:\Windows\system32\taskhost.exe[1772] ADVAPI32.dll!CreateProcessAsUserA 776A2642 5 Bytes JMP 02D6757C
.text C:\Program Files\Tobit Radio.fx\Server\rfx-server.exe[1856] kernel32.dll!SetUnhandledExceptionFilter 77A1F4EB 5 Bytes JMP 00641870 C:\Program Files\Tobit Radio.fx\Server\rfx-server.exe
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2468] kernel32.dll!CreateProcessW 779D204D 5 Bytes JMP 016E747A
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2468] kernel32.dll!CreateProcessA 779D2082 5 Bytes JMP 016E74CF
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2468] ADVAPI32.dll!CreateProcessAsUserW 7766C532 5 Bytes JMP 016E7524
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2468] ADVAPI32.dll!CreateProcessAsUserA 776A2642 5 Bytes JMP 016E757C
.text C:\Program Files\Fujitsu\Wireless_Utility\Wireless Selector.exe[2604] kernel32.dll!CreateProcessW 779D204D 5 Bytes JMP 0179747A
.text C:\Program Files\Fujitsu\Wireless_Utility\Wireless Selector.exe[2604] kernel32.dll!CreateProcessA 779D2082 5 Bytes JMP 017974CF
.text C:\Program Files\Fujitsu\Wireless_Utility\Wireless Selector.exe[2604] ADVAPI32.dll!CreateProcessAsUserW 7766C532 5 Bytes JMP 01797524
.text C:\Program Files\Fujitsu\Wireless_Utility\Wireless Selector.exe[2604] ADVAPI32.dll!CreateProcessAsUserA 776A2642 5 Bytes JMP 0179757C
.text C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe[2664] kernel32.dll!CreateProcessW 779D204D 5 Bytes JMP 0224747A
.text C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe[2664] kernel32.dll!CreateProcessA 779D2082 5 Bytes JMP 022474CF
.text C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe[2664] ADVAPI32.dll!CreateProcessAsUserW 7766C532 5 Bytes JMP 02247524
.text C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe[2664] ADVAPI32.dll!CreateProcessAsUserA 776A2642 5 Bytes JMP 0224757C
.text C:\Program Files\Microsoft Security Client\msseces.exe[2832] kernel32.dll!CreateProcessW 779D204D 5 Bytes JMP 028B747A
.text C:\Program Files\Microsoft Security Client\msseces.exe[2832] kernel32.dll!CreateProcessA 779D2082 5 Bytes JMP 028B74CF
.text C:\Program Files\Microsoft Security Client\msseces.exe[2832] ADVAPI32.dll!CreateProcessAsUserW 7766C532 5 Bytes JMP 028B7524
.text C:\Program Files\Microsoft Security Client\msseces.exe[2832] ADVAPI32.dll!CreateProcessAsUserA 776A2642 5 Bytes JMP 028B757C
.text C:\Program Files\Internet Explorer\iexplore.exe[2900] kernel32.dll!CreateProcessW 779D204D 5 Bytes JMP 00A0747A
.text C:\Program Files\Internet Explorer\iexplore.exe[2900] kernel32.dll!CreateProcessA 779D2082 5 Bytes JMP 00A074CF
.text C:\Program Files\Internet Explorer\iexplore.exe[2900] advapi32.DLL!CreateProcessAsUserW 7766C532 5 Bytes JMP 00A07524
.text C:\Program Files\Internet Explorer\iexplore.exe[2900] advapi32.DLL!CreateProcessAsUserA 776A2642 5 Bytes JMP 00A0757C
.text C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!InternetReadFileExA 77792055 5 Bytes JMP 00A06B62
.text C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!InternetWriteFile 777C46D9 5 Bytes JMP 00A03D24
.text C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!HttpEndRequestA 777C4B75 5 Bytes JMP 00A04272
.text C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!HttpSendRequestExW 777C5E07 5 Bytes JMP 00A06F17
.text C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!InternetQueryOptionA 777DDC3E 5 Bytes JMP 00A04560
.text C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!InternetSetOptionA 777DF69A 5 Bytes JMP 00A0463E
.text C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!InternetSetOptionW 777DFA34 5 Bytes JMP 00A0466D
.text C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!InternetQueryOptionW 777E03CD 5 Bytes JMP 00A0458F
.text C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!HttpOpenRequestW 777E2957 5 Bytes JMP 00A0442C
.text C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!InternetCloseHandle 777E5B7F 5 Bytes JMP 00A06886
.text C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!HttpQueryInfoA 777E72A0 5 Bytes JMP 00A03BE4
.text C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!InternetConnectW 777E8F57 5 Bytes JMP 00A06941
.text C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!InternetReadFile 777F4390 5 Bytes JMP 00A06B15
.text C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!InternetQueryDataAvailable 777F8461 5 Bytes JMP 00A06988
.text C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!HttpSendRequestW 777F8DD0 5 Bytes JMP 00A06DF1
.text C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!HttpSendRequestA 7780F6FA 5 Bytes JMP 00A06D7F
.text C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!InternetConnectA 7785D336 5 Bytes JMP 00A068FA
.text C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!HttpEndRequestW 7787F5B8 5 Bytes JMP 00A0429F
.text C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!HttpSendRequestExA 7787F671 5 Bytes JMP 00A06E63
.text C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!HttpOpenRequestA 7787FA9D 5 Bytes JMP 00A043CA

---- Devices - GMER 2.1 ----

AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys

---- Registry - GMER 2.1 ----

Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager@PendingFileRenameOperations ?????????????????????????????7??????????????????????????????????????????CD/DVD File System Reader???HidUsb?ll???????????? ??????????????????Tcpip6??NNEL?Tcpip6??????????????-?????????????? #??????????????? ???????????????????r?1????????????????????? ?????????????????????1????????????????????HID\VID_04F3&PID_01A4&REV_0100&MI_01&Col01?HID\VID_04F3&PID_01A4&MI_01&Col01?HID_DEVICE_SYSTEM_MOUSE?HID_DEV ICE_UP:0001_U:0002?HID_DEVICE????a??@hidserv.inf,%mfgname%;Microsoft????6.1.7601.18199????????(??????&??????HID-konformes Ger?t??????????????/???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&?? ?&???&???&???&???&???&???&???&???&????AFD NetBIOS [\Device\NetBT_Tcpip6_{58B45821-E940-47B3-8D???????????F?????????????e 2??hidserv.inf:Microsoft.NTx86:HIDSystemConsumerDevice:6.1.7600.16385:hid_device_up:000c_u:0001?2????????????????????????????????????????????????????? ?#????0?????????????????????????????????????????i????????B??
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\00158352d18e
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\00158352d18e@1474111c2257 0xCA 0x3A 0x91 0xB4 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\00158352d18e@70d4f230f561 0x55 0x13 0x23 0x52 ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\00158352d18e (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\00158352d18e@1474111c2257 0xCA 0x3A 0x91 0xB4 ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\00158352d18e@70d4f230f561 0x55 0x13 0x23 0x52 ...

---- EOF - GMER 2.1 ----

Alt 27.11.2013, 14:19   #2
schrauber
/// the machine
/// TB-Ausbilder
 
wie entferne ich unter Windows 7 Postbankrojaner ? - Standard

wie entferne ich unter Windows 7 Postbankrojaner ?


hi,

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.




Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

__________________

__________________
Alt 27.11.2013, 16:45   #3
Marc11
 
wie entferne ich unter Windows 7 Postbankrojaner ? - Standard

wie entferne ich unter Windows 7 Postbankrojaner ?


Hi Schrauber !
Wenn ich Dich richtig verstanden habe geht es so besser:
LOG FRST:


FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 24-11-2013
Ran by Grahl (administrator) on GRAHL-PC on 25-11-2013 12:56:53
Running from C:\Users\Grahl\Desktop
Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Nero AG) C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
() C:\Program Files\Tobit Radio.fx\Server\rfx-server.exe
(Fujitsu Technology Solutions) C:\Program Files\Fujitsu\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe
(Fujitsu Technology Solutions) C:\Program Files\Fujitsu\DeskViewBasic\DeskViewBasicService.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Inventec Corp.) C:\Program Files\Fujitsu\Wireless_Utility\Wireless Selector.exe
(Research In Motion Limited) C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Research In Motion Limited) C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe
(APN LLC.) C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe
(Microsoft Corporation) C:\Windows\System32\taskmgr.exe
(Microsoft Corporation) C:\Windows\System32\LogonUI.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1545512 2009-07-20] (Synaptics Incorporated)
HKLM\...\Run: [DeskViewBasic] - C:\Program Files\Fujitsu\DeskViewBasic\DeskViewBasic.exe [182784 2009-08-19] (Fujitsu Technology Solutions)
HKLM\...\Run: [Wireless_Selector] - C:\Program Files\Fujitsu\Wireless_Utility\Wireless Selector.exe [327680 2009-05-14] (Inventec Corp.)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7514656 2009-05-22] (Realtek Semiconductor)
HKLM\...\Run: [NvCplDaemon] - RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [RIMBBLaunchAgent.exe] - C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe [443408 2013-09-09] (Research In Motion Limited)
HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [948440 2013-10-23] (Microsoft Corporation)
HKLM\...\Run: [BCSSync] - C:\Program Files\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [Windows Mobile-based device management] - C:\Windows\WindowsMobile\wmdcBase.exe [648072 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [683576 2013-10-31] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [ApnTBMon] - C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1673680 2013-10-23] (APN)
HKCU\...\Run: [ISUSPM] - C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe [218032 2006-09-11] (Macrovision Corporation)
HKCU\...\Run: [GoogleDriveSync] - C:\Program Files\Google\Drive\googledrivesync.exe [20133824 2013-09-25] (Google)
HKCU\...\Run: [tuswrwpl] - regsvr32.exe /s "C:\ProgramData\tuswrwpl.dat"
BootExecute: autocheck autochk * sdnclean.exe

==================== Internet (Whitelisted) ====================

ProxyServer: :0
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://aartemis.com/?type=hp&ts=1385378153&from=cor&uid=HitachiXHTS545016B9A300_090904PB5B01QCC9SXXGX
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.aartemis.com/web/?type=ds&ts=1385378153&from=cor&uid=HitachiXHTS545016B9A300_090904PB5B01QCC9SXXGX&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://aartemis.com/?type=hp&ts=1385378153&from=cor&uid=HitachiXHTS545016B9A300_090904PB5B01QCC9SXXGX
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://aartemis.com/?type=hp&ts=1385378153&from=cor&uid=HitachiXHTS545016B9A300_090904PB5B01QCC9SXXGX
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.aartemis.com/web/?type=ds&ts=1385378153&from=cor&uid=HitachiXHTS545016B9A300_090904PB5B01QCC9SXXGX&q={searchTerms}
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.aartemis.com/web/?type=ds&ts=1385378153&from=cor&uid=HitachiXHTS545016B9A300_090904PB5B01QCC9SXXGX&q={searchTerms}
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.aartemis.com/web/?type=ds&ts=1385378153&from=cor&uid=HitachiXHTS545016B9A300_090904PB5B01QCC9SXXGX&q={searchTerms}
SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 
BHO: AC-Pro - {0FB6A909-6086-458F-BD92-1F8EE10042A0} - C:\Program Files\AutocompletePro\AutocompletePro.dll (SimplyGen)
BHO: Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
Tcpip\Parameters: [DhcpNameServer] 10.4.59.1

FireFox:
========
FF ProfilePath: C:\Users\Grahl\AppData\Roaming\Mozilla\Firefox\Profiles\zh7u3f8r.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @RIM.com/WebSLLauncher,version=1.0 - C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: AutocompletePro - Your handy search suggestions tool - C:\Users\Grahl\AppData\Roaming\Mozilla\Firefox\Profiles\zh7u3f8r.default\Extensions\support@predictad.com
FF Extension: toolbar_AVIRA-V7 - C:\Users\Grahl\AppData\Roaming\Mozilla\Firefox\Profiles\zh7u3f8r.default\Extensions\toolbar_AVIRA-V7@apn.ask.com.xpi

Chrome: 
=======
CHR HomePage: hxxp://www.spiegel.de/
CHR DefaultSearchURL: (Google) - {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR HKLM\...\Chrome\Extension: [aaaaacalgebmfelllfiaoknifldpngjh] - C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\CRX\ToolbarCR.crx
CHR HKLM\...\Chrome\Extension: [defdhglnppeioeflggkmglipcecffkhk] - C:\Program Files\AutocompletePro\chrome\autocompleteprochrome.crx

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440376 2013-10-31] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440376 2013-10-31] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe [1164360 2013-10-31] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2013-10-23] (APN LLC.)
R3 BlackBerry Device Manager; C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe [585728 2013-09-09] (Research In Motion Limited)
R2 DeskViewBasicService; C:\Program Files\Fujitsu\DeskViewBasic\DeskViewBasicService.exe [34816 2009-08-19] (Fujitsu Technology Solutions)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [22208 2013-10-23] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [280288 2013-10-23] (Microsoft Corporation)
R2 Radio.fx; C:\Program Files\Tobit Radio.fx\Server\rfx-server.exe [3673944 2011-11-18] ()
R2 TestHandler; C:\Program Files\Fujitsu\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe [341264 2009-02-19] (Fujitsu Technology Solutions)
S2 RoxLiveShare9; "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe" [x]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-10-31] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [137208 2013-10-31] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-31] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [67680 2013-10-31] (Avira Operations GmbH & Co. KG)
S3 BthAvrcp; C:\Windows\System32\DRIVERS\BthAvrcp.sys [22528 2009-08-13] (CSR, plc)
S3 DTVFW; C:\Windows\System32\DRIVERS\dtvfw.sys [22016 2005-05-12] (LITE-ON)
R3 FSCSLII; C:\Windows\System32\DRIVERS\FSCSLII.sys [16384 2009-05-18] (Fujitsu)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [214696 2013-09-27] (Microsoft Corporation)
R1 MpKslf5029df0; C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{696B7E90-DB80-43A7-A355-727E39677A06}\MpKslf5029df0.sys [40392 2013-11-22] (Microsoft Corporation)
S3 rimvndis; C:\Windows\System32\Drivers\rimvndis6.sys [14336 2013-08-15] (Research in Motion Limited)
S3 s0016bus; C:\Windows\System32\DRIVERS\s0016bus.sys [89256 2008-05-16] (MCCI Corporation)
S3 s0016mdfl; C:\Windows\System32\DRIVERS\s0016mdfl.sys [15016 2008-05-16] (MCCI Corporation)
S3 s0016mdm; C:\Windows\System32\DRIVERS\s0016mdm.sys [120744 2008-05-16] (MCCI Corporation)
S3 s0016mgmt; C:\Windows\System32\DRIVERS\s0016mgmt.sys [114216 2008-05-16] (MCCI Corporation)
S3 s0016nd5; C:\Windows\System32\DRIVERS\s0016nd5.sys [25512 2008-05-16] (MCCI Corporation)
S3 s0016obex; C:\Windows\System32\DRIVERS\s0016obex.sys [110632 2008-05-16] (MCCI Corporation)
S3 s0016unic; C:\Windows\System32\DRIVERS\s0016unic.sys [115752 2008-05-16] (MCCI Corporation)
S1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-10-31] (Avira GmbH)
S3 usbdtv; C:\Windows\System32\Drivers\usbdtv.sys [31232 2005-06-07] (LITE-ON)
S3 usbrndis6; C:\Windows\System32\DRIVERS\usb80236.sys [15872 2013-02-12] (Microsoft Corporation)
S3 pccsmcfd; system32\DRIVERS\pccsmcfd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-11-25 12:56 - 2013-11-25 12:57 - 00012627 _____ C:\Users\Grahl\Desktop\FRST.txt
2013-11-25 12:56 - 2013-11-25 12:56 - 00000000 ____D C:\FRST
2013-11-25 12:55 - 2013-11-25 12:55 - 01091583 _____ (Farbar) C:\Users\Grahl\Desktop\FRST.exe
2013-11-25 12:23 - 2013-11-25 12:23 - 00000000 ____D C:\Users\Grahl\Documents\PC Speed Maximizer
2013-11-25 12:14 - 2013-11-25 12:14 - 00001145 _____ C:\Users\Grahl\Desktop\Continue Zip Extractor Installation.lnk
2013-11-22 12:49 - 2013-11-22 12:49 - 00000000 ____D C:\Users\Grahl\AppData\Roaming\Avira
2013-11-22 12:48 - 2013-11-22 12:48 - 00000000 ____D C:\ProgramData\AskPartnerNetwork
2013-11-22 12:48 - 2013-11-22 12:48 - 00000000 ____D C:\Program Files\AskPartnerNetwork
2013-11-22 12:48 - 2013-05-31 20:51 - 00489392 _____ (Ask Partner Network) C:\Users\Grahl\Documents\APNSetup1.exe
2013-11-22 12:46 - 2013-11-22 12:46 - 00002018 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-11-22 12:46 - 2013-10-31 19:25 - 00137208 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-11-22 12:46 - 2013-10-31 19:25 - 00090400 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-11-22 12:46 - 2013-10-31 19:25 - 00067680 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-11-22 12:46 - 2013-10-31 19:25 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-11-22 12:46 - 2013-10-31 19:25 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
2013-11-22 12:45 - 2013-11-22 12:45 - 00000000 ____D C:\ProgramData\Avira
2013-11-22 12:45 - 2013-11-22 12:45 - 00000000 ____D C:\Program Files\Avira
2013-11-22 12:39 - 2013-11-22 12:44 - 126764512 _____ C:\Users\Grahl\Desktop\avira_free_antivirus_de.exe
2013-11-22 12:14 - 2013-11-22 12:40 - 00000000 ____D C:\Users\Grahl\AppData\Roaming\Nico Mak Computing
2013-11-22 12:13 - 2013-11-22 12:13 - 04892480 _____ (WinZip International LLC                                    ) C:\Users\Grahl\Desktop\wzmp_8.exe
2013-11-22 12:02 - 2013-11-22 12:02 - 02209056 _____ C:\Users\Grahl\Downloads\avira-eu-cleaner_de.exe
2013-11-22 12:01 - 2013-11-22 12:01 - 00002033 _____ C:\Users\Grahl\Desktop\Entfernen des Avira EU-Cleaners.lnk
2013-11-22 12:01 - 2013-11-22 12:01 - 00001977 _____ C:\Users\Grahl\Desktop\Avira EU-Cleaner.lnk
2013-11-21 23:32 - 2013-11-21 23:32 - 00000000 ____D C:\Users\Grahl\AppData\Roaming\Research In Motion
2013-11-21 23:30 - 2013-11-21 23:30 - 00002195 _____ C:\Users\Public\Desktop\BlackBerry Desktop Software.lnk
2013-11-20 14:14 - 2013-11-20 14:14 - 17142784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 11220992 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 04240384 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-20 14:14 - 2013-11-20 14:14 - 02166272 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 01926656 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-11-20 14:14 - 2013-11-20 14:14 - 01818112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 01156608 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 01051136 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00703488 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00645120 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-11-20 14:14 - 2013-11-20 14:14 - 00610304 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00553472 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00523776 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-11-20 14:14 - 2013-11-20 14:14 - 00244736 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00238288 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00233472 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00208896 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00208384 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00182272 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00151552 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00127488 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00083456 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-11-20 14:14 - 2013-11-20 14:14 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-11-20 14:12 - 2013-11-20 14:17 - 00009945 _____ C:\Windows\IE11_main.log
2013-11-20 13:02 - 2013-11-21 23:21 - 00258048 _____ C:\ProgramData\tuswrwpl.dat
2013-11-20 12:29 - 2013-11-25 12:31 - 00000000 ____D C:\Program Files\7-Zip
2013-11-18 11:26 - 2013-11-21 14:39 - 00000000 ____D C:\Windows\rescache
2013-11-14 10:51 - 2013-11-14 13:43 - 03865088 _____ C:\Users\Grahl\Desktop\Präsentation LVR.ppt
2013-11-13 13:26 - 2013-11-13 13:26 - 00083456 _____ C:\Users\Grahl\Documents\Zeitstrahl Pro 4.ppt
2013-11-13 12:36 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll
2013-11-13 12:36 - 2013-10-04 02:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2013-11-13 12:36 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll
2013-11-13 12:36 - 2013-09-25 03:01 - 00136640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-11-13 12:36 - 2013-09-25 03:01 - 00067520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2013-11-13 12:36 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-11-13 12:36 - 2013-09-25 02:57 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2013-11-13 12:36 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2013-11-13 12:36 - 2013-09-25 02:56 - 01038848 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-11-13 12:36 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2013-11-13 12:36 - 2013-09-25 01:49 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2013-11-13 12:36 - 2013-09-25 01:49 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2013-11-13 12:36 - 2013-07-04 13:16 - 00369848 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-11-13 12:35 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2013-11-13 12:35 - 2013-10-12 03:01 - 00679424 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2013-11-13 12:35 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2013-11-13 12:35 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-11-13 12:35 - 2013-10-03 02:58 - 00305152 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2013-11-13 12:10 - 2013-11-22 08:54 - 00009616 _____ C:\Windows\setupact.log
2013-11-13 12:10 - 2013-11-13 12:10 - 00000000 _____ C:\Windows\setuperr.log

==================== One Month Modified Files and Folders =======

2013-11-25 12:58 - 2011-07-21 13:43 - 00001096 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-25 12:57 - 2013-11-25 12:56 - 00012627 _____ C:\Users\Grahl\Desktop\FRST.txt
2013-11-25 12:56 - 2013-11-25 12:56 - 00000000 ____D C:\FRST
2013-11-25 12:56 - 2009-11-07 01:18 - 01049534 _____ C:\Windows\WindowsUpdate.log
2013-11-25 12:55 - 2013-11-25 12:55 - 01091583 _____ (Farbar) C:\Users\Grahl\Desktop\FRST.exe
2013-11-25 12:47 - 2009-07-14 05:34 - 00009712 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-25 12:47 - 2009-07-14 05:34 - 00009712 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-25 12:31 - 2013-11-20 12:29 - 00000000 ____D C:\Program Files\7-Zip
2013-11-25 12:23 - 2013-11-25 12:23 - 00000000 ____D C:\Users\Grahl\Documents\PC Speed Maximizer
2013-11-25 12:16 - 2009-11-06 16:36 - 00001619 _____ C:\Users\Grahl\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-11-25 12:14 - 2013-11-25 12:14 - 00001145 _____ C:\Users\Grahl\Desktop\Continue Zip Extractor Installation.lnk
2013-11-25 12:00 - 2012-04-16 12:02 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-25 11:08 - 2011-07-21 13:43 - 00001092 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-25 11:00 - 2013-05-27 07:45 - 00000000 ____D C:\Program Files\File Type Assistant
2013-11-22 12:49 - 2013-11-22 12:49 - 00000000 ____D C:\Users\Grahl\AppData\Roaming\Avira
2013-11-22 12:48 - 2013-11-22 12:48 - 00000000 ____D C:\ProgramData\AskPartnerNetwork
2013-11-22 12:48 - 2013-11-22 12:48 - 00000000 ____D C:\Program Files\AskPartnerNetwork
2013-11-22 12:46 - 2013-11-22 12:46 - 00002018 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-11-22 12:45 - 2013-11-22 12:45 - 00000000 ____D C:\ProgramData\Avira
2013-11-22 12:45 - 2013-11-22 12:45 - 00000000 ____D C:\Program Files\Avira
2013-11-22 12:44 - 2013-11-22 12:39 - 126764512 _____ C:\Users\Grahl\Desktop\avira_free_antivirus_de.exe
2013-11-22 12:40 - 2013-11-22 12:14 - 00000000 ____D C:\Users\Grahl\AppData\Roaming\Nico Mak Computing
2013-11-22 12:13 - 2013-11-22 12:13 - 04892480 _____ (WinZip International LLC                                    ) C:\Users\Grahl\Desktop\wzmp_8.exe
2013-11-22 12:02 - 2013-11-22 12:02 - 02209056 _____ C:\Users\Grahl\Downloads\avira-eu-cleaner_de.exe
2013-11-22 12:01 - 2013-11-22 12:01 - 00002033 _____ C:\Users\Grahl\Desktop\Entfernen des Avira EU-Cleaners.lnk
2013-11-22 12:01 - 2013-11-22 12:01 - 00001977 _____ C:\Users\Grahl\Desktop\Avira EU-Cleaner.lnk
2013-11-22 08:58 - 2009-08-21 07:35 - 01507340 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-22 08:55 - 2013-04-12 18:12 - 00000000 ___RD C:\Users\Grahl\Google Drive
2013-11-22 08:54 - 2013-11-13 12:10 - 00009616 _____ C:\Windows\setupact.log
2013-11-22 08:54 - 2009-07-14 05:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-21 23:43 - 2011-06-10 07:55 - 00008624 _____ C:\Users\Grahl\AppData\Roaming\Rim.DesktopHelper.Exception.log
2013-11-21 23:43 - 2010-08-18 11:35 - 00054772 _____ C:\Users\Grahl\AppData\Roaming\Rim.Desktop.Exception.log
2013-11-21 23:32 - 2013-11-21 23:32 - 00000000 ____D C:\Users\Grahl\AppData\Roaming\Research In Motion
2013-11-21 23:32 - 2010-12-22 12:19 - 00000000 ____D C:\Users\Grahl\AppData\Local\Research In Motion
2013-11-21 23:31 - 2010-08-18 11:22 - 00021897 _____ C:\Users\Grahl\AppData\Roaming\Rim.Desktop.HttpServerSetup.log
2013-11-21 23:30 - 2013-11-21 23:30 - 00002195 _____ C:\Users\Public\Desktop\BlackBerry Desktop Software.lnk
2013-11-21 23:30 - 2012-08-02 08:36 - 00000000 ____D C:\ProgramData\Research In Motion
2013-11-21 23:30 - 2012-02-15 15:42 - 00000000 ____D C:\Program Files\Common Files\XCPCSync.OEM
2013-11-21 23:29 - 2010-08-15 13:48 - 00000000 ____D C:\Program Files\Research In Motion
2013-11-21 23:29 - 2010-08-15 13:48 - 00000000 ____D C:\Program Files\Common Files\Research In Motion
2013-11-21 23:21 - 2013-11-20 13:02 - 00258048 _____ C:\ProgramData\tuswrwpl.dat
2013-11-21 23:15 - 2012-02-15 15:46 - 00014476 _____ C:\Users\Grahl\AppData\Roaming\Rim.Transcoder.Exception.log
2013-11-21 22:34 - 2011-09-11 12:56 - 00000000 ____D C:\Users\Grahl\AppData\Local\Downloaded Installations
2013-11-21 14:39 - 2013-11-18 11:26 - 00000000 ____D C:\Windows\rescache
2013-11-20 14:19 - 2013-10-11 12:54 - 00001712 _____ C:\Windows\PFRO.log
2013-11-20 14:19 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\system32\de-DE
2013-11-20 14:18 - 2011-02-08 19:58 - 00001912 _____ C:\Windows\epplauncher.mif
2013-11-20 14:17 - 2013-11-20 14:12 - 00009945 _____ C:\Windows\IE11_main.log
2013-11-20 14:17 - 2011-02-08 19:56 - 00000000 ____D C:\Program Files\Microsoft Security Client
2013-11-20 14:14 - 2013-11-20 14:14 - 17142784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 11220992 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 04240384 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-20 14:14 - 2013-11-20 14:14 - 02166272 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 01926656 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-11-20 14:14 - 2013-11-20 14:14 - 01818112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 01156608 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 01051136 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00703488 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00645120 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-11-20 14:14 - 2013-11-20 14:14 - 00610304 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00553472 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00523776 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-11-20 14:14 - 2013-11-20 14:14 - 00244736 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00238288 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00233472 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00208896 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00208384 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00182272 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00151552 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00127488 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00083456 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-11-20 14:14 - 2013-11-20 14:14 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-11-20 11:56 - 2013-04-29 12:49 - 00000000 ____D C:\Users\Grahl\Documents\DDPB
2013-11-19 11:21 - 2009-11-06 17:07 - 00230048 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2013-11-14 13:43 - 2013-11-14 10:51 - 03865088 _____ C:\Users\Grahl\Desktop\Präsentation LVR.ppt
2013-11-14 11:20 - 2012-02-27 11:22 - 00023552 _____ C:\Users\Grahl\Documents\Codes für alles.xls
2013-11-14 09:15 - 2012-04-16 12:02 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-11-14 09:15 - 2011-06-28 07:00 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-11-14 09:15 - 2009-11-06 16:35 - 00000000 ____D C:\Users\Grahl\AppData\Local\Adobe
2013-11-14 09:10 - 2009-08-07 14:43 - 00000000 ____D C:\Windows\Panther
2013-11-13 13:47 - 2009-08-21 07:31 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-11-13 13:45 - 2010-11-16 08:53 - 00000000 ____D C:\Windows\WindowsMobile
2013-11-13 13:41 - 2013-07-19 08:43 - 00000000 ____D C:\Windows\system32\MRT
2013-11-13 13:38 - 2009-11-26 09:21 - 80340640 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-11-13 13:26 - 2013-11-13 13:26 - 00083456 _____ C:\Users\Grahl\Documents\Zeitstrahl Pro 4.ppt
2013-11-13 12:38 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-11-13 12:10 - 2013-11-13 12:10 - 00000000 _____ C:\Windows\setuperr.log
2013-11-12 16:08 - 2009-07-14 03:04 - 00000499 _____ C:\Windows\win.ini
2013-11-12 11:14 - 2011-03-09 10:20 - 00000000 ____D C:\Users\Grahl\Desktop\Privat
2013-11-05 08:49 - 2013-04-15 09:17 - 00000000 ____D C:\Users\Grahl\Desktop\BUT
2013-10-31 19:25 - 2013-11-22 12:46 - 00137208 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-10-31 19:25 - 2013-11-22 12:46 - 00090400 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-10-31 19:25 - 2013-11-22 12:46 - 00067680 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-10-31 19:25 - 2013-11-22 12:46 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-10-31 19:25 - 2013-11-22 12:46 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
2013-10-30 11:07 - 2013-04-08 10:59 - 00000000 _____ C:\Users\Grahl\Documents\RIMPTG

Files to move or delete:
====================
C:\ProgramData\tuswrwpl.dat


Some content of TEMP:
====================
C:\Users\Grahl\AppData\Local\Temp\2SKKKKKKK.exe
C:\Users\Grahl\AppData\Local\Temp\89.4239114108929_Update.exe
C:\Users\Grahl\AppData\Local\Temp\avgnt.exe
C:\Users\Grahl\AppData\Local\Temp\ICReinstall_ZipExtractorSetup.exe
C:\Users\Grahl\AppData\Local\Temp\pcspeedmaxsetup.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-11-20 10:54

==================== End Of Log ============================
--- --- ---

--- --- ---


LOG Gmer:
Code:
ATTFilter
GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-11-25 14:08:22
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 Hitachi_HTS545016B9A300 rev.PBBOC64G 149,05GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Grahl\AppData\Local\Temp\pwtoqpow.sys


---- System - GMER 2.1 ----

SSDT            89137A56                                                                                                                   ZwCreateSection
SSDT            89137A60                                                                                                                   ZwRequestWaitReplyPort
SSDT            89137A5B                                                                                                                   ZwSetContextThread
SSDT            89137A65                                                                                                                   ZwSetSecurityObject
SSDT            89137A6A                                                                                                                   ZwSystemDebugControl
SSDT            891379F7                                                                                                                   ZwTerminateProcess

---- Kernel code sections - GMER 2.1 ----

.text           ntkrnlpa.exe!ZwRollbackEnlistment + 142D                                                                                   83244A15 1 Byte  [06]
.text           ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                                                     8327E212 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text           ntkrnlpa.exe!KeRemoveQueueEx + 11F7                                                                                        8328558C 4 Bytes  [56, 7A, 13, 89]
.text           ntkrnlpa.exe!KeRemoveQueueEx + 1553                                                                                        832858E8 4 Bytes  [60, 7A, 13, 89]
.text           ntkrnlpa.exe!KeRemoveQueueEx + 1597                                                                                        8328592C 4 Bytes  [5B, 7A, 13, 89]
.text           ntkrnlpa.exe!KeRemoveQueueEx + 1613                                                                                        832859A8 4 Bytes  [65, 7A, 13, 89]
.text           ntkrnlpa.exe!KeRemoveQueueEx + 1667                                                                                        832859FC 4 Bytes  [6A, 7A, 13, 89]
.text           ...                                                                                                                        

---- User code sections - GMER 2.1 ----

.text           C:\Windows\system32\taskeng.exe[448] kernel32.dll!CreateProcessW                                                           779D204D 5 Bytes  JMP 01BD747A 
.text           C:\Windows\system32\taskeng.exe[448] kernel32.dll!CreateProcessA                                                           779D2082 5 Bytes  JMP 01BD74CF 
.text           C:\Windows\system32\taskeng.exe[448] ADVAPI32.dll!CreateProcessAsUserW                                                     7766C532 5 Bytes  JMP 01BD7524 
.text           C:\Windows\system32\taskeng.exe[448] ADVAPI32.dll!CreateProcessAsUserA                                                     776A2642 5 Bytes  JMP 01BD757C 
.text           C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[1204] kernel32.dll!CreateProcessW                           779D204D 5 Bytes  JMP 020E747A 
.text           C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[1204] kernel32.dll!CreateProcessA                           779D2082 5 Bytes  JMP 020E74CF 
.text           C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[1204] ADVAPI32.dll!CreateProcessAsUserW                     7766C532 5 Bytes  JMP 020E7524 
.text           C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[1204] ADVAPI32.dll!CreateProcessAsUserA                     776A2642 5 Bytes  JMP 020E757C 
.text           C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[1332] kernel32.dll!CreateProcessW                          779D204D 5 Bytes  JMP 01F3747A 
.text           C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[1332] kernel32.dll!CreateProcessA                          779D2082 5 Bytes  JMP 01F374CF 
.text           C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[1332] ADVAPI32.dll!CreateProcessAsUserW                    7766C532 5 Bytes  JMP 01F37524 
.text           C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[1332] ADVAPI32.dll!CreateProcessAsUserA                    776A2642 5 Bytes  JMP 01F3757C 
.text           C:\Windows\system32\Dwm.exe[1692] kernel32.dll!CreateProcessW                                                              779D204D 5 Bytes  JMP 01D1747A 
.text           C:\Windows\system32\Dwm.exe[1692] kernel32.dll!CreateProcessA                                                              779D2082 5 Bytes  JMP 01D174CF 
.text           C:\Windows\system32\Dwm.exe[1692] ADVAPI32.dll!CreateProcessAsUserW                                                        7766C532 5 Bytes  JMP 01D17524 
.text           C:\Windows\system32\Dwm.exe[1692] ADVAPI32.dll!CreateProcessAsUserA                                                        776A2642 5 Bytes  JMP 01D1757C 
.text           C:\Windows\Explorer.EXE[1724] kernel32.dll!CreateProcessW                                                                  779D204D 5 Bytes  JMP 080D747A 
.text           C:\Windows\Explorer.EXE[1724] kernel32.dll!CreateProcessA                                                                  779D2082 5 Bytes  JMP 080D74CF 
.text           C:\Windows\Explorer.EXE[1724] ADVAPI32.dll!CreateProcessAsUserW                                                            7766C532 5 Bytes  JMP 080D7524 
.text           C:\Windows\Explorer.EXE[1724] ADVAPI32.dll!CreateProcessAsUserA                                                            776A2642 5 Bytes  JMP 080D757C 
.text           C:\Windows\system32\taskhost.exe[1772] kernel32.dll!CreateProcessW                                                         779D204D 5 Bytes  JMP 02D6747A 
.text           C:\Windows\system32\taskhost.exe[1772] kernel32.dll!CreateProcessA                                                         779D2082 5 Bytes  JMP 02D674CF 
.text           C:\Windows\system32\taskhost.exe[1772] ADVAPI32.dll!CreateProcessAsUserW                                                   7766C532 5 Bytes  JMP 02D67524 
.text           C:\Windows\system32\taskhost.exe[1772] ADVAPI32.dll!CreateProcessAsUserA                                                   776A2642 5 Bytes  JMP 02D6757C 
.text           C:\Program Files\Tobit Radio.fx\Server\rfx-server.exe[1856] kernel32.dll!SetUnhandledExceptionFilter                       77A1F4EB 5 Bytes  JMP 00641870 C:\Program Files\Tobit Radio.fx\Server\rfx-server.exe
.text           C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2468] kernel32.dll!CreateProcessW                                            779D204D 5 Bytes  JMP 016E747A 
.text           C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2468] kernel32.dll!CreateProcessA                                            779D2082 5 Bytes  JMP 016E74CF 
.text           C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2468] ADVAPI32.dll!CreateProcessAsUserW                                      7766C532 5 Bytes  JMP 016E7524 
.text           C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2468] ADVAPI32.dll!CreateProcessAsUserA                                      776A2642 5 Bytes  JMP 016E757C 
.text           C:\Program Files\Fujitsu\Wireless_Utility\Wireless Selector.exe[2604] kernel32.dll!CreateProcessW                          779D204D 5 Bytes  JMP 0179747A 
.text           C:\Program Files\Fujitsu\Wireless_Utility\Wireless Selector.exe[2604] kernel32.dll!CreateProcessA                          779D2082 5 Bytes  JMP 017974CF 
.text           C:\Program Files\Fujitsu\Wireless_Utility\Wireless Selector.exe[2604] ADVAPI32.dll!CreateProcessAsUserW                    7766C532 5 Bytes  JMP 01797524 
.text           C:\Program Files\Fujitsu\Wireless_Utility\Wireless Selector.exe[2604] ADVAPI32.dll!CreateProcessAsUserA                    776A2642 5 Bytes  JMP 0179757C 
.text           C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe[2664] kernel32.dll!CreateProcessW        779D204D 5 Bytes  JMP 0224747A 
.text           C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe[2664] kernel32.dll!CreateProcessA        779D2082 5 Bytes  JMP 022474CF 
.text           C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe[2664] ADVAPI32.dll!CreateProcessAsUserW  7766C532 5 Bytes  JMP 02247524 
.text           C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe[2664] ADVAPI32.dll!CreateProcessAsUserA  776A2642 5 Bytes  JMP 0224757C 
.text           C:\Program Files\Microsoft Security Client\msseces.exe[2832] kernel32.dll!CreateProcessW                                   779D204D 5 Bytes  JMP 028B747A 
.text           C:\Program Files\Microsoft Security Client\msseces.exe[2832] kernel32.dll!CreateProcessA                                   779D2082 5 Bytes  JMP 028B74CF 
.text           C:\Program Files\Microsoft Security Client\msseces.exe[2832] ADVAPI32.dll!CreateProcessAsUserW                             7766C532 5 Bytes  JMP 028B7524 
.text           C:\Program Files\Microsoft Security Client\msseces.exe[2832] ADVAPI32.dll!CreateProcessAsUserA                             776A2642 5 Bytes  JMP 028B757C 
.text           C:\Program Files\Internet Explorer\iexplore.exe[2900] kernel32.dll!CreateProcessW                                          779D204D 5 Bytes  JMP 00A0747A 
.text           C:\Program Files\Internet Explorer\iexplore.exe[2900] kernel32.dll!CreateProcessA                                          779D2082 5 Bytes  JMP 00A074CF 
.text           C:\Program Files\Internet Explorer\iexplore.exe[2900] advapi32.DLL!CreateProcessAsUserW                                    7766C532 5 Bytes  JMP 00A07524 
.text           C:\Program Files\Internet Explorer\iexplore.exe[2900] advapi32.DLL!CreateProcessAsUserA                                    776A2642 5 Bytes  JMP 00A0757C 
.text           C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!InternetReadFileExA                                      77792055 5 Bytes  JMP 00A06B62 
.text           C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!InternetWriteFile                                        777C46D9 5 Bytes  JMP 00A03D24 
.text           C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!HttpEndRequestA                                          777C4B75 5 Bytes  JMP 00A04272 
.text           C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!HttpSendRequestExW                                       777C5E07 5 Bytes  JMP 00A06F17 
.text           C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!InternetQueryOptionA                                     777DDC3E 5 Bytes  JMP 00A04560 
.text           C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!InternetSetOptionA                                       777DF69A 5 Bytes  JMP 00A0463E 
.text           C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!InternetSetOptionW                                       777DFA34 5 Bytes  JMP 00A0466D 
.text           C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!InternetQueryOptionW                                     777E03CD 5 Bytes  JMP 00A0458F 
.text           C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!HttpOpenRequestW                                         777E2957 5 Bytes  JMP 00A0442C 
.text           C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!InternetCloseHandle                                      777E5B7F 5 Bytes  JMP 00A06886 
.text           C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!HttpQueryInfoA                                           777E72A0 5 Bytes  JMP 00A03BE4 
.text           C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!InternetConnectW                                         777E8F57 5 Bytes  JMP 00A06941 
.text           C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!InternetReadFile                                         777F4390 5 Bytes  JMP 00A06B15 
.text           C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!InternetQueryDataAvailable                               777F8461 5 Bytes  JMP 00A06988 
.text           C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!HttpSendRequestW                                         777F8DD0 5 Bytes  JMP 00A06DF1 
.text           C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!HttpSendRequestA                                         7780F6FA 5 Bytes  JMP 00A06D7F 
.text           C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!InternetConnectA                                         7785D336 5 Bytes  JMP 00A068FA 
.text           C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!HttpEndRequestW                                          7787F5B8 5 Bytes  JMP 00A0429F 
.text           C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!HttpSendRequestExA                                       7787F671 5 Bytes  JMP 00A06E63 
.text           C:\Program Files\Internet Explorer\iexplore.exe[2900] WININET.DLL!HttpOpenRequestA                                         7787FA9D 5 Bytes  JMP 00A043CA 

---- Devices - GMER 2.1 ----

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                                                    Wdf01000.sys
AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                                                    Wdf01000.sys

---- Registry - GMER 2.1 ----

Reg             HKLM\SYSTEM\CurrentControlSet\Control\Session Manager@PendingFileRenameOperations                                          ?????????????????????????????7??????????????????????????????????????????CD/DVD File System Reader???HidUsb?ll???????????? ??????????????????Tcpip6??NNEL?Tcpip6??????????????-?????????????? #??????????????? ???????????????????r?1????????????????????? ?????????????????????1????????????????????HID\VID_04F3&PID_01A4&REV_0100&MI_01&Col01?HID\VID_04F3&PID_01A4&MI_01&Col01?HID_DEVICE_SYSTEM_MOUSE?HID_DEVICE_UP:0001_U:0002?HID_DEVICE????a??@hidserv.inf,%mfgname%;Microsoft????6.1.7601.18199????????(??????&??????HID-konformes Ger?t??????????????/???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&???&????AFD NetBIOS [\Device\NetBT_Tcpip6_{58B45821-E940-47B3-8D???????????F?????????????e 2??hidserv.inf:Microsoft.NTx86:HIDSystemConsumerDevice:6.1.7600.16385:hid_device_up:000c_u:0001?2??????????????????????????????????????????????????????#????0?????????????????????????????????????????i????????B??
Reg             HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\00158352d18e                                                
Reg             HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\00158352d18e@1474111c2257                                   0xCA 0x3A 0x91 0xB4 ...
Reg             HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\00158352d18e@70d4f230f561                                   0x55 0x13 0x23 0x52 ...
Reg             HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\00158352d18e (not active ControlSet)                            
Reg             HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\00158352d18e@1474111c2257                                       0xCA 0x3A 0x91 0xB4 ...
Reg             HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\00158352d18e@70d4f230f561                                       0x55 0x13 0x23 0x52 ...

---- EOF - GMER 2.1 ----
Log FRST Addition:
Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 24-11-2013
Ran by Grahl at 2013-11-25 12:58:53
Running from C:\Users\Grahl\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Microsoft Security Essentials (Enabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F}
AV: Avira Desktop (Enabled - Out of date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Out of date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Microsoft Security Essentials (Enabled - Up to date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}

==================== Installed Programs ======================

Activation Assistant for the 2007 Microsoft Office suites
Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0)
Adobe Flash Player 11 ActiveX (Version: 11.9.900.152)
Adobe Flash Player 11 Plugin (Version: 11.9.900.117)
Adobe Reader XI (11.0.05) - Deutsch (Version: 11.0.05)
Advertising Center (Version: 0.0.0.1)
AutocompletePro
Avira Free Antivirus (Version: 14.0.1.719)
Avira SearchFree Toolbar (Version: 12.6.0.1900)
BlackBerry Desktop Software 7.1 (Version: 7.1.0.41)
BlackBerry Device Software Updater (Version: 8.0.0.41)
CANON iMAGE GATEWAY Task for ZoomBrowser EX (Version: 1.5.0.3)
Canon Internet Library for ZoomBrowser EX (Version: 1.6.1.6)
Canon MP Navigator EX 2.0
Canon RAW Image Task for ZoomBrowser EX (Version: 3.2.0.10)
Canon Utilities CameraWindow (Version: 7.1.0.2)
Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX (Version: 6.4.2.16)
Canon Utilities Digital Photo Professional 3.3 (Version: 3.3.1.1)
Canon Utilities EOS Utility (Version: 2.3.1.3)
Canon Utilities MyCamera (Version: 6.4.0.5)
Canon Utilities Original Data Security Tools (Version: 1.3.0.0)
Canon Utilities PhotoStitch (Version: 3.1.21.45)
Canon Utilities Picture Style Editor (Version: 1.2.0.1)
Canon Utilities RemoteCapture Task for ZoomBrowser EX (Version: 1.7.1.9)
Canon Utilities WFT-E1/E2/E3 Utility (Version: 3.2.1.1)
Canon Utilities ZoomBrowser EX (Version: 6.1.1.21)
Canon ZoomBrowser EX Memory Card Utility (Version: 1.1.0.8)
CCleaner (Version: 4.02)
Compatibility Pack for the 2007 Office system (Version: 12.0.6612.1000)
DDPB (Version: 1.0.9)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition
EOS USB WIA Driver (Version: 6.0.1.5)
File Type Assistant (Version: 2013.4.8.0)
Google Calendar Sync
Google Drive (Version: 1.12.5329.1887)
Google Update Helper (Version: 1.3.21.165)
ImagXpress (Version: 7.0.74.0)
Java(TM) 6 Update 25 (Version: 6.0.250)
MATHEARBEIT
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Antimalware Service DE-DE Language Pack (Version: 3.0.8402.2)
Microsoft Application Error Reporting (Version: 12.0.6012.5000)
Microsoft Office 2003 Primary Interop Assemblies (Version: 11.0.6553.0)
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003)
Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1)
Microsoft Office Outlook 2010 (Version: 14.0.7015.1000)
Microsoft Office Outlook Connector (Version: 14.0.6123.5001)
Microsoft Office Outlook MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Professional Edition 2003 (Version: 11.0.8173.0)
Microsoft Office Proof (English) 2010 (Version: 14.0.7015.1000)
Microsoft Office Proof (French) 2010 (Version: 14.0.7015.1000)
Microsoft Office Proof (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Proof (Italian) 2010 (Version: 14.0.7015.1000)
Microsoft Office Proofing (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Shared MUI (German) 2010 (Version: 14.0.7015.1000)
Microsoft Outlook 2010 (Version: 14.0.7015.1000)
Microsoft Security Client (Version: 4.4.0304.0)
Microsoft Security Client DE-DE Language Pack (Version: 2.1.1116.0)
Microsoft Security Essentials (Version: 4.4.304.0)
Microsoft Silverlight (Version: 5.1.20913.0)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft-Maus- und Tastatur-Center (Version: 2.2.173.0)
MSVC80_x86_v2 (Version: 1.0.3.0)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
Nero 9 Essentials
Nero BurnRights (Version: 3.4.10.100)
Nero BurnRights Help (Version: 3.4.4.100)
Nero ControlCenter (Version: 9.0.0.1)
Nero CoverDesigner (Version: 4.4.9.203)
Nero CoverDesigner Help (Version: 4.4.6.100)
Nero DiscSpeed (Version: 5.4.7.202)
Nero DiscSpeed Help (Version: 5.4.4.100)
Nero DriveSpeed (Version: 4.4.10.100)
Nero DriveSpeed Help (Version: 4.4.4.100)
Nero InfoTool (Version: 6.4.7.204)
Nero InfoTool Help (Version: 6.4.4.100)
Nero Installer (Version: 4.4.8.1)
Nero StartSmart (Version: 9.4.11.207)
Nero StartSmart Help (Version: 9.4.1.100)
Nero StartSmart OEM (Version: 9.4.10.100)
neroxml (Version: 1.0.0)
NVIDIA Drivers (Version: 1.4)
Print To Go 2.0 (Version: 2.0.110.0)
PVSonyDll (Version: 1.00.0001)
Realtek High Definition Audio Driver (Version: 6.0.1.5859)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition
Synaptics Pointing Device Driver (Version: 13.2.6.1)
SystemDiagnostics (Version: 2.04.0006)
TuneUp Utilities Language Pack (de-DE) (Version: 12.0.2120.5)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (Version: 3)
Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition
Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition
Update for Microsoft Word 2010 (KB2827323) 32-Bit Edition
WDR RadioRecorder
Wireless_Utility (Version: 2.04.0716)
Wireless_Utility (Version: 2.05.1005)

==================== Restore Points  =========================


==================== Hosts content: ==========================

2009-07-14 03:04 - 2009-06-10 22:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {06F17F61-E4C2-4A8C-A6FA-C59A86537961} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-11-14] (Adobe Systems Incorporated)
Task: {0C49DCC8-7754-44B5-B6A8-01FC8B64E99E} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2010-11-20] (Microsoft Corporation)
Task: {11965860-D81D-420D-9628-4B66EB978307} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-11] (Microsoft Corporation)
Task: {12104A29-5A58-49D6-A71A-284E741304D0} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-05-24] (Piriform Ltd)
Task: {1E236167-7D16-4050-B19F-12017F591295} - System32\Tasks\DSite => C:\Users\Grahl\AppData\Roaming\DSite\UPDATE~1\UPDATE~1.EXE
Task: {29AA1A91-D99B-4DB8-A052-BE33E19D4C15} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\MouseKeyboardCenter.exe [2013-05-13] (Microsoft)
Task: {2B8132BC-1162-468D-98C8-34E9B1CACA05} - System32\Tasks\ProgramUpdateCheck => C:\Program Files\File Type Assistant\tsassist.exe [2013-04-08] (Trusted Software ApS)
Task: {2DA0CD1A-4379-4431-BCC0-B1C61A883F07} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {3C6D24A5-3E5F-4823-98A6-1542C7AE438A} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2013-05-13] (Microsoft Corporation)
Task: {43DC421F-F021-453B-9EB0-1CD67BEA3568} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2013-05-13] (Microsoft Corporation)
Task: {43E054FD-A8C0-4DBC-BAA6-652BCA52C633} - System32\Tasks\DealPly => C:\Users\Grahl\AppData\Roaming\DealPly\UPDATE~1\UPDATE~1.EXE
Task: {6BFBB788-A6F6-4AAB-89C0-07B145A8C649} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2011-07-21] (Google Inc.)
Task: {6C1791F2-ADA9-45E4-8BED-E8BE8752B4E6} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2011-07-21] (Google Inc.)
Task: {78CA2345-BB58-4C2A-8452-9894D455E09C} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2013-05-13] (Microsoft Corporation)
Task: {83D077C3-C880-4DD6-BBAA-7A54DA7C3DC9} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2013-05-13] (Microsoft Corporation)
Task: {C1C231DE-994F-4A4C-B830-3C8A41DCA8F8} - System32\Tasks\0 => Iexplore.exe 
Task: {C1DF6582-979F-48B4-9C5A-BAF7B7343E8E} - System32\Tasks\4675 => C:\Users\Grahl\AppData\Local\Temp\launchie.vbsC:\Users\Grahl\AppData\Local\Temp\launchie.vbs //B
Task: {D57E33A8-3888-4899-8F37-D4B1D09B1381} - System32\Tasks\ProgramRefresh-ATFST => C:\Program Files\File Type Assistant\TSASetup.exe [2013-04-08] (                                                            )
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============


==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (11/25/2013 00:28:16 PM) (Source: Application Hang) (User: )
Description: Programm ZipExtractorSetup.exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: df4

Startzeit: 01cee9cf8a323f70

Endzeit: 47

Anwendungspfad: C:\Users\Grahl\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F3EAZ9T5\ZipExtractorSetup.exe

Berichts-ID:

Error: (11/25/2013 00:15:38 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Das erforderliche "name"-Attribut fehlt im assemblyIdentity-Element.

Error: (11/25/2013 10:56:46 AM) (Source: Windows Backup) (User: )
Description: Die Sicherung wurde aufgrund eines Fehlers beim Schreiben am Sicherungsspeicherort "F:\" nicht abgeschlossen. Fehler: "Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)"

Error: (11/25/2013 10:53:58 AM) (Source: VSS) (User: )
Description: Volumeschattenkopie-Dienstfehler: Unerwarteter Fehler "DeviceIoControl(\\?\Volume{889d8ee5-cb32-11de-b03d-806e6f6e6963} - 00000120,0x0053c008,00D41FB8,0,00D42FC0,4096,[0])". hr = 0x80070079, Das Zeitlimit für die Semaphore wurde erreicht.
.


Vorgang:
   EndPrepareSnapshots wird verarbeitet

Kontext:
   Ausführungskontext: System Provider

Error: (11/22/2013 10:58:01 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1".
Die abhängige Assemblierung "Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (11/21/2013 10:37:17 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: BbDevMgr.exe, Version: 4.2.0.33, Zeitstempel: 0x51cc5527
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea91c
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0003224d
ID des fehlerhaften Prozesses: 0xed4
Startzeit der fehlerhaften Anwendung: 0xBbDevMgr.exe0
Pfad der fehlerhaften Anwendung: BbDevMgr.exe1
Pfad des fehlerhaften Moduls: BbDevMgr.exe2
Berichtskennung: BbDevMgr.exe3

Error: (11/21/2013 09:44:06 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: RIMDeviceManager.exe, Version: 7.0.0.59, Zeitstempel: 0x520beea8
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00ba34f0
ID des fehlerhaften Prozesses: 0x14c4
Startzeit der fehlerhaften Anwendung: 0xRIMDeviceManager.exe0
Pfad der fehlerhaften Anwendung: RIMDeviceManager.exe1
Pfad des fehlerhaften Moduls: RIMDeviceManager.exe2
Berichtskennung: RIMDeviceManager.exe3

Error: (11/21/2013 01:39:26 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1".
Die abhängige Assemblierung "Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (11/21/2013 00:12:53 PM) (Source: Application Hang) (User: )
Description: Programm iexplore.exe, Version 11.0.9600.16428 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 7dc

Startzeit: 01cee6aa32337140

Endzeit: 0

Anwendungspfad: C:\Program Files\Internet Explorer\iexplore.exe

Berichts-ID:

Error: (11/20/2013 10:55:34 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1".
Die abhängige Assemblierung "Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".


System errors:
=============
Error: (11/25/2013 11:17:33 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows-Fehlerberichterstattungsdienst erreicht.

Error: (11/25/2013 11:13:15 AM) (Source: Microsoft Antimalware) (User: )
Description: Beim Aktualisieren der Signaturen wurde von %NT-AUTORITÄT60 ein Fehler festgestellt.

	Neue Signaturversion: 

	Vorherige Signaturversion: 1.163.340.0

	Aktualisierungsquelle: %NT-AUTORITÄT59

	Aktualisierungsphase: 4.4.0304.00

	Quellpfad: 4.4.0304.01

	Signaturtyp: %NT-AUTORITÄT602

	Aktualisierungstyp: %NT-AUTORITÄT604

	Benutzer: NT-AUTORITÄT\SYSTEM

	Aktuelle Modulversion: %NT-AUTORITÄT605

	Vorherige Modulversion: %NT-AUTORITÄT606

	Fehlercode: %NT-AUTORITÄT607

	Fehlerbeschreibung: %NT-AUTORITÄT608

Error: (11/25/2013 10:53:50 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst AntiVirSchedulerService erreicht.

Error: (11/25/2013 10:53:47 AM) (Source: volsnap) (User: )
Description: Die Schattenkopie des erstellten Volumes "C:" konnte nicht installiert werden.

Error: (11/21/2013 11:17:58 PM) (Source: Service Control Manager) (User: )
Description: Dienst "BlackBerry Device Manager" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (11/21/2013 09:34:27 PM) (Source: bowser) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "PLAYBOOK-5D2B",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{4F8CABAA-F522-4CE4-97D3-14CC-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.

Error: (11/21/2013 00:13:09 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.

Error: (11/20/2013 02:16:52 PM) (Source: bowser) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "PLAYBOOK-5D2B",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{4F8CABAA-F522-4CE4-97D3-14CC-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.

Error: (11/20/2013 01:39:33 PM) (Source: bowser) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "PLAYBOOK-5D2B",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{4F8CABAA-F522-4CE4-97D3-14CC-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.

Error: (11/20/2013 11:59:30 AM) (Source: bowser) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "PLAYBOOK-5D2B",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{4F8CABAA-F522-4CE4-97D3-14CC-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.


Microsoft Office Sessions:
=========================
Error: (11/25/2013 00:28:16 PM) (Source: Application Hang)(User: )
Description: ZipExtractorSetup.exe0.0.0.0df401cee9cf8a323f7047C:\Users\Grahl\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F3EAZ9T5\ZipExtractorSetup.exe

Error: (11/25/2013 00:15:38 PM) (Source: SideBySide)(User: )
Description: assemblyIdentitynameC:\Users\Grahl\AppData\Local\Temp\89.4239114108929_Update.exeC:\Users\Grahl\AppData\Local\Temp\89.4239114108929_Update.exe3

Error: (11/25/2013 10:56:46 AM) (Source: Windows Backup)(User: )
Description: F:\Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)

Error: (11/25/2013 10:53:58 AM) (Source: VSS)(User: )
Description: DeviceIoControl(\\?\Volume{889d8ee5-cb32-11de-b03d-806e6f6e6963} - 00000120,0x0053c008,00D41FB8,0,00D42FC0,4096,[0])0x80070079, Das Zeitlimit für die Semaphore wurde erreicht.


Vorgang:
   EndPrepareSnapshots wird verarbeitet

Kontext:
   Ausführungskontext: System Provider

Error: (11/22/2013 10:58:01 AM) (Source: SideBySide)(User: )
Description: Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"C:\Program Files\Research In Motion\BlackBerry Desktop\MailServerMAPIProxy64.exe

Error: (11/21/2013 10:37:17 PM) (Source: Application Error)(User: )
Description: BbDevMgr.exe4.2.0.3351cc5527ntdll.dll6.1.7601.18247521ea91cc00000050003224ded401cee6fb53c646b0C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exeC:\Windows\SYSTEM32\ntdll.dll1778e170-52f5-11e3-b93c-00158352d18e

Error: (11/21/2013 09:44:06 PM) (Source: Application Error)(User: )
Description: RIMDeviceManager.exe7.0.0.59520beea8unknown0.0.0.000000000c000000500ba34f014c401cee6f853163fc0C:\Program Files\Common Files\Research In Motion\RIMDeviceManager\RIMDeviceManager.exeunknowna99cef40-52ed-11e3-8408-001e330efe24

Error: (11/21/2013 01:39:26 PM) (Source: SideBySide)(User: )
Description: Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"C:\Program Files\Research In Motion\BlackBerry Desktop\MailServerMAPIProxy64.exe

Error: (11/21/2013 00:12:53 PM) (Source: Application Hang)(User: )
Description: iexplore.exe11.0.9600.164287dc01cee6aa323371400C:\Program Files\Internet Explorer\iexplore.exe

Error: (11/20/2013 10:55:34 AM) (Source: SideBySide)(User: )
Description: Microsoft.VC90.ATL,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"C:\Program Files\Research In Motion\BlackBerry Desktop\MailServerMAPIProxy64.exe


==================== Memory info =========================== 

Percentage of memory in use: 63%
Total physical RAM: 1534.42 MB
Available physical RAM: 553.29 MB
Total Pagefile: 3068.84 MB
Available Pagefile: 1570.09 MB
Total Virtual: 2047.88 MB
Available Virtual: 1890.91 MB

==================== Drives ================================

Drive c: (System) (Fixed) (Total:50 GB) (Free:15.06 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Data) (Fixed) (Total:97.04 GB) (Free:29.99 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 149 GB) (Disk ID: D22F9EB7)
Partition 1: (Active) - (Size=2 GB) - (Type=27)
Partition 2: (Not Active) - (Size=50 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=97 GB) - (Type=07 NTFS)

==================== End Of Log ============================
Hoffe habe alles richtig gemacht!

Downloade mir dann jetzt noch das andere Programm.

Danke bis hier
Gruß Marc

Hallo Schrauber !
Jetzt habe ich auch den Rest Fertig. Hoffe ist alles korrekt. Also dann die Logdatei von Combofix:
Code:
ATTFilter
ComboFix 13-11-27.01 - Grahl 27.11.2013  16:17:20.1.2 - x86
Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.1534.559 [GMT 1:00]
ausgeführt von:: c:\users\Grahl\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Outdated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AV: Microsoft Security Essentials *Enabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}
SP: Avira Desktop *Disabled/Outdated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Microsoft Security Essentials *Enabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\AutocompletePro
c:\program files\AutocompletePro\AutocompletePro.dll
c:\program files\AutocompletePro\chrome\autocompleteprochrome.crx
c:\program files\AutocompletePro\FireFoxExtension.exe
c:\program files\AutocompletePro\InstTracker.exe
c:\program files\AutocompletePro\support@predictad.com\chrome.manifest
c:\program files\AutocompletePro\support@predictad.com\chrome\content\browserOverlay.xul
c:\program files\AutocompletePro\support@predictad.com\chrome\content\options.js
c:\program files\AutocompletePro\support@predictad.com\chrome\content\options.xul
c:\program files\AutocompletePro\support@predictad.com\chrome\content\utils.js
c:\program files\AutocompletePro\support@predictad.com\defaults\preferences\predictad.js
c:\program files\AutocompletePro\support@predictad.com\install.rdf
c:\program files\AutocompletePro\unins000.dat
c:\program files\AutocompletePro\unins000.exe
c:\users\Grahl\AppData\Local\Temp\_MEI22762\_ctypes.pyd
c:\users\Grahl\AppData\Local\Temp\_MEI22762\_elementtree.pyd
c:\users\Grahl\AppData\Local\Temp\_MEI22762\_hashlib.pyd
c:\users\Grahl\AppData\Local\Temp\_MEI22762\_multiprocessing.pyd
c:\users\Grahl\AppData\Local\Temp\_MEI22762\_socket.pyd
c:\users\Grahl\AppData\Local\Temp\_MEI22762\_ssl.pyd
c:\users\Grahl\AppData\Local\Temp\_MEI22762\msvcp100.dll
c:\users\Grahl\AppData\Local\Temp\_MEI22762\msvcr100.dll
c:\users\Grahl\AppData\Local\Temp\_MEI22762\pyexpat.pyd
c:\users\Grahl\AppData\Local\Temp\_MEI22762\pysqlite2._sqlite.pyd
c:\users\Grahl\AppData\Local\Temp\_MEI22762\python27.dll
c:\users\Grahl\AppData\Local\Temp\_MEI22762\pythoncom27.dll
c:\users\Grahl\AppData\Local\Temp\_MEI22762\PyWinTypes27.dll
c:\users\Grahl\AppData\Local\Temp\_MEI22762\select.pyd
c:\users\Grahl\AppData\Local\Temp\_MEI22762\unicodedata.pyd
c:\users\Grahl\AppData\Local\Temp\_MEI22762\win32api.pyd
c:\users\Grahl\AppData\Local\Temp\_MEI22762\win32com.shell.shell.pyd
c:\users\Grahl\AppData\Local\Temp\_MEI22762\win32crypt.pyd
c:\users\Grahl\AppData\Local\Temp\_MEI22762\win32event.pyd
c:\users\Grahl\AppData\Local\Temp\_MEI22762\win32file.pyd
c:\users\Grahl\AppData\Local\Temp\_MEI22762\win32inet.pyd
c:\users\Grahl\AppData\Local\Temp\_MEI22762\win32pdh.pyd
c:\users\Grahl\AppData\Local\Temp\_MEI22762\win32process.pyd
c:\users\Grahl\AppData\Local\Temp\_MEI22762\win32profile.pyd
c:\users\Grahl\AppData\Local\Temp\_MEI22762\win32security.pyd
c:\users\Grahl\AppData\Local\Temp\_MEI22762\win32ts.pyd
c:\users\Grahl\AppData\Local\Temp\_MEI22762\windows._cacheinvalidation.pyd
c:\users\Grahl\AppData\Local\Temp\_MEI22762\wx._controls_.pyd
c:\users\Grahl\AppData\Local\Temp\_MEI22762\wx._core_.pyd
c:\users\Grahl\AppData\Local\Temp\_MEI22762\wx._gdi_.pyd
c:\users\Grahl\AppData\Local\Temp\_MEI22762\wx._html2.pyd
c:\users\Grahl\AppData\Local\Temp\_MEI22762\wx._misc_.pyd
c:\users\Grahl\AppData\Local\Temp\_MEI22762\wx._windows_.pyd
c:\users\Grahl\AppData\Local\Temp\_MEI22762\wx._wizard.pyd
c:\users\Grahl\AppData\Local\Temp\_MEI22762\wxbase294u_net_vc90.dll
c:\users\Grahl\AppData\Local\Temp\_MEI22762\wxbase294u_vc90.dll
c:\users\Grahl\AppData\Local\Temp\_MEI22762\wxmsw294u_adv_vc90.dll
c:\users\Grahl\AppData\Local\Temp\_MEI22762\wxmsw294u_core_vc90.dll
c:\users\Grahl\AppData\Local\Temp\_MEI22762\wxmsw294u_html_vc90.dll
c:\users\Grahl\AppData\Local\Temp\_MEI22762\wxmsw294u_webview_vc90.dll
c:\windows\IsUn0407.exe
c:\windows\unin0407.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-10-27 bis 2013-11-27  ))))))))))))))))))))))))))))))
.
.
2013-11-27 15:27 . 2013-11-27 15:31	--------	d-----w-	c:\users\Grahl\AppData\Local\temp
2013-11-27 15:27 . 2013-11-27 15:27	--------	d-----w-	c:\users\Default\AppData\Local\temp
2013-11-25 11:56 . 2013-11-25 11:56	--------	d-----w-	C:\FRST
2013-11-22 11:49 . 2013-11-22 11:49	--------	d-----w-	c:\users\Grahl\AppData\Roaming\Avira
2013-11-22 11:48 . 2013-11-22 11:48	--------	d-----w-	c:\programdata\AskPartnerNetwork
2013-11-22 11:48 . 2013-11-22 11:48	--------	d-----w-	c:\program files\AskPartnerNetwork
2013-11-22 11:46 . 2013-10-31 18:25	67680	----a-w-	c:\windows\system32\drivers\avnetflt.sys
2013-11-22 11:46 . 2013-10-31 18:25	37352	----a-w-	c:\windows\system32\drivers\avkmgr.sys
2013-11-22 11:46 . 2013-10-31 18:25	137208	----a-w-	c:\windows\system32\drivers\avipbb.sys
2013-11-22 11:46 . 2013-10-31 18:25	90400	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2013-11-22 11:45 . 2013-11-22 11:45	--------	d-----w-	c:\programdata\Avira
2013-11-22 11:45 . 2013-11-22 11:45	--------	d-----w-	c:\program files\Avira
2013-11-22 11:14 . 2013-11-22 11:40	--------	d-----w-	c:\users\Grahl\AppData\Roaming\Nico Mak Computing
2013-11-22 11:05 . 2013-11-08 01:15	7772552	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{696B7E90-DB80-43A7-A355-727E39677A06}\mpengine.dll
2013-11-21 22:32 . 2013-11-21 22:32	--------	d-----w-	c:\users\Grahl\AppData\Roaming\Research In Motion
2013-11-21 10:34 . 2013-11-08 01:15	7772552	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-11-20 12:02 . 2013-11-27 12:36	197816	----a-w-	c:\programdata\tuswrwpl.dat
2013-11-20 11:29 . 2013-11-27 08:54	--------	d-----w-	c:\program files\7-Zip
2013-11-18 10:26 . 2013-11-21 13:39	--------	d-----w-	c:\windows\rescache
2013-11-13 11:35 . 2013-10-12 02:01	679424	----a-w-	c:\windows\system32\IKEEXT.DLL
2013-11-13 11:35 . 2013-10-03 01:58	305152	----a-w-	c:\windows\system32\gdi32.dll
2013-11-13 11:35 . 2013-10-12 02:03	656896	----a-w-	c:\windows\system32\nshwfp.dll
2013-11-13 11:35 . 2013-10-12 02:01	216576	----a-w-	c:\windows\system32\FWPUCLNT.DLL
2013-11-13 11:35 . 2013-10-05 19:57	1168384	----a-w-	c:\windows\system32\crypt32.dll
2013-11-06 10:10 . 2013-10-18 09:43	719224	------w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4FB141B6-609C-4CBE-BFB0-179F80DBF1A8}\gapaengine.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-11-19 10:21 . 2009-11-06 16:07	230048	------w-	c:\windows\system32\MpSigStub.exe
2013-11-14 08:15 . 2012-04-16 11:02	692616	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2013-11-14 08:15 . 2011-06-28 06:00	71048	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2013-10-18 09:43 . 2011-03-25 10:10	719224	------w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2013-09-27 08:53 . 2013-09-27 08:53	214696	----a-w-	c:\windows\system32\drivers\MpFilter.sys
2013-09-27 08:53 . 2010-10-24 20:25	104768	----a-w-	c:\windows\system32\drivers\NisDrvWFP.sys
2013-09-14 00:48 . 2013-10-10 07:25	338944	----a-w-	c:\windows\system32\drivers\afd.sys
2013-09-08 02:07 . 2013-10-10 07:25	1294272	----a-w-	c:\windows\system32\drivers\tcpip.sys
2013-09-08 02:03 . 2013-10-10 07:25	231424	----a-w-	c:\windows\system32\mswsock.dll
2012-07-23 05:38 . 2012-07-23 05:38	4024320	----a-w-	c:\program files\GUT8172.tmp
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{41564952-412D-5637-00A7-7A786E7484D7}]
2013-10-23 19:52	12240	----a-w-	c:\program files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{41564952-412D-5637-00A7-7A786E7484D7}"= "c:\program files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll" [2013-10-23 12240]
.
[HKEY_CLASSES_ROOT\clsid\{41564952-412d-5637-00a7-7a786e7484d7}]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2013-09-25 15:37	579024	----a-w-	c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2013-09-25 15:37	579024	----a-w-	c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2013-09-25 15:37	579024	----a-w-	c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedViewOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]
2013-09-25 15:37	579024	----a-w-	c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2013-09-25 15:37	579024	----a-w-	c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2013-09-25 15:37	579024	----a-w-	c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 218032]
"GoogleDriveSync"="c:\program files\Google\Drive\googledrivesync.exe" [2013-09-25 20133824]
"tuswrwpl"="c:\programdata\tuswrwpl.dat" [2013-11-27 197816]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-07-20 1545512]
"DeskViewBasic"="c:\program files\Fujitsu\DeskViewBasic\DeskViewBasic.exe" [2009-08-19 182784]
"Wireless_Selector"="c:\program files\Fujitsu\Wireless_Utility\Wireless Selector.exe" [2009-05-14 327680]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-05-22 7514656]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-09-01 13797992]
"RIMBBLaunchAgent.exe"="c:\program files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe" [2013-09-09 443408]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-10-23 948440]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2012-11-05 89184]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdcBase.exe" [2007-05-31 648072]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2013-10-31 683576]
"ApnTBMon"="c:\program files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe" [2013-10-23 1673680]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Google Calendar Sync.lnk - c:\program files\Google\Google Calendar Sync\GoogleCalendarSync.exe [2011-4-8 542264]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	autocheck autochk *\0\0sdnclean.exe
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Camera Hotkey]
2009-11-06 15:28	311296	----a-w-	c:\program files\Fujitsu\Wireless_Utility\Camera Hotkey.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GoogleDriveSync]
2013-09-25 15:37	20133824	----a-w-	c:\program files\Google\Drive\googledrivesync.exe
.
R2 DeskViewBasicService;DeskViewBasicService;c:\program files\Fujitsu\DeskViewBasic\DeskViewBasicService.exe [2009-08-19 34816]
R3 BthAvrcp;Bluetooth-AVRCP-Profil;c:\windows\system32\DRIVERS\BthAvrcp.sys [2009-08-13 22528]
R3 DTVFW;LITE-ON DVB-T USB adapter firmware;c:\windows\system32\DRIVERS\dtvfw.sys [2005-05-12 22016]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2013-11-20 108032]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 14848]
R3 rimvndis;BlackBerry Virtual Private Network;c:\windows\system32\Drivers\rimvndis6.sys [2013-08-15 14336]
R3 s0016bus;Sony Ericsson Device 0016 driver (WDM);c:\windows\system32\DRIVERS\s0016bus.sys [2008-05-16 89256]
R3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s0016mdfl.sys [2008-05-16 15016]
R3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s0016mdm.sys [2008-05-16 120744]
R3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s0016mgmt.sys [2008-05-16 114216]
R3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS);c:\windows\system32\DRIVERS\s0016nd5.sys [2008-05-16 25512]
R3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s0016obex.sys [2008-05-16 110632]
R3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM);c:\windows\system32\DRIVERS\s0016unic.sys [2008-05-16 115752]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 49664]
R3 usbdtv;LITE-ON DVB-T (PID=F001) receiver;c:\windows\system32\Drivers\usbdtv.sys [2005-06-07 31232]
R3 usbrndis6;USB-RNDIS6-Adapter;c:\windows\system32\DRIVERS\usb80236.sys [2013-02-12 15872]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2013-10-31 37352]
S1 MpKsl040e1553;MpKsl040e1553;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{696B7E90-DB80-43A7-A355-727E39677A06}\MpKsl040e1553.sys [2013-11-27 40392]
S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2013-10-31 440376]
S2 AntiVirWebService;Avira Browser-Schutz;c:\program files\Avira\AntiVir Desktop\avwebg7.exe [2013-10-31 1164360]
S2 APNMCP;Ask Aktualisierungsdienst;c:\program files\AskPartnerNetwork\Toolbar\apnmcp.exe [2013-10-23 166352]
S2 avnetflt;avnetflt;c:\windows\system32\DRIVERS\avnetflt.sys [2013-10-31 67680]
S2 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2013-09-27 104768]
S2 Radio.fx;Radio.fx Server;c:\program files\Tobit Radio.fx\Server\rfx-server.exe [2011-11-18 3673944]
S3 BlackBerry Device Manager;BlackBerry Device Manager;c:\program files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe [2013-09-09 585728]
S3 FSCSLII;FSCSLII;c:\windows\system32\DRIVERS\FSCSLII.sys [2009-05-18 16384]
S3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\NisSrv.exe [2013-10-23 280288]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile	REG_MULTI_SZ   	wcescomm rapimgr
LocalServiceRestricted	REG_MULTI_SZ   	WcesComm RapiMgr
.
Inhalt des "geplante Tasks" Ordners
.
2013-11-27 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-16 08:15]
.
2013-11-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-07-21 12:43]
.
2013-11-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-07-21 12:43]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
mStart Page = hxxp://aartemis.com/?type=hp&ts=1385378153&from=cor&uid=HitachiXHTS545016B9A300_090904PB5B01QCC9SXXGX
IE: Mit Mipony herunterladen - file://c:\program files\MiPony\Browser\IEContext.htm
TCP: DhcpNameServer = 10.4.59.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
AddRemove-AutocompletePro3_is1 - c:\program files\AutocompletePro\unins000.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\program files\Microsoft Security Client\MsMpEng.exe
c:\windows\system32\nvvsvc.exe
c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\Nero\Nero BackItUp 4\NBService.exe
c:\program files\Fujitsu\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe
c:\windows\system32\taskhost.exe
c:\program files\Microsoft Mouse and Keyboard Center\itype.exe
c:\program files\Microsoft Mouse and Keyboard Center\ipoint.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\windows\servicing\TrustedInstaller.exe
c:\windows\system32\conhost.exe
c:\program files\Synaptics\SynTP\SynTPHelper.exe
c:\windows\system32\sppsvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\Microsoft Security Client\MpCmdRun.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2013-11-27  16:37:18 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2013-11-27 15:37
.
Vor Suchlauf: 10 Verzeichnis(se), 16.614.002.688 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 16.309.784.576 Bytes frei
.
- - End Of File - - F9F329427682B6061C7CFFAAB7014EA0
A36C5E4F47E84449FF07ED3517B43A31
Gruß Marc
__________________
Alt 28.11.2013, 10:09   #4
schrauber
/// the machine
/// TB-Ausbilder
 
wie entferne ich unter Windows 7 Postbankrojaner ? - Standard

wie entferne ich unter Windows 7 Postbankrojaner ?


Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 28.11.2013, 21:32   #5
Marc11
 
wie entferne ich unter Windows 7 Postbankrojaner ? - Standard

wie entferne ich unter Windows 7 Postbankrojaner ?


Hi Schrauber!!
Danke! das war bis hier mal echt hilfreich!! Habe einiges gefunden und entfernen können!!
Setzte jetzt mal die LOG´s ein dann kannst Du sehen was so passiert ist.
Dein Hilfe ist echt cool!


FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 24-11-2013
Ran by Eule (administrator) on Eule-PC on 28-11-2013 20:15:35
Running from C:\Users\Eule\Desktop
Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(APN LLC.) C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Nero AG) C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
() C:\Program Files\Tobit Radio.fx\Server\rfx-server.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Fujitsu Technology Solutions) C:\Program Files\Fujitsu\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe
(Inventec Corp.) C:\Program Files\Fujitsu\Wireless_Utility\Wireless Selector.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Research In Motion Limited) C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
(Fujitsu Technology Solutions) C:\Program Files\Fujitsu\DeskViewBasic\DeskViewBasicService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdcBase.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Macrovision Corporation) C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe
(Research In Motion Limited) C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1545512 2009-07-20] (Synaptics Incorporated)
HKLM\...\Run: [DeskViewBasic] - C:\Program Files\Fujitsu\DeskViewBasic\DeskViewBasic.exe [182784 2009-08-19] (Fujitsu Technology Solutions)
HKLM\...\Run: [Wireless_Selector] - C:\Program Files\Fujitsu\Wireless_Utility\Wireless Selector.exe [327680 2009-05-14] (Inventec Corp.)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7514656 2009-05-22] (Realtek Semiconductor)
HKLM\...\Run: [NvCplDaemon] - RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [RIMBBLaunchAgent.exe] - C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe [443408 2013-09-09] (Research In Motion Limited)
HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [948440 2013-10-23] (Microsoft Corporation)
HKLM\...\Run: [BCSSync] - C:\Program Files\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [Windows Mobile-based device management] - C:\Windows\WindowsMobile\wmdcBase.exe [648072 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [683576 2013-10-31] (Avira Operations GmbH & Co. KG)
HKCU\...\Run: [ISUSPM] - C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe [218032 2006-09-11] (Macrovision Corporation)
HKCU\...\Run: [GoogleDriveSync] - C:\Program Files\Google\Drive\googledrivesync.exe [20133824 2013-09-25] (Google)
BootExecute: autocheck autochk * sdnclean.exe

==================== Internet (Whitelisted) ====================

ProxyServer: :0
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
SearchScopes: HKLM - DefaultScope value is missing.
BHO: No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Eule\AppData\Roaming\Mozilla\Firefox\Profiles\zh7u3f8r.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @RIM.com/WebSLLauncher,version=1.0 - C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: toolbar_AVIRA-V7 - C:\Users\Eule\AppData\Roaming\Mozilla\Firefox\Profiles\zh7u3f8r.default\Extensions\toolbar_AVIRA-V7@apn.ask.com.xpi

Chrome: 
=======
CHR HomePage: hxxp://www.spiegel.de/
CHR DefaultSearchURL: (Google) - {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR HKLM\...\Chrome\Extension: [aaaaacalgebmfelllfiaoknifldpngjh] - C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\CRX\ToolbarCR.crx

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440376 2013-10-31] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440376 2013-10-31] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe [1164360 2013-10-31] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2013-10-23] (APN LLC.)
R3 BlackBerry Device Manager; C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe [585728 2013-09-09] (Research In Motion Limited)
R2 DeskViewBasicService; C:\Program Files\Fujitsu\DeskViewBasic\DeskViewBasicService.exe [34816 2009-08-19] (Fujitsu Technology Solutions)
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [22208 2013-10-23] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [280288 2013-10-23] (Microsoft Corporation)
R2 Radio.fx; C:\Program Files\Tobit Radio.fx\Server\rfx-server.exe [3673944 2011-11-18] ()
R2 TestHandler; C:\Program Files\Fujitsu\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe [341264 2009-02-19] (Fujitsu Technology Solutions)
S2 RoxLiveShare9; "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe" [x]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-10-31] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [137208 2013-10-31] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-31] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [67680 2013-10-31] (Avira Operations GmbH & Co. KG)
S3 BthAvrcp; C:\Windows\System32\DRIVERS\BthAvrcp.sys [22528 2009-08-13] (CSR, plc)
S3 DTVFW; C:\Windows\System32\DRIVERS\dtvfw.sys [22016 2005-05-12] (LITE-ON)
R3 FSCSLII; C:\Windows\System32\DRIVERS\FSCSLII.sys [16384 2009-05-18] (Fujitsu)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [214696 2013-09-27] (Microsoft Corporation)
S3 rimvndis; C:\Windows\System32\Drivers\rimvndis6.sys [14336 2013-08-15] (Research in Motion Limited)
S3 s0016bus; C:\Windows\System32\DRIVERS\s0016bus.sys [89256 2008-05-16] (MCCI Corporation)
S3 s0016mdfl; C:\Windows\System32\DRIVERS\s0016mdfl.sys [15016 2008-05-16] (MCCI Corporation)
S3 s0016mdm; C:\Windows\System32\DRIVERS\s0016mdm.sys [120744 2008-05-16] (MCCI Corporation)
S3 s0016mgmt; C:\Windows\System32\DRIVERS\s0016mgmt.sys [114216 2008-05-16] (MCCI Corporation)
S3 s0016nd5; C:\Windows\System32\DRIVERS\s0016nd5.sys [25512 2008-05-16] (MCCI Corporation)
S3 s0016obex; C:\Windows\System32\DRIVERS\s0016obex.sys [110632 2008-05-16] (MCCI Corporation)
S3 s0016unic; C:\Windows\System32\DRIVERS\s0016unic.sys [115752 2008-05-16] (MCCI Corporation)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-10-31] (Avira GmbH)
S3 usbdtv; C:\Windows\System32\Drivers\usbdtv.sys [31232 2005-06-07] (LITE-ON)
S3 usbrndis6; C:\Windows\System32\DRIVERS\usb80236.sys [15872 2013-02-12] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Eule\AppData\Local\Temp\catchme.sys [x]
S3 pccsmcfd; system32\DRIVERS\pccsmcfd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-11-28 20:10 - 2013-11-28 20:10 - 00000625 _____ C:\Users\Eule\Desktop\JRT.txt
2013-11-28 19:52 - 2013-11-28 19:57 - 00000000 ____D C:\AdwCleaner
2013-11-28 19:51 - 2013-11-28 19:51 - 01091882 _____ C:\Users\Eule\Desktop\adwcleaner.exe
2013-11-28 10:30 - 2013-11-28 10:30 - 00000000 ____D C:\Windows\ERUNT
2013-11-28 10:22 - 2013-11-28 10:22 - 01034531 _____ (Thisisu) C:\Users\Eule\Desktop\JRT.exe
2013-11-28 08:51 - 2013-11-28 08:51 - 00000000 ____D C:\Users\Eule\AppData\Roaming\Malwarebytes
2013-11-28 08:50 - 2013-11-28 08:50 - 00001073 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-11-28 08:50 - 2013-11-28 08:50 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-28 08:50 - 2013-11-28 08:50 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-11-28 08:50 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-11-28 08:49 - 2013-11-28 08:49 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Eule\Desktop\mbam-setup-1.75.0.1300.exe
2013-11-27 16:37 - 2013-11-27 16:37 - 00020494 _____ C:\ComboFix.txt
2013-11-27 16:28 - 2013-11-28 20:00 - 00000280 _____ C:\Windows\setupact.log
2013-11-27 16:28 - 2013-11-28 11:35 - 00001100 _____ C:\Windows\PFRO.log
2013-11-27 16:28 - 2013-11-27 16:28 - 00000000 _____ C:\Windows\setuperr.log
2013-11-27 16:15 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2013-11-27 16:15 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2013-11-27 16:15 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-11-27 16:15 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-11-27 16:15 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-11-27 16:15 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2013-11-27 16:15 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2013-11-27 16:15 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2013-11-27 14:43 - 2013-11-27 16:37 - 00000000 ____D C:\Qoobox
2013-11-27 14:43 - 2013-11-27 16:34 - 00000000 ____D C:\Windows\erdnt
2013-11-27 14:42 - 2013-11-27 14:42 - 05150163 ____R (Swearware) C:\Users\Eule\Desktop\ComboFix.exe
2013-11-25 14:08 - 2013-11-25 14:08 - 00016580 _____ C:\Users\Eule\Desktop\Gmer.txt
2013-11-25 13:39 - 2013-11-25 13:39 - 00377856 _____ C:\Users\Eule\Desktop\gmer_2.1.19163.exe
2013-11-25 13:04 - 2013-11-25 13:04 - 00022703 _____ C:\Users\Eule\Desktop\FRS.txt
2013-11-25 12:58 - 2013-11-25 12:59 - 00022703 _____ C:\Users\Eule\Desktop\Addition.txt
2013-11-25 12:56 - 2013-11-28 20:15 - 00010929 _____ C:\Users\Eule\Desktop\FRST.txt
2013-11-25 12:56 - 2013-11-25 12:56 - 00000000 ____D C:\FRST
2013-11-25 12:55 - 2013-11-25 12:55 - 01091583 _____ (Farbar) C:\Users\Eule\Desktop\FRST.exe
2013-11-22 12:49 - 2013-11-22 12:49 - 00000000 ____D C:\Users\Eule\AppData\Roaming\Avira
2013-11-22 12:48 - 2013-11-22 12:48 - 00000000 ____D C:\ProgramData\AskPartnerNetwork
2013-11-22 12:48 - 2013-11-22 12:48 - 00000000 ____D C:\Program Files\AskPartnerNetwork
2013-11-22 12:46 - 2013-11-22 12:46 - 00002018 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-11-22 12:46 - 2013-10-31 19:25 - 00137208 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-11-22 12:46 - 2013-10-31 19:25 - 00090400 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-11-22 12:46 - 2013-10-31 19:25 - 00067680 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-11-22 12:46 - 2013-10-31 19:25 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-11-22 12:46 - 2013-10-31 19:25 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
2013-11-22 12:45 - 2013-11-22 12:45 - 00000000 ____D C:\ProgramData\Avira
2013-11-22 12:45 - 2013-11-22 12:45 - 00000000 ____D C:\Program Files\Avira
2013-11-22 12:39 - 2013-11-22 12:44 - 126764512 _____ C:\Users\Eule\Desktop\avira_free_antivirus_de.exe
2013-11-22 12:14 - 2013-11-22 12:40 - 00000000 ____D C:\Users\Eule\AppData\Roaming\Nico Mak Computing
2013-11-22 12:13 - 2013-11-22 12:13 - 04892480 _____ (WinZip International LLC                                    ) C:\Users\Eule\Desktop\wzmp_8.exe
2013-11-22 12:02 - 2013-11-22 12:02 - 02209056 _____ C:\Users\Eule\Downloads\avira-eu-cleaner_de.exe
2013-11-22 12:01 - 2013-11-22 12:01 - 00002033 _____ C:\Users\Eule\Desktop\Entfernen des Avira EU-Cleaners.lnk
2013-11-22 12:01 - 2013-11-22 12:01 - 00001977 _____ C:\Users\Eule\Desktop\Avira EU-Cleaner.lnk
2013-11-21 23:32 - 2013-11-21 23:32 - 00000000 ____D C:\Users\Eule\AppData\Roaming\Research In Motion
2013-11-21 23:30 - 2013-11-21 23:30 - 00002195 _____ C:\Users\Public\Desktop\BlackBerry Desktop Software.lnk
2013-11-20 14:14 - 2013-11-20 14:14 - 17142784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 11220992 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 04240384 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-20 14:14 - 2013-11-20 14:14 - 02166272 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 01926656 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-11-20 14:14 - 2013-11-20 14:14 - 01818112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 01156608 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 01051136 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00703488 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00645120 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-11-20 14:14 - 2013-11-20 14:14 - 00610304 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00553472 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00523776 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-11-20 14:14 - 2013-11-20 14:14 - 00244736 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00238288 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00233472 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00208896 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00208384 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00182272 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00151552 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00127488 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00083456 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-11-20 14:14 - 2013-11-20 14:14 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-11-20 12:29 - 2013-11-27 09:54 - 00000000 ____D C:\Program Files\7-Zip
2013-11-18 11:26 - 2013-11-21 14:39 - 00000000 ____D C:\Windows\rescache
2013-11-14 10:51 - 2013-11-14 13:43 - 03865088 _____ C:\Users\Eule\Desktop\Präsentation LVR.ppt
2013-11-13 13:26 - 2013-11-13 13:26 - 00083456 _____ C:\Users\Eule\Documents\Zeitstrahl Pro 4.ppt
2013-11-13 12:36 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll
2013-11-13 12:36 - 2013-10-04 02:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2013-11-13 12:36 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll
2013-11-13 12:36 - 2013-09-25 03:01 - 00136640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-11-13 12:36 - 2013-09-25 03:01 - 00067520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2013-11-13 12:36 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-11-13 12:36 - 2013-09-25 02:57 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2013-11-13 12:36 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2013-11-13 12:36 - 2013-09-25 02:56 - 01038848 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-11-13 12:36 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2013-11-13 12:36 - 2013-09-25 01:49 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2013-11-13 12:36 - 2013-09-25 01:49 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2013-11-13 12:36 - 2013-07-04 13:16 - 00369848 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-11-13 12:35 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2013-11-13 12:35 - 2013-10-12 03:01 - 00679424 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2013-11-13 12:35 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2013-11-13 12:35 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-11-13 12:35 - 2013-10-03 02:58 - 00305152 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll

==================== One Month Modified Files and Folders =======

2013-11-28 20:16 - 2013-11-25 12:56 - 00010929 _____ C:\Users\Eule\Desktop\FRST.txt
2013-11-28 20:10 - 2013-11-28 20:10 - 00000625 _____ C:\Users\Eule\Desktop\JRT.txt
2013-11-28 20:08 - 2009-07-14 05:34 - 00009712 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-28 20:08 - 2009-07-14 05:34 - 00009712 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-28 20:05 - 2009-11-07 01:18 - 01267355 _____ C:\Windows\WindowsUpdate.log
2013-11-28 20:00 - 2013-11-27 16:28 - 00000280 _____ C:\Windows\setupact.log
2013-11-28 20:00 - 2013-04-12 18:12 - 00000000 ___RD C:\Users\Eule\Google Drive
2013-11-28 20:00 - 2011-07-21 13:43 - 00001092 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-28 20:00 - 2009-07-14 05:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-28 19:58 - 2011-07-21 13:43 - 00001096 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-28 19:57 - 2013-11-28 19:52 - 00000000 ____D C:\AdwCleaner
2013-11-28 19:57 - 2009-11-06 16:36 - 00001154 _____ C:\Users\Eule\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-11-28 19:51 - 2013-11-28 19:51 - 01091882 _____ C:\Users\Eule\Desktop\adwcleaner.exe
2013-11-28 12:00 - 2012-04-16 12:02 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-28 11:35 - 2013-11-27 16:28 - 00001100 _____ C:\Windows\PFRO.log
2013-11-28 11:35 - 2009-11-30 23:12 - 00000000 ____D C:\Windows\Minidump
2013-11-28 10:30 - 2013-11-28 10:30 - 00000000 ____D C:\Windows\ERUNT
2013-11-28 10:22 - 2013-11-28 10:22 - 01034531 _____ (Thisisu) C:\Users\Eule\Desktop\JRT.exe
2013-11-28 08:51 - 2013-11-28 08:51 - 00000000 ____D C:\Users\Eule\AppData\Roaming\Malwarebytes
2013-11-28 08:50 - 2013-11-28 08:50 - 00001073 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-11-28 08:50 - 2013-11-28 08:50 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-28 08:50 - 2013-11-28 08:50 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-11-28 08:49 - 2013-11-28 08:49 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Eule\Desktop\mbam-setup-1.75.0.1300.exe
2013-11-27 16:37 - 2013-11-27 16:37 - 00020494 _____ C:\ComboFix.txt
2013-11-27 16:37 - 2013-11-27 14:43 - 00000000 ____D C:\Qoobox
2013-11-27 16:37 - 2009-07-14 03:37 - 00000000 ___RD C:\Users\Public
2013-11-27 16:36 - 2009-08-21 07:35 - 01507340 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-27 16:34 - 2013-11-27 14:43 - 00000000 ____D C:\Windows\erdnt
2013-11-27 16:30 - 2009-07-14 03:04 - 00000215 _____ C:\Windows\system.ini
2013-11-27 16:28 - 2013-11-27 16:28 - 00000000 _____ C:\Windows\setuperr.log
2013-11-27 14:42 - 2013-11-27 14:42 - 05150163 ____R (Swearware) C:\Users\Eule\Desktop\ComboFix.exe
2013-11-27 14:17 - 2009-08-07 14:43 - 00000000 ____D C:\Windows\Panther
2013-11-27 14:13 - 2013-05-27 07:45 - 00000000 ____D C:\Program Files\File Type Assistant
2013-11-27 09:54 - 2013-11-20 12:29 - 00000000 ____D C:\Program Files\7-Zip
2013-11-25 14:08 - 2013-11-25 14:08 - 00016580 _____ C:\Users\Eule\Desktop\Gmer.txt
2013-11-25 13:39 - 2013-11-25 13:39 - 00377856 _____ C:\Users\Eule\Desktop\gmer_2.1.19163.exe
2013-11-25 13:04 - 2013-11-25 13:04 - 00022703 _____ C:\Users\Eule\Desktop\FRS.txt
2013-11-25 12:59 - 2013-11-25 12:58 - 00022703 _____ C:\Users\Eule\Desktop\Addition.txt
2013-11-25 12:56 - 2013-11-25 12:56 - 00000000 ____D C:\FRST
2013-11-25 12:55 - 2013-11-25 12:55 - 01091583 _____ (Farbar) C:\Users\Eule\Desktop\FRST.exe
2013-11-22 12:49 - 2013-11-22 12:49 - 00000000 ____D C:\Users\Eule\AppData\Roaming\Avira
2013-11-22 12:48 - 2013-11-22 12:48 - 00000000 ____D C:\ProgramData\AskPartnerNetwork
2013-11-22 12:48 - 2013-11-22 12:48 - 00000000 ____D C:\Program Files\AskPartnerNetwork
2013-11-22 12:46 - 2013-11-22 12:46 - 00002018 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-11-22 12:45 - 2013-11-22 12:45 - 00000000 ____D C:\ProgramData\Avira
2013-11-22 12:45 - 2013-11-22 12:45 - 00000000 ____D C:\Program Files\Avira
2013-11-22 12:44 - 2013-11-22 12:39 - 126764512 _____ C:\Users\Eule\Desktop\avira_free_antivirus_de.exe
2013-11-22 12:40 - 2013-11-22 12:14 - 00000000 ____D C:\Users\Eule\AppData\Roaming\Nico Mak Computing
2013-11-22 12:13 - 2013-11-22 12:13 - 04892480 _____ (WinZip International LLC                                    ) C:\Users\Eule\Desktop\wzmp_8.exe
2013-11-22 12:02 - 2013-11-22 12:02 - 02209056 _____ C:\Users\Eule\Downloads\avira-eu-cleaner_de.exe
2013-11-22 12:01 - 2013-11-22 12:01 - 00002033 _____ C:\Users\Eule\Desktop\Entfernen des Avira EU-Cleaners.lnk
2013-11-22 12:01 - 2013-11-22 12:01 - 00001977 _____ C:\Users\Eule\Desktop\Avira EU-Cleaner.lnk
2013-11-21 23:43 - 2011-06-10 07:55 - 00008624 _____ C:\Users\Eule\AppData\Roaming\Rim.DesktopHelper.Exception.log
2013-11-21 23:43 - 2010-08-18 11:35 - 00054772 _____ C:\Users\Eule\AppData\Roaming\Rim.Desktop.Exception.log
2013-11-21 23:32 - 2013-11-21 23:32 - 00000000 ____D C:\Users\Eule\AppData\Roaming\Research In Motion
2013-11-21 23:32 - 2010-12-22 12:19 - 00000000 ____D C:\Users\Eule\AppData\Local\Research In Motion
2013-11-21 23:31 - 2010-08-18 11:22 - 00021897 _____ C:\Users\Eule\AppData\Roaming\Rim.Desktop.HttpServerSetup.log
2013-11-21 23:30 - 2013-11-21 23:30 - 00002195 _____ C:\Users\Public\Desktop\BlackBerry Desktop Software.lnk
2013-11-21 23:30 - 2012-08-02 08:36 - 00000000 ____D C:\ProgramData\Research In Motion
2013-11-21 23:30 - 2012-02-15 15:42 - 00000000 ____D C:\Program Files\Common Files\XCPCSync.OEM
2013-11-21 23:29 - 2010-08-15 13:48 - 00000000 ____D C:\Program Files\Research In Motion
2013-11-21 23:29 - 2010-08-15 13:48 - 00000000 ____D C:\Program Files\Common Files\Research In Motion
2013-11-21 23:15 - 2012-02-15 15:46 - 00014476 _____ C:\Users\Eule\AppData\Roaming\Rim.Transcoder.Exception.log
2013-11-21 22:34 - 2011-09-11 12:56 - 00000000 ____D C:\Users\Eule\AppData\Local\Downloaded Installations
2013-11-21 14:39 - 2013-11-18 11:26 - 00000000 ____D C:\Windows\rescache
2013-11-20 14:19 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\system32\de-DE
2013-11-20 14:18 - 2011-02-08 19:58 - 00001912 _____ C:\Windows\epplauncher.mif
2013-11-20 14:17 - 2011-02-08 19:56 - 00000000 ____D C:\Program Files\Microsoft Security Client
2013-11-20 14:14 - 2013-11-20 14:14 - 17142784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 11220992 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 04240384 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-20 14:14 - 2013-11-20 14:14 - 02166272 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 01926656 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-11-20 14:14 - 2013-11-20 14:14 - 01818112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 01156608 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 01051136 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00703488 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00645120 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-11-20 14:14 - 2013-11-20 14:14 - 00610304 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00553472 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00523776 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-11-20 14:14 - 2013-11-20 14:14 - 00244736 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00238288 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00233472 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00208896 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00208384 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00182272 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00151552 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00127488 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00083456 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-11-20 14:14 - 2013-11-20 14:14 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-11-20 11:56 - 2013-04-29 12:49 - 00000000 ____D C:\Users\Eule\Documents\DDPB
2013-11-19 11:21 - 2009-11-06 17:07 - 00230048 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2013-11-14 13:43 - 2013-11-14 10:51 - 03865088 _____ C:\Users\Eule\Desktop\Präsentation LVR.ppt
2013-11-14 11:20 - 2012-02-27 11:22 - 00023552 _____ C:\Users\Eule\Documents\Codes für alles.xls
2013-11-14 09:15 - 2012-04-16 12:02 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-11-14 09:15 - 2011-06-28 07:00 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-11-14 09:15 - 2009-11-06 16:35 - 00000000 ____D C:\Users\Eule\AppData\Local\Adobe
2013-11-13 13:47 - 2009-08-21 07:31 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-11-13 13:45 - 2010-11-16 08:53 - 00000000 ____D C:\Windows\WindowsMobile
2013-11-13 13:41 - 2013-07-19 08:43 - 00000000 ____D C:\Windows\system32\MRT
2013-11-13 13:38 - 2009-11-26 09:21 - 80340640 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-11-13 13:26 - 2013-11-13 13:26 - 00083456 _____ C:\Users\Eule\Documents\Zeitstrahl Pro 4.ppt
2013-11-13 12:38 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-11-12 16:08 - 2009-07-14 03:04 - 00000499 _____ C:\Windows\win.ini
2013-11-12 11:14 - 2011-03-09 10:20 - 00000000 ____D C:\Users\Eule\Desktop\Privat
2013-11-05 08:49 - 2013-04-15 09:17 - 00000000 ____D C:\Users\Eule\Desktop\BUT
2013-10-31 19:25 - 2013-11-22 12:46 - 00137208 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-10-31 19:25 - 2013-11-22 12:46 - 00090400 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-10-31 19:25 - 2013-11-22 12:46 - 00067680 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-10-31 19:25 - 2013-11-22 12:46 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-10-31 19:25 - 2013-11-22 12:46 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
2013-10-30 11:07 - 2013-04-08 10:59 - 00000000 _____ C:\Users\Eule\Documents\RIMPTG

Some content of TEMP:
====================
C:\Users\Eule\AppData\Local\temp\avgnt.exe
C:\Users\Eule\AppData\Local\temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-11-20 10:54

==================== End Of Log ============================
--- --- ---


und auch noch JRT
Code:
ATTFilter
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.8 (11.05.2013:1)
OS: Windows 7 Professional x86
Ran by Grahl on 28.11.2013 at 21:08:13,11
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 28.11.2013 at 21:12:02,96
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
und auch noch

Code:
ATTFilter
# AdwCleaner v3.013 - Bericht erstellt am 28/11/2013 um 19:56:58
# Updated 24/11/2013 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (32 bits)
# Benutzername : Eule - Eule-PC
# Gestartet von : C:\Users\Eule\Desktop\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Users\Eule\Documents\PC Speed Maximizer
Ordner Gelöscht : C:\Users\Eule\AppData\Roaming\Mozilla\Firefox\Profiles\zh7u3f8r.default\Extensions\support@predictad.com

***** [ Verknüpfungen ] *****

Verknüpfung Desinfiziert : C:\Users\Eule\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
Verknüpfung Desinfiziert : C:\Users\Eule\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk
Verknüpfung Desinfiziert : C:\Users\Eule\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
Verknüpfung Desinfiziert : C:\Users\Eule\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk

***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\defdhglnppeioeflggkmglipcecffkhk
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{43E054FD-A8C0-4DBC-BAA6-652BCA52C633}
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{43E054FD-A8C0-4DBC-BAA6-652BCA52C633}
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{1E236167-7D16-4050-B19F-12017F591295}
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1E236167-7D16-4050-B19F-12017F591295}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{442F13BC-2031-42D5-9520-437F65271153}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{0FB6A909-6086-458F-BD92-1F8EE10042A0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C9AE652B-8C99-4AC2-B556-8B501182874E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{01BCB858-2F62-4F06-A8F4-48F927C15333}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0FB6A909-6086-458F-BD92-1F8EE10042A0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{0FB6A909-6086-458F-BD92-1F8EE10042A0}
Schlüssel Gelöscht : HKLM\Software\aartemisSoftware
Schlüssel Gelöscht : HKLM\Software\Uniblue
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FF2AEFF45EEA0A48A4B33C1973B6094
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.16428


-\\ Mozilla Firefox v

[ Datei : C:\Users\Eule\AppData\Roaming\Mozilla\Firefox\Profiles\zh7u3f8r.default\prefs.js ]


-\\ Google Chrome v

[ Datei : C:\Users\Eule\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [3665 octets] - [28/11/2013 19:53:27]
AdwCleaner[S0].txt - [3202 octets] - [28/11/2013 19:56:58]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [3262 octets] ##########
Brauchst Du noch mehr?
Habe ich alles entfernen können?
Finde deine Hilfe echt großartig!
LG Marc


Alt 29.11.2013, 15:42   #6
schrauber
/// the machine
/// TB-Ausbilder
 
wie entferne ich unter Windows 7 Postbankrojaner ? - Standard

wie entferne ich unter Windows 7 Postbankrojaner ?



ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?
__________________
--> wie entferne ich unter Windows 7 Postbankrojaner ?

Alt 01.12.2013, 12:51   #7
Marc11
 
wie entferne ich unter Windows 7 Postbankrojaner ? - Standard

wie entferne ich unter Windows 7 Postbankrojaner ?


Hallo Schrauber!
Habe gestern nacht den Eset durchlaufen lassen. Hat ewig gedauert und heute morgen war der Rechner runtergefahren. Das Log war ohne Befund, leider finde ich es nicht wieder.
Das FRST Log ist hier:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 01-12-2013
Ran by Eule (administrator) on Eule-PC on 01-12-2013 12:35:26
Running from C:\Users\Eule\Desktop
Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Inventec Corp.) C:\Program Files\Fujitsu\Wireless_Utility\Wireless Selector.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Research In Motion Limited) C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdcBase.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Macrovision Corporation) C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
(APN LLC.) C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Nero AG) C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
() C:\Program Files\Tobit Radio.fx\Server\rfx-server.exe
(Fujitsu Technology Solutions) C:\Program Files\Fujitsu\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe
(Fujitsu Technology Solutions) C:\Program Files\Fujitsu\DeskViewBasic\DeskViewBasicService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe
(Research In Motion Limited) C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1545512 2009-07-20] (Synaptics Incorporated)
HKLM\...\Run: [DeskViewBasic] - C:\Program Files\Fujitsu\DeskViewBasic\DeskViewBasic.exe [182784 2009-08-19] (Fujitsu Technology Solutions)
HKLM\...\Run: [Wireless_Selector] - C:\Program Files\Fujitsu\Wireless_Utility\Wireless Selector.exe [327680 2009-05-14] (Inventec Corp.)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7514656 2009-05-22] (Realtek Semiconductor)
HKLM\...\Run: [NvCplDaemon] - RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [RIMBBLaunchAgent.exe] - C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe [443408 2013-09-09] (Research In Motion Limited)
HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [948440 2013-10-23] (Microsoft Corporation)
HKLM\...\Run: [BCSSync] - C:\Program Files\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [Windows Mobile-based device management] - C:\Windows\WindowsMobile\wmdcBase.exe [648072 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [683576 2013-10-31] (Avira Operations GmbH & Co. KG)
HKCU\...\Run: [ISUSPM] - C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe [218032 2006-09-11] (Macrovision Corporation)
HKCU\...\Run: [GoogleDriveSync] - C:\Program Files\Google\Drive\googledrivesync.exe [20133824 2013-09-25] (Google)
BootExecute: autocheck autochk * sdnclean.exe

==================== Internet (Whitelisted) ====================

ProxyServer: :0
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
SearchScopes: HKLM - DefaultScope value is missing.
BHO: No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Eule\AppData\Roaming\Mozilla\Firefox\Profiles\zh7u3f8r.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @RIM.com/WebSLLauncher,version=1.0 - C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: toolbar_AVIRA-V7 - C:\Users\Eule\AppData\Roaming\Mozilla\Firefox\Profiles\zh7u3f8r.default\Extensions\toolbar_AVIRA-V7@apn.ask.com.xpi

Chrome: 
=======
CHR HomePage: hxxp://www.spiegel.de/
CHR DefaultSearchURL: (Google) - {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR HKLM\...\Chrome\Extension: [aaaaacalgebmfelllfiaoknifldpngjh] - C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\CRX\ToolbarCR.crx

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440376 2013-10-31] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440376 2013-10-31] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe [1164360 2013-10-31] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2013-10-23] (APN LLC.)
R3 BlackBerry Device Manager; C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe [585728 2013-09-09] (Research In Motion Limited)
R2 DeskViewBasicService; C:\Program Files\Fujitsu\DeskViewBasic\DeskViewBasicService.exe [34816 2009-08-19] (Fujitsu Technology Solutions)
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [22208 2013-10-23] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [280288 2013-10-23] (Microsoft Corporation)
R2 Radio.fx; C:\Program Files\Tobit Radio.fx\Server\rfx-server.exe [3673944 2011-11-18] ()
R2 TestHandler; C:\Program Files\Fujitsu\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe [341264 2009-02-19] (Fujitsu Technology Solutions)
S2 RoxLiveShare9; "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe" [x]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-10-31] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [137208 2013-10-31] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-31] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [67680 2013-10-31] (Avira Operations GmbH & Co. KG)
S3 BthAvrcp; C:\Windows\System32\DRIVERS\BthAvrcp.sys [22528 2009-08-13] (CSR, plc)
S3 DTVFW; C:\Windows\System32\DRIVERS\dtvfw.sys [22016 2005-05-12] (LITE-ON)
R3 FSCSLII; C:\Windows\System32\DRIVERS\FSCSLII.sys [16384 2009-05-18] (Fujitsu)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [214696 2013-09-27] (Microsoft Corporation)
S3 rimvndis; C:\Windows\System32\Drivers\rimvndis6.sys [14336 2013-08-15] (Research in Motion Limited)
S3 s0016bus; C:\Windows\System32\DRIVERS\s0016bus.sys [89256 2008-05-16] (MCCI Corporation)
S3 s0016mdfl; C:\Windows\System32\DRIVERS\s0016mdfl.sys [15016 2008-05-16] (MCCI Corporation)
S3 s0016mdm; C:\Windows\System32\DRIVERS\s0016mdm.sys [120744 2008-05-16] (MCCI Corporation)
S3 s0016mgmt; C:\Windows\System32\DRIVERS\s0016mgmt.sys [114216 2008-05-16] (MCCI Corporation)
S3 s0016nd5; C:\Windows\System32\DRIVERS\s0016nd5.sys [25512 2008-05-16] (MCCI Corporation)
S3 s0016obex; C:\Windows\System32\DRIVERS\s0016obex.sys [110632 2008-05-16] (MCCI Corporation)
S3 s0016unic; C:\Windows\System32\DRIVERS\s0016unic.sys [115752 2008-05-16] (MCCI Corporation)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-10-31] (Avira GmbH)
S3 usbdtv; C:\Windows\System32\Drivers\usbdtv.sys [31232 2005-06-07] (LITE-ON)
S3 usbrndis6; C:\Windows\System32\DRIVERS\usb80236.sys [15872 2013-02-12] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Eule\AppData\Local\Temp\catchme.sys [x]
S3 pccsmcfd; system32\DRIVERS\pccsmcfd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-12-01 12:35 - 2013-12-01 12:35 - 00011075 _____ C:\Users\Eule\Desktop\FRST.txt
2013-12-01 12:34 - 2013-12-01 12:34 - 01092187 _____ (Farbar) C:\Users\Eule\Desktop\FRST.exe
2013-12-01 12:09 - 2013-12-01 12:09 - 00891184 _____ C:\Users\Eule\Desktop\SecurityCheck.exe
2013-11-30 18:46 - 2013-11-30 18:46 - 00000000 ____D C:\Program Files\ESET
2013-11-30 18:45 - 2013-11-30 18:45 - 02347384 _____ (ESET) C:\Users\Eule\Desktop\esetsmartinstaller_enu.exe
2013-11-29 08:00 - 2013-12-01 12:32 - 00000000 ____D C:\Users\Eule\Desktop\Maleware
2013-11-28 19:52 - 2013-11-28 20:25 - 00000000 ____D C:\AdwCleaner
2013-11-28 10:30 - 2013-11-28 10:30 - 00000000 ____D C:\Windows\ERUNT
2013-11-28 08:51 - 2013-11-28 08:51 - 00000000 ____D C:\Users\Eule\AppData\Roaming\Malwarebytes
2013-11-28 08:50 - 2013-11-28 08:50 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-28 08:50 - 2013-11-28 08:50 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-11-28 08:50 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-11-28 08:49 - 2013-11-28 08:49 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Eule\Desktop\mbam-setup-1.75.0.1300.exe
2013-11-27 16:37 - 2013-11-27 16:37 - 00020494 _____ C:\ComboFix.txt
2013-11-27 16:28 - 2013-11-30 18:41 - 00000448 _____ C:\Windows\setupact.log
2013-11-27 16:28 - 2013-11-28 11:35 - 00001100 _____ C:\Windows\PFRO.log
2013-11-27 16:28 - 2013-11-27 16:28 - 00000000 _____ C:\Windows\setuperr.log
2013-11-27 16:15 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2013-11-27 16:15 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2013-11-27 16:15 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-11-27 16:15 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-11-27 16:15 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-11-27 16:15 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2013-11-27 16:15 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2013-11-27 16:15 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2013-11-27 14:43 - 2013-11-27 16:37 - 00000000 ____D C:\Qoobox
2013-11-27 14:43 - 2013-11-27 16:34 - 00000000 ____D C:\Windows\erdnt
2013-11-27 14:42 - 2013-11-27 14:42 - 05150163 ____R (Swearware) C:\Users\Eule\Desktop\ComboFix.exe
2013-11-25 12:56 - 2013-11-25 12:56 - 00000000 ____D C:\FRST
2013-11-22 12:49 - 2013-11-22 12:49 - 00000000 ____D C:\Users\Eule\AppData\Roaming\Avira
2013-11-22 12:48 - 2013-11-22 12:48 - 00000000 ____D C:\ProgramData\AskPartnerNetwork
2013-11-22 12:48 - 2013-11-22 12:48 - 00000000 ____D C:\Program Files\AskPartnerNetwork
2013-11-22 12:46 - 2013-10-31 19:25 - 00137208 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-11-22 12:46 - 2013-10-31 19:25 - 00090400 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-11-22 12:46 - 2013-10-31 19:25 - 00067680 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-11-22 12:46 - 2013-10-31 19:25 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-11-22 12:46 - 2013-10-31 19:25 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
2013-11-22 12:45 - 2013-11-22 12:45 - 00000000 ____D C:\ProgramData\Avira
2013-11-22 12:45 - 2013-11-22 12:45 - 00000000 ____D C:\Program Files\Avira
2013-11-22 12:14 - 2013-11-22 12:40 - 00000000 ____D C:\Users\Eule\AppData\Roaming\Nico Mak Computing
2013-11-22 12:02 - 2013-11-22 12:02 - 02209056 _____ C:\Users\Eule\Downloads\avira-eu-cleaner_de.exe
2013-11-21 23:32 - 2013-11-21 23:32 - 00000000 ____D C:\Users\Eule\AppData\Roaming\Research In Motion
2013-11-21 23:30 - 2013-11-21 23:30 - 00002195 _____ C:\Users\Public\Desktop\BlackBerry Desktop Software.lnk
2013-11-20 14:14 - 2013-11-20 14:14 - 17142784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 11220992 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 04240384 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-20 14:14 - 2013-11-20 14:14 - 02166272 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 01926656 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-11-20 14:14 - 2013-11-20 14:14 - 01818112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 01156608 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 01051136 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00703488 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00645120 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-11-20 14:14 - 2013-11-20 14:14 - 00610304 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00553472 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00523776 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-11-20 14:14 - 2013-11-20 14:14 - 00244736 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00238288 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00233472 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00208896 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00208384 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00182272 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00151552 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00127488 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00083456 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-11-20 14:14 - 2013-11-20 14:14 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-11-20 12:29 - 2013-11-27 09:54 - 00000000 ____D C:\Program Files\7-Zip
2013-11-18 11:26 - 2013-11-21 14:39 - 00000000 ____D C:\Windows\rescache
2013-11-14 10:51 - 2013-11-14 13:43 - 03865088 _____ C:\Users\Eule\Desktop\Präsentation LVR.ppt
2013-11-13 13:26 - 2013-11-13 13:26 - 00083456 _____ C:\Users\Eule\Documents\Zeitstrahl Pro 4.ppt
2013-11-13 12:36 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll
2013-11-13 12:36 - 2013-10-04 02:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2013-11-13 12:36 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll
2013-11-13 12:36 - 2013-09-25 03:01 - 00136640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-11-13 12:36 - 2013-09-25 03:01 - 00067520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2013-11-13 12:36 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-11-13 12:36 - 2013-09-25 02:57 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2013-11-13 12:36 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2013-11-13 12:36 - 2013-09-25 02:56 - 01038848 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-11-13 12:36 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2013-11-13 12:36 - 2013-09-25 01:49 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2013-11-13 12:36 - 2013-09-25 01:49 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2013-11-13 12:36 - 2013-07-04 13:16 - 00369848 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-11-13 12:35 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2013-11-13 12:35 - 2013-10-12 03:01 - 00679424 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2013-11-13 12:35 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2013-11-13 12:35 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-11-13 12:35 - 2013-10-03 02:58 - 00305152 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll

==================== One Month Modified Files and Folders =======

2013-12-01 12:35 - 2013-12-01 12:35 - 00011075 _____ C:\Users\Eule\Desktop\FRST.txt
2013-12-01 12:34 - 2013-12-01 12:34 - 01092187 _____ (Farbar) C:\Users\Eule\Desktop\FRST.exe
2013-12-01 12:32 - 2013-11-29 08:00 - 00000000 ____D C:\Users\Eule\Desktop\Maleware
2013-12-01 12:10 - 2009-11-07 01:18 - 01387929 _____ C:\Windows\WindowsUpdate.log
2013-12-01 12:09 - 2013-12-01 12:09 - 00891184 _____ C:\Users\Eule\Desktop\SecurityCheck.exe
2013-12-01 12:07 - 2011-07-21 13:43 - 00001096 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-12-01 12:07 - 2011-07-21 13:43 - 00001092 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-12-01 12:06 - 2012-04-16 12:02 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-30 18:50 - 2009-07-14 05:34 - 00009712 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-30 18:50 - 2009-07-14 05:34 - 00009712 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-30 18:46 - 2013-11-30 18:46 - 00000000 ____D C:\Program Files\ESET
2013-11-30 18:45 - 2013-11-30 18:45 - 02347384 _____ (ESET) C:\Users\Eule\Desktop\esetsmartinstaller_enu.exe
2013-11-30 18:43 - 2013-04-12 18:12 - 00000000 ___RD C:\Users\Eule\Google Drive
2013-11-30 18:41 - 2013-11-27 16:28 - 00000448 _____ C:\Windows\setupact.log
2013-11-30 18:41 - 2009-07-14 05:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-29 14:46 - 2011-06-10 07:55 - 00008701 _____ C:\Users\Eule\AppData\Roaming\Rim.DesktopHelper.Exception.log
2013-11-29 14:46 - 2010-08-18 11:35 - 00054926 _____ C:\Users\Eule\AppData\Roaming\Rim.Desktop.Exception.log
2013-11-29 13:02 - 2009-08-21 07:35 - 01507340 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-28 20:25 - 2013-11-28 19:52 - 00000000 ____D C:\AdwCleaner
2013-11-28 19:57 - 2009-11-06 16:36 - 00001154 _____ C:\Users\Eule\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-11-28 11:35 - 2013-11-27 16:28 - 00001100 _____ C:\Windows\PFRO.log
2013-11-28 11:35 - 2009-11-30 23:12 - 00000000 ____D C:\Windows\Minidump
2013-11-28 10:30 - 2013-11-28 10:30 - 00000000 ____D C:\Windows\ERUNT
2013-11-28 08:51 - 2013-11-28 08:51 - 00000000 ____D C:\Users\Eule\AppData\Roaming\Malwarebytes
2013-11-28 08:50 - 2013-11-28 08:50 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-28 08:50 - 2013-11-28 08:50 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-11-28 08:49 - 2013-11-28 08:49 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Eule\Desktop\mbam-setup-1.75.0.1300.exe
2013-11-27 16:37 - 2013-11-27 16:37 - 00020494 _____ C:\ComboFix.txt
2013-11-27 16:37 - 2013-11-27 14:43 - 00000000 ____D C:\Qoobox
2013-11-27 16:37 - 2009-07-14 03:37 - 00000000 ___RD C:\Users\Public
2013-11-27 16:34 - 2013-11-27 14:43 - 00000000 ____D C:\Windows\erdnt
2013-11-27 16:30 - 2009-07-14 03:04 - 00000215 _____ C:\Windows\system.ini
2013-11-27 16:28 - 2013-11-27 16:28 - 00000000 _____ C:\Windows\setuperr.log
2013-11-27 14:42 - 2013-11-27 14:42 - 05150163 ____R (Swearware) C:\Users\Eule\Desktop\ComboFix.exe
2013-11-27 14:17 - 2009-08-07 14:43 - 00000000 ____D C:\Windows\Panther
2013-11-27 14:13 - 2013-05-27 07:45 - 00000000 ____D C:\Program Files\File Type Assistant
2013-11-27 09:54 - 2013-11-20 12:29 - 00000000 ____D C:\Program Files\7-Zip
2013-11-25 12:56 - 2013-11-25 12:56 - 00000000 ____D C:\FRST
2013-11-22 12:49 - 2013-11-22 12:49 - 00000000 ____D C:\Users\Eule\AppData\Roaming\Avira
2013-11-22 12:48 - 2013-11-22 12:48 - 00000000 ____D C:\ProgramData\AskPartnerNetwork
2013-11-22 12:48 - 2013-11-22 12:48 - 00000000 ____D C:\Program Files\AskPartnerNetwork
2013-11-22 12:45 - 2013-11-22 12:45 - 00000000 ____D C:\ProgramData\Avira
2013-11-22 12:45 - 2013-11-22 12:45 - 00000000 ____D C:\Program Files\Avira
2013-11-22 12:40 - 2013-11-22 12:14 - 00000000 ____D C:\Users\Eule\AppData\Roaming\Nico Mak Computing
2013-11-22 12:02 - 2013-11-22 12:02 - 02209056 _____ C:\Users\Eule\Downloads\avira-eu-cleaner_de.exe
2013-11-21 23:32 - 2013-11-21 23:32 - 00000000 ____D C:\Users\Eule\AppData\Roaming\Research In Motion
2013-11-21 23:32 - 2010-12-22 12:19 - 00000000 ____D C:\Users\Eule\AppData\Local\Research In Motion
2013-11-21 23:31 - 2010-08-18 11:22 - 00021897 _____ C:\Users\Eule\AppData\Roaming\Rim.Desktop.HttpServerSetup.log
2013-11-21 23:30 - 2013-11-21 23:30 - 00002195 _____ C:\Users\Public\Desktop\BlackBerry Desktop Software.lnk
2013-11-21 23:30 - 2012-08-02 08:36 - 00000000 ____D C:\ProgramData\Research In Motion
2013-11-21 23:30 - 2012-02-15 15:42 - 00000000 ____D C:\Program Files\Common Files\XCPCSync.OEM
2013-11-21 23:29 - 2010-08-15 13:48 - 00000000 ____D C:\Program Files\Research In Motion
2013-11-21 23:29 - 2010-08-15 13:48 - 00000000 ____D C:\Program Files\Common Files\Research In Motion
2013-11-21 23:15 - 2012-02-15 15:46 - 00014476 _____ C:\Users\Eule\AppData\Roaming\Rim.Transcoder.Exception.log
2013-11-21 22:34 - 2011-09-11 12:56 - 00000000 ____D C:\Users\Eule\AppData\Local\Downloaded Installations
2013-11-21 14:39 - 2013-11-18 11:26 - 00000000 ____D C:\Windows\rescache
2013-11-20 14:19 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\system32\de-DE
2013-11-20 14:18 - 2011-02-08 19:58 - 00001912 _____ C:\Windows\epplauncher.mif
2013-11-20 14:17 - 2011-02-08 19:56 - 00000000 ____D C:\Program Files\Microsoft Security Client
2013-11-20 14:14 - 2013-11-20 14:14 - 17142784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 11220992 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 04240384 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-20 14:14 - 2013-11-20 14:14 - 02166272 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 01926656 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-11-20 14:14 - 2013-11-20 14:14 - 01818112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 01156608 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 01051136 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00703488 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00645120 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-11-20 14:14 - 2013-11-20 14:14 - 00610304 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00553472 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00523776 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-11-20 14:14 - 2013-11-20 14:14 - 00244736 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00238288 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00233472 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00208896 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00208384 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00182272 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00151552 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00127488 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00083456 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-11-20 14:14 - 2013-11-20 14:14 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-11-20 14:14 - 2013-11-20 14:14 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-11-20 14:14 - 2013-11-20 14:14 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-11-20 11:56 - 2013-04-29 12:49 - 00000000 ____D C:\Users\Eule\Documents\DDPB
2013-11-19 11:21 - 2009-11-06 17:07 - 00230048 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2013-11-14 13:43 - 2013-11-14 10:51 - 03865088 _____ C:\Users\Eule\Desktop\Präsentation LVR.ppt
2013-11-14 11:20 - 2012-02-27 11:22 - 00023552 _____ C:\Users\Eule\Documents\Codes für alles.xls
2013-11-14 09:15 - 2012-04-16 12:02 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-11-14 09:15 - 2011-06-28 07:00 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-11-14 09:15 - 2009-11-06 16:35 - 00000000 ____D C:\Users\Eule\AppData\Local\Adobe
2013-11-13 13:47 - 2009-08-21 07:31 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-11-13 13:45 - 2010-11-16 08:53 - 00000000 ____D C:\Windows\WindowsMobile
2013-11-13 13:41 - 2013-07-19 08:43 - 00000000 ____D C:\Windows\system32\MRT
2013-11-13 13:38 - 2009-11-26 09:21 - 80340640 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-11-13 13:26 - 2013-11-13 13:26 - 00083456 _____ C:\Users\Eule\Documents\Zeitstrahl Pro 4.ppt
2013-11-13 12:38 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-11-12 16:08 - 2009-07-14 03:04 - 00000499 _____ C:\Windows\win.ini
2013-11-12 11:14 - 2011-03-09 10:20 - 00000000 ____D C:\Users\Eule\Desktop\Privat
2013-11-05 08:49 - 2013-04-15 09:17 - 00000000 ____D C:\Users\Eule\Desktop\BUT

Some content of TEMP:
====================
C:\Users\Eule\AppData\Local\temp\avgnt.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-11-30 23:51

==================== End Of Log ============================
--- --- ---


und das security check log auch noch
Code:
ATTFilter
 Results of screen317's Security Check version 0.99.76  
 Windows 7 Service Pack 1 x86 (UAC is enabled)  
 Internet Explorer 10  
``````````````Antivirus/Firewall Check:`````````````` 
Microsoft Security Essentials   
Avira Desktop                   
 Antivirus up to date!  (On Access scanning disabled!) 
`````````Anti-malware/Other Utilities Check:````````` 
 Malwarebytes Anti-Malware Version 1.75.0.1300  
 TuneUp Utilities Language Pack (de-DE) 
 CCleaner     
 Java(TM) 6 Update 25  
 Java version out of Date! 
 Adobe Flash Player 	11.9.900.117  
 Adobe Reader XI  
````````Process Check: objlist.exe by Laurent````````  
 Microsoft Security Essentials MSMpEng.exe 
 Microsoft Security Essentials msseces.exe 
 Avira Antivir avgnt.exe 
 Avira Antivir avguard.exe 
 Malwarebytes' Anti-Malware mbamscheduler.exe   
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````

Keine Probleme mehr!
Kann ich meinen Rechner wieder für das Onlinebanking gebrauchen?
Lieben Gruß Marc

Alt 02.12.2013, 10:21   #8
schrauber
/// the machine
/// TB-Ausbilder
 
wie entferne ich unter Windows 7 Postbankrojaner ? - Standard

wie entferne ich unter Windows 7 Postbankrojaner ?


Java updaten.

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
ATTFilter
ProxyServer: :0

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.



Alle Zugänge und Passwörter ändern.


Fertig

Die Reihenfolge ist hier entscheidend.
  1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
  2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
    • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
    • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
    • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
  3. Downloade Dir bitte auf jeden Fall DelFix Download DelFix auf deinen Desktop:
    • Schließe alle offenen Programme.
    • Starte die delfix.exe mit einem Doppelklick.
    • Setze vor jede Funktion ein Häkchen.
    • Klicke auf Start.
    • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
    • Starte deinen Rechner abschließend neu.
  4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.


Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
  • Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
  • Windows Updates
    • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
    • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
  • Gehe sicher das die automatischen Updates aktiviert sind.
  • Software Updates
    Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
    Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.


Anti- Viren Software
  • Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.


Zusätzlicher Schutz
  • MalwareBytes Anti Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
    Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.
  • WinPatrol
    Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.


Sicheres Browsen
  • SpywareBlaster
    Eine kurze Einführung findest du Hier
  • MVPs hosts file
    Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
  • WOT (Web of trust)
    Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.


Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
  • Opera
  • Mozilla Firefox.
    • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
    • NoScript
      Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    • AdblockPlus
      Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
      Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts
  • Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
  • verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe
Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 02.12.2013, 11:33   #9
Marc11
 
wie entferne ich unter Windows 7 Postbankrojaner ? - Standard

wie entferne ich unter Windows 7 Postbankrojaner ?


Hi Schrauber !
Hier das Log von Fix:
Code:
ATTFilter
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 01-12-2013
Ran by Eule at 2013-12-02 11:31:44 Run:1
Running from C:\Users\Eule\Desktop
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
ProxyServer: :0
*****************

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => Value deleted successfully.

==== End of Fixlog ====

Alt 02.12.2013, 11:56   #10
schrauber
/// the machine
/// TB-Ausbilder
 
wie entferne ich unter Windows 7 Postbankrojaner ? - Standard

wie entferne ich unter Windows 7 Postbankrojaner ?


fertig
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 19.12.2013, 12:41   #11
Marc11
 
wie entferne ich unter Windows 7 Postbankrojaner ? - Standard

wie entferne ich unter Windows 7 Postbankrojaner ?


Hallo Schrauber!
Möchte mich bei Dir nochmal für die Hilfe bedanken. War in den letzten Wochen auf Fortbildung und sw. daher erst jetzt. Mein Rechner ist dank deiner Hilfe komplett frei von allen Schädlingen. Ohne dich hätte ich das nicht hinbekommen.

Wünsche Dir ein froher Fest und ein gutes Jahr 2014!

Gruß Marc

Alt 20.12.2013, 09:21   #12
schrauber
/// the machine
/// TB-Ausbilder
 
wie entferne ich unter Windows 7 Postbankrojaner ? - Standard

wie entferne ich unter Windows 7 Postbankrojaner ?


Gern Geschehen
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Antwort

Themen zu wie entferne ich unter Windows 7 Postbankrojaner ?
adobe, antivir, antivirus, avira, avira searchfree toolbar, computer, continue, defender, device driver, entfernen, error, fehler, flash player, homepage, icreinstall, mozilla, nicht installiert, ntdll.dll, plug-in, postbanktrojaner windows7, programm, realtek, registry, richtlinie, rundll, security, server, services.exe, svchost.exe, system, taskhost.exe, trojaner, usb, warnung, windows


« Win 7 - Firefox - ständig neue Popups | Windows-Sicherheitscenter war deaktiviert - nun kann ich Windows-Defender nicht mehr starten »


Ähnliche Themen: wie entferne ich unter Windows 7 Postbankrojaner ?


  1. Windows Defender findet Trojaner ,entferne ich sie funktionieren meine Browser nicht mehr
    Log-Analyse und Auswertung - 07.10.2015 (7)
  2. Wie entferne ich "Script.Adware.DealPly.G (Engine B)" unter Windows7?
    Log-Analyse und Auswertung - 06.10.2015 (20)
  3. Begrenzte Internetverbindung unter Windows 10; keinerlei Probleme unter Ubuntu
    Netzwerk und Hardware - 05.09.2015 (13)
  4. Windows 7: wie entferne ich Profiler.gen.ac und Win32/Matsnu.L?
    Plagegeister aller Art und deren Bekämpfung - 06.02.2015 (35)
  5. Wie entferne ich tlb search von mozilla firefox, betriebssystem windows xp???
    Plagegeister aller Art und deren Bekämpfung - 23.09.2014 (12)
  6. Windows 7 : Wie entferne ich Do-Search?
    Log-Analyse und Auswertung - 19.12.2013 (35)
  7. Wie entferne ich Win32.Downloader.gen ? (Windows 7)
    Plagegeister aller Art und deren Bekämpfung - 05.10.2013 (9)
  8. Windows XP - Wie entferne ich Browser Updater\TBUpdater.dll?
    Log-Analyse und Auswertung - 17.09.2013 (19)
  9. Windows 8, 64 Bit: Wie entferne ich LyricsContainer, snap do u.a. müll & Falschmeldungen?
    Log-Analyse und Auswertung - 06.09.2013 (7)
  10. Wie entferne ich auf Windows 7 im abgesicherten Modus einen "BKA Trojaner"
    Log-Analyse und Auswertung - 01.08.2013 (5)
  11. C:\Windows\system32\d3dx9_37.dll ist entweder nicht für die Ausführung unter Windows vorgesehen oder enthält einen Fehler.
    Alles rund um Windows - 23.03.2013 (3)
  12. Windows Firewall unter Windows 8 nicht mehr aktivierbar
    Alles rund um Windows - 28.01.2013 (5)
  13. Wie entferne ich Windows Vista 32bit
    Alles rund um Windows - 17.07.2012 (6)
  14. Erwischt: Windows Verschlüsselungstrojaner unter Windows XP via E-Mail
    Log-Analyse und Auswertung - 17.06.2012 (11)
  15. Windows-Verschlüsselungs-Trojaner unter Windows 7 auf einem MAC
    Log-Analyse und Auswertung - 14.06.2012 (3)
  16. Windows Verschlüsselungs Trojaner wie entferne ich ?
    Plagegeister aller Art und deren Bekämpfung - 01.06.2012 (3)
  17. Ständiges WINDOWS SECURITY ALERT: Wie entferne ich diesen Trojaner? Logfile vorhanden
    Plagegeister aller Art und deren Bekämpfung - 01.08.2008 (7)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema wie entferne ich unter Windows 7 Postbankrojaner ? - Hallo! Ich habe mir einen Trojaner der Postbank eingefangen. Habe die folgenden Logs gemacht. Was kann / muss ich tun, um diesen Trojaner wieder los zu werden. Habe in den - wie entferne ich unter Windows 7 Postbankrojaner ?...
Archiv
Du betrachtest: wie entferne ich unter Windows 7 Postbankrojaner ? auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130