| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Hilfe Cryptlocker 300,-€ Variante - Datei zu groß oder beschädigt!Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
08.12.2013, 23:54
| #1 |
| |  Hilfe Cryptlocker 300,-€ Variante - Datei zu groß oder beschädigt! Hallo Zusammen, Zuerst, ich (weiblich) gehöre zur Kategorie " Cryptlocker für Dummies". Fakt ist: 1sten: hab ich keine Ahnung wie ich an meine Dateien komme und welcher Wurm??, Virus?? das ist und 2tens .. (jetzt bitte keine schlauen Ratschläge über Sicherheitskopien. ich ärger mich schon genug) ich keine Backups habe und auch die vorgängerversionen (rechtsklick)... von Windows nicht funktionieren. Die Dateiennamen sind die gleichen auch unter Eigenschaften ist nichts erkennbar. Sie heißen immernoch z.b Img_1222.jpg usw. Hab auch Decrypthelper 0.5.3 runtergeladen. Wenn ich aber den "Schlüssel" angebe und dann das "Original" kommt die Nachricht, die Dateien sind unterschiedlich groß. Wenn ich die verschlüsselte Datei öffne kommt "Datei zu groß oder beschädigt! " Kennt sich damit jemand aus? Vielleicht wichtig; Ich hab mir Cryptlocker schon Ende Okt eingefangen. Hab mit Kaspersky und Malwarebytes Anti-Malware gescannt und die Funde entfernt. Ansonsten weiss ich echt nicht mehr weiter. Wenn ich den Schleppy neuinstallieren muss kann es sein das trotz formatierung in der Registry noch was hängenbleibt? Und zu guter letzt welchen Virenschutz würdet ihr mir empfehlen-  schonmal im Voraus das ihr euch zeit nimmt. |
|
08.12.2013, 23:58
| #2 | ||
| /// Winkelfunktion /// TB-Süch-Tiger™   | Hilfe Cryptlocker 300,-€ Variante - Datei zu groß oder beschädigt! Hallo und
__________________ http://www.trojaner-board.de/144615-...entfernen.html Zitat:
Zitat:
Scan mit Farbar's Recovery Scan Tool (FRST) Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ |
|
09.12.2013, 00:14
| #3 |
| | Hilfe Cryptlocker 300,-€ Variante - Datei zu groß oder beschädigt! FRST.txt
__________________FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 08-12-2013 03
Ran by Toshiba (administrator) on TOSHIBA-TOSH on 09-12-2013 00:09:08
Running from C:\Users\Toshiba\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Infowatch) C:\Program Files (x86)\Common Files\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TecoService.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe
(Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe
(Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\Teco.exe
(Toshiba Europe GmbH) C:\Program Files\TOSHIBA\Registration\ToshibaReminder.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(Microsoft) C:\Users\Toshiba\keazeet.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(TOSHIBA CORPORATION.) C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe
(Nero AG) C:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe
(Dropbox, Inc.) C:\Users\Toshiba\AppData\Roaming\Dropbox\bin\Dropbox.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
() C:\Users\Toshiba\Downloads\ZipOpenerSetup.exe
(Setup © ) C:\Users\Toshiba\AppData\Local\Temp\is357113909\26668753_stp\MetaCrawlerSetup.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(MyPCBackup.com) C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2052392 2010-03-10] (Synaptics Incorporated)
HKLM\...\Run: [SmartFaceVWatcher] - C:\Program Files\TOSHIBA\SmartFaceV\SmartFaceVWatcher.exe [238080 2009-10-19] (TOSHIBA Corporation)
HKLM\...\Run: [TosSENotify] - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [709976 2010-02-05] (TOSHIBA Corporation)
HKLM\...\Run: [TosReelTimeMonitor] - C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe [35672 2010-03-03] (TOSHIBA Corporation)
HKLM\...\Run: [TosNC] - C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe [595816 2010-03-09] (TOSHIBA Corporation)
HKLM\...\Run: [Toshiba TEMPRO] - C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe [1050072 2010-02-11] (Toshiba Europe GmbH)
HKLM\...\Run: [SmartAudio] - C:\Program Files\CONEXANT\SAII\SAIICpl.exe [307768 2009-11-19] ()
HKLM\...\Run: [cAudioFilterAgent] - C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe [520760 2010-03-10] (Conexant Systems, Inc.)
HKLM\...\Run: [TPwrMain] - C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe [505696 2009-11-05] (TOSHIBA Corporation)
HKLM\...\Run: [HSON] - C:\Program Files\TOSHIBA\TBS\HSON.exe [52600 2009-03-09] (TOSHIBA Corporation)
HKLM\...\Run: [SmoothView] - C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe [570680 2009-08-13] (TOSHIBA Corporation)
HKLM\...\Run: [00TCrdMain] - C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [913720 2010-03-03] (TOSHIBA Corporation)
HKLM\...\Run: [Teco] - C:\Program Files\TOSHIBA\TECO\Teco.exe [1489760 2010-03-17] (TOSHIBA Corporation)
HKLM\...\Run: [TosWaitSrv] - C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [705368 2010-02-23] (TOSHIBA Corporation)
HKLM\...\Run: [TosVolRegulator] - C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation)
HKLM\...\Run: [Toshiba Registration] - C:\Program Files\TOSHIBA\Registration\ToshibaReminder.exe [136136 2010-02-12] (Toshiba Europe GmbH)
HKLM\...\Run: [Trend Micro Client Framework] - "C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe"
HKCU\...\Run: [AdobeBridge] - [x]
HKCU\...\Run: [EPLTarget\P0000000000000000] - C:\Windows\System32\spool\drivers\x64\3\E_IATIILE.EXE [283232 2012-02-28] (SEIKO EPSON CORPORATION)
HKCU\...\Run: [Hewlett-Packard] - C:\Users\Toshiba\AppData\Roaming\ivhijrjj\bcstcwvr.exe
HKCU\...\Run: [RESTART_STICKY_NOTES] - C:\Windows\System32\StikyNot.exe [427520 2009-07-14] (Microsoft Corporation)
HKCU\...\Run: [keazeet] - C:\Users\Toshiba\keazeet.exe [81920 2013-12-08] (Microsoft)
HKCU\...409d6c4515e9\InprocServer32: [Default-shell32] C:\$Recycle.Bin\S-1-5-21-567861899-1677700898-3115183993-1000\$09ad7540ea48d56e3827574d5de1208b\n. ATTENTION! ====> ZeroAccess?
MountPoints2: {357531bb-063e-11e2-acb9-806e6f6e6963} - rundll32.exe url,FileProtocolHandler index.html
HKLM-x32\...\Run: [TWebCamera] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe [2454840 2010-02-24] (TOSHIBA CORPORATION.)
HKLM-x32\...\Run: [NBAgent] - C:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe [1086760 2010-03-09] (Nero AG)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-03-15] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [ToshibaServiceStation] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe [1294136 2009-10-06] (TOSHIBA Corporation)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exe [54840 2007-05-08] (Hewlett-Packard)
HKLM-x32\...\Run: [hpqSRMon] - C:\Program Files (x86)\HP\Digital Imaging\bin\HpqSRmon.exe [150528 2008-07-22] (Hewlett-Packard)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [EEventManager] - C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe [1058400 2011-10-31] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [AVP] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\avp.exe [356128 2013-10-16] (Kaspersky Lab ZAO)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKU\Default\...\Run: [TOSHIBA Online Product Information] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\TOPI.exe [4581280 2010-03-03] (TOSHIBA)
HKU\Default User\...\Run: [TOSHIBA Online Product Information] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\TOPI.exe [4581280 2010-03-03] (TOSHIBA)
AppInit_DLLs-x32: c:\progra~3\browse~1\261095~1.52\{c16c1~1\browse~1.dll [ ] ()
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Toshiba\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk
ShortcutTarget: Adobe Gamma.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
Startup: C:\Users\Toshiba\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Toshiba\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Toshiba\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk
ShortcutTarget: MyPC Backup.lnk -> C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe (MyPCBackup.com)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = QVO6
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = QVO6
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = QVO6
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = QVO6
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = QVO6
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe QVO6
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=TOSHIBAXMK5076GSXN_32JMT0L0TXX32JMT0L0T&ts=1382036230&type=default&q={searchTerms}
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=TOSHIBAXMK5076GSXN_32JMT0L0TXX32JMT0L0T&ts=1382036230&type=default&q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=TOSHIBAXMK5076GSXN_32JMT0L0TXX32JMT0L0T&ts=1382036230&type=default&q={searchTerms}
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=TOSHIBAXMK5076GSXN_32JMT0L0TXX32JMT0L0T&ts=1382036230&type=default&q={searchTerms}
SearchScopes: HKCU - DefaultScope {D8A64939-CF98-4BFA-BCEF-35BFF285ED7E} URL = hxxp://search.softonic.com/MOY00621/tb_v1?q={searchTerms}&SearchSource=4&cc=&mi=12bc2fea000000000000e839dfc054e1&r=171
SearchScopes: HKCU - {0C98A004-1293-41D6-B562-1FDF5E5C6CCB} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=U3&apn_dtid=OSJ000YYDE&apn_uid=5D5EBBEE-73A8-4F9F-AD76-954AD58BFF47&apn_sauid=3664C6CA-F136-4C4A-A0C1-F10732BD2B0B
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www.delta-search.com/?q={searchTerms}&affID=119816&babsrc=SP_ss&mntrId=12bc2fea000000000000e839dfc054e1
SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=TOSHIBAXMK5076GSXN_32JMT0L0TXX32JMT0L0T&ts=1382036230&type=default&q={searchTerms}
SearchScopes: HKCU - {5B06887A-7E57-4D0C-878E-6D9157A0C4DC} URL = hxxp://www.amazon.de/gp/search?ie=UTF8&keywords={searchTerms}&tag=tochibade-win7-ie-search-21&index=blended&linkCode=ur2
SearchScopes: HKCU - {D8A64939-CF98-4BFA-BCEF-35BFF285ED7E} URL = hxxp://search.softonic.com/MOY00621/tb_v1?q={searchTerms}&SearchSource=4&cc=&mi=12bc2fea000000000000e839dfc054e1&r=171
SearchScopes: HKCU - {EB4F81E9-ACC4-43DC-A2FA-071C0EA694AE} URL = hxxp://rover.ebay.com/rover/1/707-44556-9400-9/4?satitle={searchTerms}
SearchScopes: HKCU - {F17B1741-2399-482D-8428-42F999AEC8DE} URL =
BHO: TmIEPlugInBHO Class - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20004\2.5.1331\6.8.1094\TmIEPlg.dll No File
BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~1\mcafee\msk\MSKAPB~1.DLL No File
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\EPSON Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: No Name - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\smart web printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.130\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: TmIEPlugInBHO Class - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20004\2.5.1331\6.8.1094\TmIEPlg32.dll No File
BHO-x32: Kaspersky Passsword Manager Toolbar - {215BA832-75A3-426E-A4FC-7C5B58CE6A10} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\Kaspersky Password Manager\spIEBho.dll (Kaspersky Lab)
BHO-x32: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\progra~1\mcafee\msk\mskapbho.dll No File
BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Skype add-on for Internet Explorer - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: Softonic Helper Object - {E87806B5-E908-45FD-AF5E-957D83E58E68} - C:\Program Files (x86)\Softonic\Softonic\1.8.21.14\bh\Softonic.dll (Softonic.com)
BHO-x32: TOSHIBA Media Controller Plug-in - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)
BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\smart web printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\EPSON Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKLM-x32 - Kaspersky Passsword Manager Toolbar - {215BA832-75A3-426E-A4FC-7C5B58CE6A10} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\Kaspersky Password Manager\spIEBho.dll (Kaspersky Lab)
Toolbar: HKLM-x32 - Softonic Toolbar - {5018CFD2-804D-4C99-9F81-25EAEA2769DE} - C:\Program Files (x86)\Softonic\Softonic\1.8.21.14\SoftonicTlbr.dll (Softonic.com)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\2.5.1331\6.8.1094\TmIEPlg.dll No File
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler-x32: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\2.5.1331\6.8.1094\TmIEPlg32.dll No File
Tcpip\Parameters: [DhcpNameServer] 192.168.220.1
FireFox:
========
FF ProfilePath: C:\Users\Toshiba\AppData\Roaming\Mozilla\Firefox\Profiles\jhgeh7qa.default
FF user.js: detected! => C:\Users\Toshiba\AppData\Roaming\Mozilla\Firefox\Profiles\jhgeh7qa.default\user.js
FF DefaultSearchEngine: qvo6
FF SearchEngineOrder.1: Ask.com
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll No File
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.130\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Toshiba\AppData\Roaming\Mozilla\Firefox\Profiles\jhgeh7qa.default\searchplugins\askcom.xml
FF SearchPlugin: C:\Users\Toshiba\AppData\Roaming\Mozilla\Firefox\Profiles\jhgeh7qa.default\searchplugins\delta.xml
FF SearchPlugin: C:\Users\Toshiba\AppData\Roaming\Mozilla\Firefox\Profiles\jhgeh7qa.default\searchplugins\dokotoolbar.xml
FF SearchPlugin: C:\Users\Toshiba\AppData\Roaming\Mozilla\Firefox\Profiles\jhgeh7qa.default\searchplugins\softonic.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\qvo6.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: dokotoolbar.com - C:\Users\Toshiba\AppData\Roaming\Mozilla\Firefox\Profiles\jhgeh7qa.default\Extensions\ffxtlbr@dokotoolbar.com
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF HKLM-x32\...\Firefox\Extensions: - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\FFExt\url_advisor@kaspersky.com
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\FFExt\url_advisor@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\FFExt\virtual_keyboard@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\FFExt\content_blocker@kaspersky.com
FF Extension: Content Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\FFExt\content_blocker@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\FFExt\anti_banner@kaspersky.com
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\FFExt\anti_banner@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\FFExt\online_banking@kaspersky.com
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
Chrome:
=======
CHR HomePage: hxxp://search.softonic.com/MOY00621/tb_v1?SearchSource=48&cc=&mi=12bc2fea000000000000e839dfc054e1
CHR RestoreOnStartup: "hxxp://search.softonic.com/MOY00621/tb_v1?SearchSource=48&cc=&mi=12bc2fea000000000000e839dfc054e1"
CHR DefaultSearchProvider: Search the web (Softonic)
CHR DefaultSearchURL: hxxp://search.softonic.com/MOY00621/tb_v1?q={searchTerms}&SearchSource=49&cc=&mi=12bc2fea000000000000e839dfc054e1
CHR DefaultSuggestURL: "suggest_url": ""
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll No File
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\pdf.dll ()
CHR Plugin: (McAfee SiteAdvisor) - C:\Users\Toshiba\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.60.126.1_0\McChPlg.dll No File
CHR Plugin: (McAfee SiteAdvisor) - C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java Deployment Toolkit 6.0.170.4) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeploytk.dll (Sun Microsystems, Inc.)
CHR Plugin: (Java(TM) Platform SE 6 U17) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll No File
CHR Plugin: (Bing Bar) - C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1399.0\npwinext.dll No File
CHR Plugin: (McAfee Security Scanner +) - C:\Program Files (x86)\McAfee Security Scan\3.0.313\npMcAfeeMss.dll No File
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (Windows Live Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (McAfee SecurityCenter) - c:\progra~2\mcafee\msc\npmcsn~1.dll No File
CHR Extension: (YouTube) - C:\Users\Toshiba\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\Toshiba\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Kaspersky URL Advisor) - C:\Users\Toshiba\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\13.0.2.558_1
CHR Extension: (Softonic Chrome Toolbar) - C:\Users\Toshiba\AppData\Local\Google\Chrome\User Data\Default\Extensions\elchiiiejkobdbblfejjkbphbddgmljf\1.0_0
CHR Extension: (Safe Money) - C:\Users\Toshiba\AppData\Local\Google\Chrome\User Data\Default\Extensions\hakdifolhalapjijoafobooafbilfakh\13.0.2.558_0
CHR Extension: (Content Blocker) - C:\Users\Toshiba\AppData\Local\Google\Chrome\User Data\Default\Extensions\hghkgaeecgjhjkannahfamoehjmkjail\13.0.2.614_1
CHR Extension: (Lightning Newtab) - C:\Users\Toshiba\AppData\Local\Google\Chrome\User Data\Default\Extensions\ifohbjbgfchkkfhphahclmkpgejiplfo\1.1.8.4_0
CHR Extension: (Virtual Keyboard) - C:\Users\Toshiba\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\13.0.2.614_1
CHR Extension: (Google Wallet) - C:\Users\Toshiba\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0
CHR Extension: (Gmail) - C:\Users\Toshiba\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1
CHR Extension: (Anti-Banner) - C:\Users\Toshiba\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\13.0.2.558_0
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\ChromeExt\urladvisor.crx
CHR HKLM-x32\...\Chrome\Extension: [elchiiiejkobdbblfejjkbphbddgmljf] - C:\Program Files (x86)\Softonic\Softonic\1.8.21.14\Softonic.crx
CHR HKLM-x32\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\ChromeExt\online_banking_chrome.crx
CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\ChromeExt\content_blocker_chrome.crx
CHR HKLM-x32\...\Chrome\Extension: [ifohbjbgfchkkfhphahclmkpgejiplfo] - C:\Users\Toshiba\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtab.crx
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\ChromeExt\virtkbd.crx
CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\ChromeExt\ab.crx
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Services (Whitelisted) =================
S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2013-05-22] (Adobe Systems)
S2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\avp.exe [356128 2013-10-16] (Kaspersky Lab ZAO)
S2 BackupStack; C:\Program Files (x86)\MyPC Backup\BackupStack.exe [38440 2013-09-19] (Just Develop It)
R2 CSObjectsSrv; C:\Program Files (x86)\Common Files\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe [819040 2012-12-21] (Infowatch)
R2 EpsonScanSvc; C:\Windows\system32\EscSvc64.exe [135824 2011-12-11] (Seiko Epson Corporation)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [288776 2013-09-06] (McAfee, Inc.)
S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [124368 2010-02-11] (Toshiba Europe GmbH)
S2 McMPFSvc; "C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [x]
S4 syshost32; [x]
==================== Drivers (Whitelisted) ====================
R3 CnxtHdmiAudService; C:\Windows\System32\drivers\CHDMI64.sys [720952 2010-03-05] (Conexant Systems Inc.)
R0 CSCrySec; C:\Windows\System32\DRIVERS\CSCrySec.sys [84536 2011-06-02] (Infowatch)
R1 CSVirtualDiskDrv; C:\Windows\System32\DRIVERS\CSVirtualDiskDrv.sys [66616 2011-06-02] (Infowatch)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [7717984 2013-10-16] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [626272 2013-10-16] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [28504 2012-08-02] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29280 2013-10-16] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-10-16] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [54368 2013-10-16] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178448 2013-10-16] (Kaspersky Lab ZAO)
S0 714b7c7fcbac5335; \SystemRoot\System32\Drivers\714b7c7fcbac5335.sys [x]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
U5 klflt; C:\Windows\System32\Drivers\klflt.sys [90208 2013-10-16] (Kaspersky Lab ZAO)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-12-09 00:09 - 2013-12-09 00:09 - 00033945 _____ C:\Users\Toshiba\Downloads\FRST.txt
2013-12-09 00:09 - 2013-12-09 00:09 - 00000000 ____D C:\FRST
2013-12-09 00:08 - 2013-12-09 00:08 - 01927998 _____ (Farbar) C:\Users\Toshiba\Downloads\FRST64.exe
2013-12-09 00:06 - 2013-12-09 00:06 - 00003120 _____ C:\Windows\System32\Tasks\Advanced System Protector_startup
2013-12-09 00:06 - 2013-12-09 00:06 - 00001206 _____ C:\Users\Public\Desktop\Advanced System Protector.lnk
2013-12-09 00:06 - 2013-12-09 00:06 - 00001092 _____ C:\Users\Toshiba\Desktop\MyPC Backup.lnk
2013-12-09 00:06 - 2013-12-09 00:06 - 00000000 ____D C:\Users\Toshiba\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPC Backup
2013-12-09 00:06 - 2013-12-09 00:06 - 00000000 ____D C:\ProgramData\Systweak
2013-12-09 00:06 - 2013-12-09 00:06 - 00000000 ____D C:\Program Files (x86)\Advanced System Protector
2013-12-09 00:06 - 2012-07-25 12:03 - 00016896 _____ C:\Windows\system32\sasnative64.exe
2013-12-09 00:05 - 2013-12-09 00:05 - 00681424 _____ C:\Users\Toshiba\Downloads\ZipOpenerSetup.exe
2013-12-09 00:05 - 2013-12-09 00:05 - 00003336 _____ C:\Windows\System32\Tasks\Advanced System Protector
2013-12-09 00:05 - 2013-12-09 00:05 - 00003108 _____ C:\Windows\System32\Tasks\RegClean Pro
2013-12-09 00:05 - 2013-12-09 00:05 - 00003042 _____ C:\Windows\System32\Tasks\RegClean Pro_UPDATES
2013-12-09 00:05 - 2013-12-09 00:05 - 00002886 _____ C:\Windows\System32\Tasks\RegClean Pro_DEFAULT
2013-12-09 00:05 - 2013-12-09 00:05 - 00001426 _____ C:\Users\Toshiba\Desktop\Registry kostenlos entrümpeln!.lnk
2013-12-09 00:05 - 2013-12-09 00:05 - 00001115 _____ C:\Users\Public\Desktop\Open It!.lnk
2013-12-09 00:05 - 2013-12-09 00:05 - 00001055 _____ C:\Users\Public\Desktop\RegClean Pro.lnk
2013-12-09 00:05 - 2013-12-09 00:05 - 00000288 _____ C:\Windows\Tasks\RegClean Pro_UPDATES.job
2013-12-09 00:05 - 2013-12-09 00:05 - 00000280 _____ C:\Windows\Tasks\RegClean Pro_DEFAULT.job
2013-12-09 00:05 - 2013-12-09 00:05 - 00000000 ____D C:\Users\Toshiba\AppData\Roaming\0D0S1L2Z1P1B0T1P1B2Z
2013-12-09 00:05 - 2013-12-09 00:05 - 00000000 ____D C:\Program Files (x86)\RegClean Pro
2013-12-09 00:05 - 2013-12-09 00:05 - 00000000 ____D C:\Program Files (x86)\OpenIt
2013-12-09 00:05 - 2013-12-09 00:05 - 00000000 ____D C:\Program Files (x86)\metaCrawler
2013-12-08 23:59 - 2013-12-08 23:59 - 00001663 _____ C:\Users\Public\Desktop\Recuva.lnk
2013-12-08 23:59 - 2013-12-08 23:59 - 00000000 ____D C:\Program Files\Recuva
2013-12-08 23:58 - 2013-12-08 23:58 - 03992416 _____ (Piriform Ltd) C:\Users\Toshiba\Downloads\rcsetup149.exe
2013-12-08 23:23 - 2013-12-08 23:23 - 00062065 _____ C:\Users\Toshiba\Downloads\ransom_file_unlocker.zip
2013-12-08 22:37 - 2013-12-08 22:37 - 00149694 _____ C:\Users\Toshiba\Downloads\DecryptHelper-0.5.3(1).exe
2013-12-08 15:20 - 2013-12-08 15:20 - 00081920 __RSH (Microsoft) C:\Users\Toshiba\keazeet.exe
2013-12-07 18:27 - 2013-12-07 18:28 - 31264872 _____ (DVDVideoSoft Ltd. ) C:\Users\Toshiba\Downloads\FreeMP4VideoConverter-5.0.31.1125.exe
2013-12-04 11:15 - 2013-12-04 11:15 - 00000616 _____ C:\Windows\PFRO.log
2013-12-04 10:29 - 2013-12-04 10:30 - 00009728 _____ C:\Users\Toshiba\Documents\Unbenanntes Dokument.wps
2013-12-03 21:52 - 2013-12-03 21:52 - 00000000 ____D C:\Users\Toshiba\AppData\Roaming\HandBrake
2013-12-03 21:47 - 2013-12-03 21:47 - 00000000 ____D C:\Users\Toshiba\AppData\Roaming\Softonic
2013-12-03 21:47 - 2013-12-03 21:47 - 00000000 ____D C:\Program Files (x86)\Softonic
2013-12-03 21:46 - 2013-12-04 07:41 - 00000000 ____D C:\ProgramData\TuneUp Software
2013-12-03 21:46 - 2013-12-03 21:46 - 00000000 __SHD C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2013-12-03 21:46 - 2013-12-03 21:46 - 00000000 ____D C:\Users\Toshiba\AppData\Roaming\TuneUp Software
2013-12-03 21:45 - 2013-12-03 21:45 - 00001482 _____ C:\Users\Public\Desktop\Free DVD Video Converter.lnk
2013-12-03 21:45 - 2013-12-03 21:45 - 00001244 _____ C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk
2013-12-03 21:44 - 2013-12-03 21:45 - 00000000 ____D C:\Users\Toshiba\AppData\Roaming\DVDVideoSoft
2013-12-03 21:44 - 2013-12-03 21:45 - 00000000 ____D C:\Program Files (x86)\DVDVideoSoft
2013-12-03 21:44 - 2013-12-03 21:44 - 00000000 ____D C:\Users\Toshiba\AppData\Roaming\OpenCandy
2013-12-03 21:36 - 2013-12-03 21:36 - 35588048 _____ (DVDVideoSoft Ltd. ) C:\Users\Toshiba\Downloads\FreeDVDVideoConverter-2.0.15.1125(1).exe
2013-12-03 21:35 - 2013-12-03 21:35 - 35588048 _____ (DVDVideoSoft Ltd. ) C:\Users\Toshiba\Downloads\FreeDVDVideoConverter-2.0.15.1125.exe
2013-11-17 17:11 - 2013-11-17 17:11 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-17 16:58 - 2013-11-17 16:58 - 00001936 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2013-11-15 07:06 - 2013-10-12 09:45 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-15 07:06 - 2013-10-12 09:45 - 01364992 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-15 07:06 - 2013-10-12 09:45 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-15 07:06 - 2013-10-12 09:43 - 19269632 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-15 07:06 - 2013-10-12 09:43 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-15 07:06 - 2013-10-12 09:43 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-15 07:06 - 2013-10-12 09:43 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-15 07:06 - 2013-10-12 09:43 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-15 07:06 - 2013-10-12 09:43 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-15 07:06 - 2013-10-12 09:43 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-15 07:06 - 2013-10-12 09:43 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-15 07:06 - 2013-10-12 09:43 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-15 07:06 - 2013-10-12 09:43 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-15 07:06 - 2013-10-12 09:43 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-15 07:06 - 2013-10-12 08:03 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-15 07:06 - 2013-10-12 08:03 - 01138176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-11-15 07:06 - 2013-10-12 08:02 - 14355968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-15 07:06 - 2013-10-12 08:02 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-15 07:06 - 2013-10-12 08:02 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-15 07:06 - 2013-10-12 08:02 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-15 07:06 - 2013-10-12 08:02 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-11-15 07:06 - 2013-10-12 08:02 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-11-15 07:06 - 2013-10-12 08:02 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-11-15 07:06 - 2013-10-12 08:02 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-11-15 07:06 - 2013-10-12 08:02 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-11-15 07:06 - 2013-10-12 08:02 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-11-15 07:06 - 2013-10-12 08:02 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-11-15 07:06 - 2013-10-12 07:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-15 07:06 - 2013-10-12 07:08 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-11-15 07:06 - 2013-10-12 06:44 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-15 07:06 - 2013-10-12 06:15 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-11-14 06:57 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2013-11-14 06:57 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2013-11-14 06:57 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2013-11-14 06:57 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2013-11-14 06:57 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2013-11-14 06:57 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-11-14 06:57 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-11-14 06:57 - 2013-10-04 03:28 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll
2013-11-14 06:57 - 2013-10-04 03:25 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll
2013-11-14 06:57 - 2013-10-04 03:24 - 01930752 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2013-11-14 06:57 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SmartcardCredentialProvider.dll
2013-11-14 06:57 - 2013-10-04 02:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2013-11-14 06:57 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credui.dll
2013-11-14 06:57 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2013-11-14 06:57 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2013-11-14 06:57 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-11-14 06:57 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-11-14 06:57 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2013-11-14 06:57 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2013-11-14 06:57 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2013-11-14 06:57 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2013-11-14 06:57 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-11-14 06:57 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-11-14 06:57 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2013-11-14 06:57 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2013-11-14 06:57 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-11-14 06:57 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2013-11-14 06:57 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2013-11-14 06:57 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2013-11-14 06:57 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
==================== One Month Modified Files and Folders =======
2013-12-09 00:09 - 2013-12-09 00:09 - 00033945 _____ C:\Users\Toshiba\Downloads\FRST.txt
2013-12-09 00:09 - 2013-12-09 00:09 - 00000000 ____D C:\FRST
2013-12-09 00:08 - 2013-12-09 00:08 - 01927998 _____ (Farbar) C:\Users\Toshiba\Downloads\FRST64.exe
2013-12-09 00:06 - 2013-12-09 00:06 - 00003120 _____ C:\Windows\System32\Tasks\Advanced System Protector_startup
2013-12-09 00:06 - 2013-12-09 00:06 - 00001206 _____ C:\Users\Public\Desktop\Advanced System Protector.lnk
2013-12-09 00:06 - 2013-12-09 00:06 - 00001092 _____ C:\Users\Toshiba\Desktop\MyPC Backup.lnk
2013-12-09 00:06 - 2013-12-09 00:06 - 00000000 ____D C:\Users\Toshiba\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPC Backup
2013-12-09 00:06 - 2013-12-09 00:06 - 00000000 ____D C:\ProgramData\Systweak
2013-12-09 00:06 - 2013-12-09 00:06 - 00000000 ____D C:\Program Files (x86)\Advanced System Protector
2013-12-09 00:06 - 2013-10-17 19:57 - 00000000 ____D C:\Users\Toshiba\AppData\Roaming\Systweak
2013-12-09 00:06 - 2013-10-17 19:57 - 00000000 ____D C:\Program Files (x86)\MyPC Backup
2013-12-09 00:06 - 2012-04-30 09:42 - 00000000 ___RD C:\Users\Toshiba\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-12-09 00:05 - 2013-12-09 00:05 - 00681424 _____ C:\Users\Toshiba\Downloads\ZipOpenerSetup.exe
2013-12-09 00:05 - 2013-12-09 00:05 - 00003336 _____ C:\Windows\System32\Tasks\Advanced System Protector
2013-12-09 00:05 - 2013-12-09 00:05 - 00003108 _____ C:\Windows\System32\Tasks\RegClean Pro
2013-12-09 00:05 - 2013-12-09 00:05 - 00003042 _____ C:\Windows\System32\Tasks\RegClean Pro_UPDATES
2013-12-09 00:05 - 2013-12-09 00:05 - 00002886 _____ C:\Windows\System32\Tasks\RegClean Pro_DEFAULT
2013-12-09 00:05 - 2013-12-09 00:05 - 00001426 _____ C:\Users\Toshiba\Desktop\Registry kostenlos entrümpeln!.lnk
2013-12-09 00:05 - 2013-12-09 00:05 - 00001115 _____ C:\Users\Public\Desktop\Open It!.lnk
2013-12-09 00:05 - 2013-12-09 00:05 - 00001055 _____ C:\Users\Public\Desktop\RegClean Pro.lnk
2013-12-09 00:05 - 2013-12-09 00:05 - 00000288 _____ C:\Windows\Tasks\RegClean Pro_UPDATES.job
2013-12-09 00:05 - 2013-12-09 00:05 - 00000280 _____ C:\Windows\Tasks\RegClean Pro_DEFAULT.job
2013-12-09 00:05 - 2013-12-09 00:05 - 00000000 ____D C:\Users\Toshiba\AppData\Roaming\0D0S1L2Z1P1B0T1P1B2Z
2013-12-09 00:05 - 2013-12-09 00:05 - 00000000 ____D C:\Program Files (x86)\RegClean Pro
2013-12-09 00:05 - 2013-12-09 00:05 - 00000000 ____D C:\Program Files (x86)\OpenIt
2013-12-09 00:05 - 2013-12-09 00:05 - 00000000 ____D C:\Program Files (x86)\metaCrawler
2013-12-09 00:05 - 2012-05-04 20:05 - 00000000 ____D C:\Users\Toshiba\AppData\Roaming\Skype
2013-12-08 23:59 - 2013-12-08 23:59 - 00001663 _____ C:\Users\Public\Desktop\Recuva.lnk
2013-12-08 23:59 - 2013-12-08 23:59 - 00000000 ____D C:\Program Files\Recuva
2013-12-08 23:58 - 2013-12-08 23:58 - 03992416 _____ (Piriform Ltd) C:\Users\Toshiba\Downloads\rcsetup149.exe
2013-12-08 23:57 - 2013-10-17 19:57 - 00000300 _____ C:\Windows\Tasks\DigitalSite.job
2013-12-08 23:28 - 2013-02-07 09:36 - 00001112 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-12-08 23:23 - 2013-12-08 23:23 - 00062065 _____ C:\Users\Toshiba\Downloads\ransom_file_unlocker.zip
2013-12-08 23:22 - 2012-05-04 20:28 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-12-08 23:19 - 2009-07-14 05:45 - 00016080 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-12-08 23:19 - 2009-07-14 05:45 - 00016080 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-12-08 23:15 - 2012-04-30 09:13 - 01355975 _____ C:\Windows\WindowsUpdate.log
2013-12-08 23:13 - 2013-10-16 10:08 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-12-08 22:47 - 2009-07-14 18:58 - 00654166 _____ C:\Windows\system32\perfh007.dat
2013-12-08 22:47 - 2009-07-14 18:58 - 00130006 _____ C:\Windows\system32\perfc007.dat
2013-12-08 22:47 - 2009-07-14 06:13 - 01498506 _____ C:\Windows\system32\PerfStringBackup.INI
2013-12-08 22:37 - 2013-12-08 22:37 - 00149694 _____ C:\Users\Toshiba\Downloads\DecryptHelper-0.5.3(1).exe
2013-12-08 22:37 - 2013-10-16 10:00 - 00000000 _____ C:\Users\Toshiba\Downloads\DecryptHelper.txt
2013-12-08 22:37 - 2013-10-16 10:00 - 00000000 _____ C:\Users\Toshiba\Downloads\DecryptException.txt
2013-12-08 19:34 - 2013-01-15 18:00 - 00000000 ____D C:\Users\Toshiba\Desktop\Ebay
2013-12-08 19:28 - 2013-02-07 09:36 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-12-08 16:41 - 2013-06-07 16:00 - 00000000 ___RD C:\Users\Toshiba\Dropbox
2013-12-08 16:41 - 2013-06-07 15:56 - 00000000 ____D C:\Users\Toshiba\AppData\Roaming\Dropbox
2013-12-08 16:39 - 2013-11-08 10:10 - 00020216 _____ C:\Windows\setupact.log
2013-12-08 16:39 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-12-08 15:20 - 2013-12-08 15:20 - 00081920 __RSH (Microsoft) C:\Users\Toshiba\keazeet.exe
2013-12-08 15:20 - 2012-04-30 09:42 - 00000000 ____D C:\Users\Toshiba
2013-12-08 11:07 - 2013-10-17 20:57 - 00000096 _____ C:\Users\Toshiba\AppData\Roaming\WB.CFG
2013-12-08 11:07 - 2013-10-17 20:57 - 00000006 _____ C:\Users\Toshiba\AppData\Roaming\WBPU-TTL.DAT
2013-12-07 18:28 - 2013-12-07 18:27 - 31264872 _____ (DVDVideoSoft Ltd. ) C:\Users\Toshiba\Downloads\FreeMP4VideoConverter-5.0.31.1125.exe
2013-12-07 08:17 - 2010-04-01 12:00 - 00000000 ____D C:\ProgramData\Adobe
2013-12-07 08:16 - 2010-04-01 12:00 - 00000000 ____D C:\Program Files (x86)\Adobe
2013-12-06 19:50 - 2012-09-27 13:57 - 00000450 _____ C:\Users\Toshiba\AppData\Roaming\wklnhst.dat
2013-12-06 19:50 - 2009-07-14 06:32 - 00000000 ____D C:\Windows\system32\FxsTmp
2013-12-04 19:23 - 2013-02-07 09:36 - 00004108 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-12-04 19:23 - 2013-02-07 09:36 - 00003856 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-12-04 11:15 - 2013-12-04 11:15 - 00000616 _____ C:\Windows\PFRO.log
2013-12-04 10:30 - 2013-12-04 10:29 - 00009728 _____ C:\Users\Toshiba\Documents\Unbenanntes Dokument.wps
2013-12-04 07:41 - 2013-12-03 21:46 - 00000000 ____D C:\ProgramData\TuneUp Software
2013-12-04 07:31 - 2012-05-06 18:12 - 00000000 ____D C:\Users\Toshiba\AppData\Local\Adobe
2013-12-03 21:52 - 2013-12-03 21:52 - 00000000 ____D C:\Users\Toshiba\AppData\Roaming\HandBrake
2013-12-03 21:47 - 2013-12-03 21:47 - 00000000 ____D C:\Users\Toshiba\AppData\Roaming\Softonic
2013-12-03 21:47 - 2013-12-03 21:47 - 00000000 ____D C:\Program Files (x86)\Softonic
2013-12-03 21:46 - 2013-12-03 21:46 - 00000000 __SHD C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2013-12-03 21:46 - 2013-12-03 21:46 - 00000000 ____D C:\Users\Toshiba\AppData\Roaming\TuneUp Software
2013-12-03 21:45 - 2013-12-03 21:45 - 00001482 _____ C:\Users\Public\Desktop\Free DVD Video Converter.lnk
2013-12-03 21:45 - 2013-12-03 21:45 - 00001244 _____ C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk
2013-12-03 21:45 - 2013-12-03 21:44 - 00000000 ____D C:\Users\Toshiba\AppData\Roaming\DVDVideoSoft
2013-12-03 21:45 - 2013-12-03 21:44 - 00000000 ____D C:\Program Files (x86)\DVDVideoSoft
2013-12-03 21:44 - 2013-12-03 21:44 - 00000000 ____D C:\Users\Toshiba\AppData\Roaming\OpenCandy
2013-12-03 21:36 - 2013-12-03 21:36 - 35588048 _____ (DVDVideoSoft Ltd. ) C:\Users\Toshiba\Downloads\FreeDVDVideoConverter-2.0.15.1125(1).exe
2013-12-03 21:35 - 2013-12-03 21:35 - 35588048 _____ (DVDVideoSoft Ltd. ) C:\Users\Toshiba\Downloads\FreeDVDVideoConverter-2.0.15.1125.exe
2013-11-22 15:42 - 2013-10-17 19:57 - 00020312 _____ (Systweak Inc., (www.systweak.com)) C:\Windows\system32\roboot64.exe
2013-11-18 07:58 - 2012-08-01 20:42 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-11-17 18:05 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-11-17 17:11 - 2013-11-17 17:11 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-17 16:58 - 2013-11-17 16:58 - 00001936 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2013-11-17 16:58 - 2013-10-11 20:56 - 00000000 ____D C:\Program Files\McAfee Security Scan
2013-11-15 07:24 - 2010-04-01 11:15 - 00000000 ____D C:\Windows\Panther
2013-11-15 07:06 - 2012-04-30 09:33 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-11-15 07:05 - 2013-10-16 06:48 - 00000000 ____D C:\Windows\system32\MRT
2013-11-15 07:03 - 2012-06-24 16:50 - 82896128 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-11-13 11:55 - 2013-10-16 10:08 - 00000000 ____D C:\Windows\ELAMBKUP
2013-11-09 20:35 - 2013-05-06 16:27 - 00000000 ____D C:\Users\Toshiba\Desktop\T5
ZeroAccess:
C:\$Recycle.Bin\S-1-5-21-567861899-1677700898-3115183993-1000\$09ad7540ea48d56e3827574d5de1208b
ZeroAccess:
C:\$Recycle.Bin\S-1-5-18\$09ad7540ea48d56e3827574d5de1208b
Files to move or delete:
====================
C:\Users\Toshiba\keazeet.exe
Some content of TEMP:
====================
C:\Users\Toshiba\AppData\Local\Temp\54.4210088341639_Update.exe
C:\Users\Toshiba\AppData\Local\Temp\BackupSetup.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
testsigning: ==> Check for possible unsigned rootkit driver <===== ATTENTION!
LastRegBack: 2013-12-03 11:10
==================== End Of Log ============================
--- --- --- FRST Additions Logfile: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 08-12-2013 03
Ran by Toshiba at 2013-12-09 00:09:50
Running from C:\Users\Toshiba\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: McAfee Anti-Virus und Anti-Spyware (Enabled - Up to date) {86355677-4064-3EA7-ABB3-1B136EB04637}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: McAfee Anti-Virus und Anti-Spyware (Enabled - Up to date) {3D54B793-665E-3129-9103-206115370C8A}
FW: McAfee Firewall (Enabled) {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
==================== Installed Programs ======================
Update for Microsoft Office 2007 (KB2508958) (x32)
64 Bit HP CIO Components Installer (Version: 6.2.1)
Adobe AIR (x32 Version: 3.3.0.3670)
Adobe Bridge 1.0 (x32 Version: 001.000.001)
Adobe Common File Installer (x32 Version: 1.00.001)
Adobe Download Assistant (x32 Version: 1.2.1)
Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.117)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.117)
Adobe Help Center 1.0 (x32 Version: 1.0.1)
Adobe Photoshop CS2 (x32 Version: 9.0)
Adobe Reader XI (11.0.05) - Deutsch (x32 Version: 11.0.05)
Adobe Stock Photos 1.0 (x32 Version: 1.0.1)
Advanced System Protector (x32 Version: 2.1.1000.12150)
Advertising Center (x32 Version: 0.0.0.2)
AIO_CDB_Software (x32 Version: 130.0.365.000)
AIO_Scan (x32 Version: 130.0.421.000)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (x32 Version: 1.0.0.26)
ATI Catalyst Install Manager (Version: 3.0.765.0)
Bejeweled 2 Deluxe (x32 Version: 2.2.0.82)
Benutzerhandbuch EPSON XP-205 207 Series (x32)
BufferChm (x32 Version: 130.0.331.000)
Catalyst Control Center - Branding (x32 Version: 1.00.0000)
Catalyst Control Center Core Implementation (x32 Version: 2010.0315.1050.17562)
Catalyst Control Center Graphics Full Existing (x32 Version: 2010.0315.1050.17562)
Catalyst Control Center Graphics Full New (x32 Version: 2010.0315.1050.17562)
Catalyst Control Center Graphics Light (x32 Version: 2010.0315.1050.17562)
Catalyst Control Center Graphics Previews Common (x32 Version: 2010.0315.1050.17562)
Catalyst Control Center Graphics Previews Vista (x32 Version: 2010.0315.1050.17562)
Catalyst Control Center InstallProxy (x32 Version: 2010.0315.1050.17562)
Catalyst Control Center Localization All (x32 Version: 2010.0315.1050.17562)
CCC Help Chinese Standard (x32 Version: 2010.0315.1049.17562)
CCC Help Chinese Traditional (x32 Version: 2010.0315.1049.17562)
CCC Help Czech (x32 Version: 2010.0315.1049.17562)
CCC Help Danish (x32 Version: 2010.0315.1049.17562)
CCC Help Dutch (x32 Version: 2010.0315.1049.17562)
CCC Help English (x32 Version: 2010.0315.1049.17562)
CCC Help Finnish (x32 Version: 2010.0315.1049.17562)
CCC Help French (x32 Version: 2010.0315.1049.17562)
CCC Help German (x32 Version: 2010.0315.1049.17562)
CCC Help Greek (x32 Version: 2010.0315.1049.17562)
CCC Help Hungarian (x32 Version: 2010.0315.1049.17562)
CCC Help Italian (x32 Version: 2010.0315.1049.17562)
CCC Help Japanese (x32 Version: 2010.0315.1049.17562)
CCC Help Korean (x32 Version: 2010.0315.1049.17562)
CCC Help Norwegian (x32 Version: 2010.0315.1049.17562)
CCC Help Polish (x32 Version: 2010.0315.1049.17562)
CCC Help Portuguese (x32 Version: 2010.0315.1049.17562)
CCC Help Russian (x32 Version: 2010.0315.1049.17562)
CCC Help Spanish (x32 Version: 2010.0315.1049.17562)
CCC Help Swedish (x32 Version: 2010.0315.1049.17562)
CCC Help Thai (x32 Version: 2010.0315.1049.17562)
CCC Help Turkish (x32 Version: 2010.0315.1049.17562)
ccc-core-static (x32 Version: 2010.0315.1050.17562)
ccc-utility64 (Version: 2010.0315.1050.17562)
CCleaner (Version: 4.07)
Chuzzle Deluxe (x32 Version: 2.2.0.82)
Compatibility Pack für 2007 Office System (x32 Version: 12.0.6612.1000)
Conexant Audio Driver For AMD HDMI Codec (Version: 4.98.26.0)
Conexant HD Audio (Version: 4.111.0.64)
Copy (x32 Version: 130.0.428.000)
Destinations (x32 Version: 130.0.0.0)
DeviceDiscovery (x32 Version: 130.0.465.000)
Diner Dash 2 Restaurant Rescue (x32 Version: 2.2.0.82)
DocProc (x32 Version: 13.0.0.0)
Dropbox (HKCU Version: 2.0.26)
eBay (x32 Version: 1.1.9)
Epson Connect Printer Setup (x32 Version: 1.1.1)
Epson Easy Photo Print 2 (x32 Version: 2.4.0.0)
Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser) (x32 Version: 1.00.0000)
Epson Event Manager (x32 Version: 3.01.0000)
EPSON Scan (x32)
EPSON XP-205 207 Series Printer Uninstall
EpsonNet Print (x32 Version: 2.6.0)
FATE (x32 Version: 2.2.0.82)
Fax (x32 Version: 130.0.418.000)
Free DVD Video Converter version 2.0.15.1125 (x32 Version: 2.0.15.1125)
Google Chrome (x32 Version: 31.0.1650.63)
Google Earth Plug-in (x32 Version: 7.1.1.1888)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0)
Google Toolbar for Internet Explorer (x32 Version: 7.5.4601.54)
Google Update Helper (x32 Version: 1.3.22.3)
GPBaseService2 (x32 Version: 130.0.371.000)
HP Customer Participation Program 13.0 (Version: 13.0)
HP Imaging Device Functions 13.0 (Version: 13.0)
HP Photosmart Essential 3.5 (Version: 3.5)
HP Photosmart Officejet and Deskjet All-In-One Driver Software 13.0 Rel. B (Version: 13.0)
HP Smart Web Printing 4.51 (Version: 4.51)
HP Solution Center 13.0 (Version: 13.0)
HP Update (x32 Version: 4.000.011.006)
HPPhotoGadget (x32 Version: 130.0.282.000)
HPPhotoSmartDiscLabelContent1 (x32 Version: 2.04.0000)
HPPhotosmartEssential (x32 Version: 2.04.0000)
HPProductAssistant (x32 Version: 130.0.371.000)
HPSSupply (x32 Version: 130.0.371.000)
ImagXpress (x32 Version: 7.0.74.0)
Intel(R) Management Engine Components (x32 Version: 6.0.0.1179)
Intel(R) Rapid Storage Technology (x32 Version: 9.5.7.1002)
Java 7 Update 45 (x32 Version: 7.0.450)
Java Auto Updater (x32 Version: 2.1.9.8)
Java(TM) 6 Update 17 (x32 Version: 6.0.170)
Jewel Quest II (x32 Version: 2.2.0.82)
Junk Mail filter update (x32 Version: 14.0.8089.726)
Kaspersky PURE 3.0 (x32 Version: 13.0.2.558)
MarketResearch (x32 Version: 130.0.374.000)
McAfee Security Scan Plus (Version: 3.8.130.10)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Choice Guard (x32 Version: 2.0.48.0)
Microsoft Office 2007 Service Pack 3 (SP3) (x32)
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003)
Microsoft Office Home and Student 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Live Add-in 1.5 (x32 Version: 2.0.4024.1)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000)
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office PowerPoint Viewer 2007 (German) (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32)
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Suite Activation Assistant (x32 Version: 2.9)
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Silverlight (Version: 5.1.20913.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft Works (x32 Version: 9.7.0621)
Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000)
Mozilla Firefox 25.0.1 (x86 de) (x32 Version: 25.0.1)
Mozilla Maintenance Service (x32 Version: 25.0.1)
MSVCRT (x32 Version: 14.0.1468.721)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
MyPC Backup (Version: ) <==== ATTENTION
Nero 9 Essentials (x32)
Nero BackItUp (x32 Version: 5.2.21001)
Nero BackItUp and Burn (x32 Version: 1.2.0030)
Nero BurnRights (x32 Version: 3.4.13.100)
Nero BurnRights (x32 Version: 3.6.26001)
Nero BurnRights Help (x32 Version: 3.4.4.100)
Nero ControlCenter (x32 Version: 9.0.0.1)
Nero DiscSpeed (x32 Version: 5.4.13.100)
Nero DiscSpeed Help (x32 Version: 5.4.4.100)
Nero DriveSpeed (x32 Version: 4.4.12.100)
Nero DriveSpeed Help (x32 Version: 4.4.4.100)
Nero Express (x32 Version: 9.6.16000)
Nero Express Help (x32 Version: 9.4.34.100)
Nero InfoTool (x32 Version: 6.4.12.100)
Nero InfoTool Help (x32 Version: 6.4.4.100)
Nero Installer (x32 Version: 4.4.9.0)
Nero Online Upgrade (x32 Version: 1.3.0.0)
Nero RescueAgent (x32 Version: 2.6.25002)
Nero StartSmart (x32 Version: 9.4.37.100)
Nero StartSmart Help (x32 Version: 9.4.37.100)
NeroExpress (x32 Version: 9.4.34.100)
neroxml (x32 Version: 1.0.0)
Network64 (Version: 130.0.572.000)
Netzwerkhandbuch EPSON XP-205 207 Series (x32)
OCR Software by I.R.I.S. 13.0 (Version: 13.0)
Open It! (x32 Version: 1.1.1)
Penguins! (x32 Version: 2.2.0.82)
Plants vs. Zombies (x32 Version: 2.2.0.82)
PlayReady PC Runtime amd64 (Version: 1.3.0)
Polar Bowler (x32 Version: 2.2.0.82)
Realtek USB 2.0 Card Reader (x32 Version: 6.1.7600.30111)
Realtek WLAN Driver (x32 Version: 2.00.0011)
Recuva (Version: 1.49)
RegClean Pro (x32 Version: 6.21) <==== ATTENTION
Scan (x32 Version: 13.0.0.0)
Shop for HP Supplies (Version: 13.0)
Skype Toolbars (x32 Version: 1.0.4051)
Skype™ 5.10 (x32 Version: 5.10.116)
SmartWebPrinting (x32 Version: 130.0.457.000)
Softonic toolbar on IE and Chrome (x32 Version: 1.8.21.14)
Software Updater (x32 Version: 4.1.1)
SolutionCenter (x32 Version: 130.0.373.000)
Status (x32 Version: 130.0.469.000)
Synaptics Pointing Device Driver (Version: 15.0.8.1)
TeamViewer 8 (x32 Version: 8.0.20202)
Toolbox (x32 Version: 130.0.648.000)
Toshiba Assist (x32 Version: 3.00.10)
TOSHIBA Bulletin Board (Version: 1.6.06.64)
TOSHIBA Bulletin Board (x32 Version: 1.6.06.64)
TOSHIBA ConfigFree (x32 Version: 8.0.28)
TOSHIBA Disc Creator (Version: 2.1.0.2 for x64)
TOSHIBA eco Utility (Version: 1.2.10.64)
TOSHIBA eco Utility (x32 Version: 1.2.10.64)
TOSHIBA Face Recognition (Version: 3.1.3.64)
TOSHIBA Face Recognition (x32 Version: 3.1.3.64)
TOSHIBA Hardware Setup (x32 Version: 2.00.06)
TOSHIBA HDD/SSD Alert (Version: 3.1.64.6)
TOSHIBA HDD/SSD Alert (x32 Version: 3.1.64.6)
Toshiba Manuals (x32 Version: 10.01)
TOSHIBA Media Controller (x32 Version: 1.0.80.3.64)
TOSHIBA Media Controller Plug-in (x32 Version: 1.0.5.10)
TOSHIBA Online Product Information (x32 Version: 2.09.0001)
TOSHIBA PC Health Monitor (Version: 1.6.0.64)
TOSHIBA Recovery Media Creator (Version: 2.1.0.4 x64)
TOSHIBA Recovery Media Creator Reminder (x32 Version: 1.00.0019)
TOSHIBA ReelTime (Version: 1.6.06.64)
TOSHIBA ReelTime (x32 Version: 1.6.06.64)
TOSHIBA Service Station (x32 Version: 2.1.40)
TOSHIBA Supervisor Password (x32 Version: 2.00.03)
Toshiba TEMPRO (x32 Version: 3.30)
TOSHIBA Value Added Package (Version: 1.3.3.64)
TOSHIBA Value Added Package (x32 Version: 1.3.3.64)
TOSHIBA Web Camera Application (x32 Version: 1.1.1.15)
TrayApp (x32 Version: 130.0.422.000)
TRORMCLauncher (Version: 1.0.0.9)
TRORMCLauncher (x32 Version: )
UnloadSupport (x32 Version: 11.0.0)
Update for 2007 Microsoft Office System (KB967642) (x32)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32)
Update für Microsoft Office Excel 2007 Help (KB963678) (x32)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (x32)
Update für Microsoft Office Word 2007 Help (KB963665) (x32)
WebReg (x32 Version: 130.0.132.017)
WildTangent ORB Game Console (x32)
WildTangent-Spiele (x32 Version: 1.0.0.80)
Windows Live Call (x32 Version: 14.0.8064.0206)
Windows Live Communications Platform (x32 Version: 14.0.8064.206)
Windows Live Essentials (x32 Version: 14.0.8089.0726)
Windows Live Essentials (x32 Version: 14.0.8089.726)
Windows Live Fotogalerie (x32 Version: 14.0.8081.709)
Windows Live ID Sign-in Assistant (Version: 6.500.3165.0)
Windows Live Mail (x32 Version: 14.0.8089.0726)
Windows Live Messenger (x32 Version: 14.0.8089.0726)
Windows Live Movie Maker (x32 Version: 14.0.8091.0730)
Windows Live Sync (x32 Version: 14.0.8089.726)
Windows Live Writer (x32 Version: 14.0.8089.0726)
Windows Live-Uploadtool (x32 Version: 14.0.8014.1029)
Zip Opener Packages (HKCU)
Zuma Deluxe (x32 Version: 2.2.0.82)
==================== Restore Points =========================
15-11-2013 06:01:29 Windows Update
25-11-2013 19:10:06 Geplanter Prüfpunkt
03-12-2013 10:17:38 Geplanter Prüfpunkt
07-12-2013 08:26:01 TuneUp Utilities 2014 wird entfernt
07-12-2013 08:26:40 TuneUp Utilities 2014 (de-DE) wird entfernt
==================== Hosts content: ==========================
2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {0F38A8F6-9964-45F0-8F95-B9C5F38381C1} - System32\Tasks\RegClean Pro => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe [2013-11-22] (Systweak Inc) <==== ATTENTION
Task: {2225B860-35F1-4891-BAA8-089CCEE2CC12} - System32\Tasks\Advanced System Protector_startup => C:\Program Files (x86)\Advanced System Protector\AdvancedSystemProtector.exe [2013-10-04] (Systweak)
Task: {227001EA-2926-4364-81F0-EB71060B9870} - System32\Tasks\RegClean Pro_UPDATES => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe [2013-11-22] (Systweak Inc) <==== ATTENTION
Task: {37C5087D-C2D6-4A3A-BAE9-A21DEDF20FC4} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-02-07] (Google Inc.)
Task: {3E9CCB56-4EAF-4347-B07A-3B8210083C82} - System32\Tasks\Advanced System Protector => C:\Program Files (x86)\RegClean Pro\systweakasp.exe [2013-08-23] (Systweak Inc ) <==== ATTENTION
Task: {7E323806-5E02-4B20-A65B-BC7D70FF86BE} - System32\Tasks\ConfigFree Startup Programs => C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe [2010-02-22] (TOSHIBA CORPORATION)
Task: {879592D5-3175-40E6-AB50-B9328F608A5D} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-10-22] (Piriform Ltd)
Task: {8C442DFD-3C11-4F17-BA3F-C6E1C1237801} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-02-07] (Google Inc.)
Task: {AFDBF207-4AB6-4D45-BE02-6836F62B5E9B} - System32\Tasks\RegClean Pro_DEFAULT => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe [2013-11-22] (Systweak Inc) <==== ATTENTION
Task: {D899C117-7E43-46E7-80D7-091C41C28514} - System32\Tasks\DigitalSite => C:\Users\Toshiba\AppData\Roaming\DigitalSite\UpdateProc\UpdateTask.exe [2013-04-12] ()
Task: {F99D8CF5-83E6-4168-942C-3398C90FDBE8} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-15] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\DigitalSite.job => C:\Users\Toshiba\AppData\Roaming\DIGITA~1\UPDATE~1\UPDATE~1.EXE
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\RegClean Pro_DEFAULT.job => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe <==== ATTENTION
Task: C:\Windows\Tasks\RegClean Pro_UPDATES.job => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe <==== ATTENTION
==================== Loaded Modules (whitelisted) =============
2010-03-09 13:31 - 2010-03-09 13:31 - 03409256 _____ () C:\Program Files\TOSHIBA\BulletinBoard\TosNcUi.dll
2010-03-03 13:15 - 2010-03-03 13:15 - 08762680 _____ () C:\Program Files\TOSHIBA\FlashCards\BlackPng.dll
2009-11-03 12:26 - 2009-11-03 12:26 - 00053560 _____ () C:\Program Files\TOSHIBA\FlashCards\Hotkey\FnZ.dll
2010-03-03 13:15 - 2010-03-03 13:15 - 00019256 _____ () C:\Program Files\TOSHIBA\FlashCards\Hotkey\FnF10.dll
2010-03-03 13:15 - 2010-03-03 13:15 - 00019256 _____ () C:\Program Files\TOSHIBA\FlashCards\Hotkey\FnF11.dll
2010-04-01 11:50 - 2009-06-22 13:40 - 00022328 _____ () C:\Program Files\TOSHIBA\Toshiba Assist\NotifyX.dll
2009-03-12 18:08 - 2009-03-12 18:08 - 00048640 _____ () C:\Program Files (x86)\Toshiba\PCDiag\NotifyPCD.dll
2009-07-25 15:38 - 2009-07-25 15:38 - 00017800 _____ () C:\Program Files\TOSHIBA\TOSHIBA Disc Creator\NotifyTDC.dll
2010-03-17 15:01 - 2010-03-17 15:01 - 00578936 _____ () C:\Program Files\TOSHIBA\TECO\TecoPower.dll
2009-10-13 09:00 - 2009-10-13 09:00 - 00016384 ____R () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2012-04-30 09:19 - 2012-04-30 09:19 - 00270336 _____ () C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2010-02-05 16:44 - 2010-02-05 16:44 - 00079192 _____ () C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosIPCWraper.dll
2013-09-19 23:37 - 2013-09-19 23:37 - 00012288 _____ () C:\Program Files (x86)\MyPC Backup\GetText.dll
2013-09-19 23:32 - 2013-09-19 23:32 - 01102336 _____ () C:\Program Files (x86)\MyPC Backup\x64\System.Data.SQLite.dll
2013-03-13 21:48 - 2013-03-13 21:48 - 24978944 _____ () C:\Users\Toshiba\AppData\Roaming\Dropbox\bin\libcef.dll
2013-11-17 17:11 - 2013-11-17 17:11 - 03363952 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MSIServer => ""="Service"
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (12/09/2013 00:05:35 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Das erforderliche "name"-Attribut fehlt im assemblyIdentity-Element.
Error: (12/08/2013 11:24:42 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Avira-RansomFileUnlocker.exe, Version: 1.0.1.0, Zeitstempel: 0x4f9f0b59
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000
ID des fehlerhaften Prozesses: 0x%9
Startzeit der fehlerhaften Anwendung: 0xAvira-RansomFileUnlocker.exe0
Pfad der fehlerhaften Anwendung: Avira-RansomFileUnlocker.exe1
Pfad des fehlerhaften Moduls: Avira-RansomFileUnlocker.exe2
Berichtskennung: Avira-RansomFileUnlocker.exe3
Error: (12/08/2013 11:24:14 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Avira-RansomFileUnlocker.exe, Version: 1.0.1.0, Zeitstempel: 0x4f9f0b59
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000
ID des fehlerhaften Prozesses: 0x%9
Startzeit der fehlerhaften Anwendung: 0xAvira-RansomFileUnlocker.exe0
Pfad der fehlerhaften Anwendung: Avira-RansomFileUnlocker.exe1
Pfad des fehlerhaften Moduls: Avira-RansomFileUnlocker.exe2
Berichtskennung: Avira-RansomFileUnlocker.exe3
Error: (12/08/2013 11:12:57 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: FreeDVDVideoConverter.exe, Version: 2.0.15.1125, Zeitstempel: 0x529355c2
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x060c737a
ID des fehlerhaften Prozesses: 0xb78
Startzeit der fehlerhaften Anwendung: 0xFreeDVDVideoConverter.exe0
Pfad der fehlerhaften Anwendung: FreeDVDVideoConverter.exe1
Pfad des fehlerhaften Moduls: FreeDVDVideoConverter.exe2
Berichtskennung: FreeDVDVideoConverter.exe3
Error: (12/08/2013 07:26:39 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: FreeDVDVideoConverter.exe, Version: 2.0.15.1125, Zeitstempel: 0x529355c2
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x05ea737e
ID des fehlerhaften Prozesses: 0x1318
Startzeit der fehlerhaften Anwendung: 0xFreeDVDVideoConverter.exe0
Pfad der fehlerhaften Anwendung: FreeDVDVideoConverter.exe1
Pfad des fehlerhaften Moduls: FreeDVDVideoConverter.exe2
Berichtskennung: FreeDVDVideoConverter.exe3
Error: (12/08/2013 04:37:07 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: FreeDVDVideoConverter.exe, Version: 2.0.15.1125, Zeitstempel: 0x529355c2
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0622efd8
ID des fehlerhaften Prozesses: 0xcb4
Startzeit der fehlerhaften Anwendung: 0xFreeDVDVideoConverter.exe0
Pfad der fehlerhaften Anwendung: FreeDVDVideoConverter.exe1
Pfad des fehlerhaften Moduls: FreeDVDVideoConverter.exe2
Berichtskennung: FreeDVDVideoConverter.exe3
Error: (12/08/2013 10:52:43 AM) (Source: Application Hang) (User: )
Description: Programm FreeDVDVideoConverter.exe, Version 2.0.15.1125 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 1b08
Startzeit: 01cef3fab5713766
Endzeit: 20
Anwendungspfad: C:\Program Files (x86)\DVDVideoSoft\Free DVD Video Converter\FreeDVDVideoConverter.exe
Berichts-ID: 781ef09b-5fee-11e3-ac77-00266c854c61
Error: (12/08/2013 10:44:38 AM) (Source: Application Hang) (User: )
Description: Programm FreeDVDVideoConverter.exe, Version 2.0.15.1125 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: f1c
Startzeit: 01cef3f9d7824197
Endzeit: 10
Anwendungspfad: C:\Program Files (x86)\DVDVideoSoft\Free DVD Video Converter\FreeDVDVideoConverter.exe
Berichts-ID: 54fcce65-5fed-11e3-ac77-00266c854c61
Error: (12/07/2013 08:26:31 PM) (Source: Application Hang) (User: )
Description: Programm Explorer.EXE, Version 6.1.7601.17567 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 7b4
Startzeit: 01cef24824747ee4
Endzeit: 3171
Anwendungspfad: C:\Windows\Explorer.EXE
Berichts-ID: 73168b3b-5f75-11e3-ac77-00266c854c61
Error: (12/07/2013 08:58:46 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.
System errors:
=============
Error: (12/08/2013 05:06:40 PM) (Source: cdrom) (User: )
Description: Fehlerhafter Block bei Gerät \Device\CdRom0.
Error: (12/08/2013 05:06:37 PM) (Source: cdrom) (User: )
Description: Fehlerhafter Block bei Gerät \Device\CdRom0.
Error: (12/08/2013 05:06:33 PM) (Source: cdrom) (User: )
Description: Fehlerhafter Block bei Gerät \Device\CdRom0.
Error: (12/08/2013 05:06:28 PM) (Source: cdrom) (User: )
Description: Fehlerhafter Block bei Gerät \Device\CdRom0.
Error: (12/08/2013 05:06:25 PM) (Source: cdrom) (User: )
Description: Fehlerhafter Block bei Gerät \Device\CdRom0.
Error: (12/08/2013 05:06:21 PM) (Source: cdrom) (User: )
Description: Fehlerhafter Block bei Gerät \Device\CdRom0.
Error: (12/08/2013 05:06:14 PM) (Source: cdrom) (User: )
Description: Fehlerhafter Block bei Gerät \Device\CdRom0.
Error: (12/08/2013 05:06:11 PM) (Source: cdrom) (User: )
Description: Fehlerhafter Block bei Gerät \Device\CdRom0.
Error: (12/08/2013 05:06:08 PM) (Source: cdrom) (User: )
Description: Fehlerhafter Block bei Gerät \Device\CdRom0.
Error: (12/08/2013 05:06:03 PM) (Source: cdrom) (User: )
Description: Fehlerhafter Block bei Gerät \Device\CdRom0.
Microsoft Office Sessions:
=========================
CodeIntegrity Errors:
===================================
Date: 2013-12-07 08:58:37.854
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-07 08:58:37.852
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-07 08:58:37.849
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-07 08:58:37.828
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-07 08:58:37.826
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-07 08:58:37.823
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-06 12:39:53.005
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-06 12:39:53.005
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-06 12:39:52.995
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-12-06 12:39:52.975
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Percentage of memory in use: 49%
Total physical RAM: 3957.86 MB
Available physical RAM: 2003 MB
Total Pagefile: 7913.9 MB
Available Pagefile: 5811.84 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB
==================== Drives ================================
Drive c: (Vista) (Fixed) (Total:232.42 GB) (Free:178.88 GB) NTFS
Drive d: (Data) (Fixed) (Total:231.87 GB) (Free:91.16 GB) NTFS
Drive e: (ARCHE_NOAH) (CDROM) (Total:2.29 GB) (Free:0 GB) UDF
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 466 GB) (Disk ID: 9BE09F04)
Partition 1: (Active) - (Size=1 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=232 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=232 GB) - (Type=07 NTFS)
==================== End Of Log ============================
|
|
09.12.2013, 00:17
| #4 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Hilfe Cryptlocker 300,-€ Variante - Datei zu groß oder beschädigt! Was ist mit den Logs von Malwarebytes und den anderen Scannern? Noch vorhanden? edit: Zitat:
 Lesestoff:Rootkit-Warnung Dein Computer wurde mit einem besonderen Schädling infiziert, der sich vor herkömmlichen Virenscannern und dem Betriebssystem selbst verstecken kann. Zusätzlich hat so ein Schädling meist auch Backdoor-Funktionalität, reißt also ganz bewußt Löcher durch alle Schutzmaßnahmen, damit er weiteren Schadcode nachladen oder die Daten, die er so sammelt, an die "bösen Jungs" weiterleiten kann. Was heißt das jetzt für dich?
Teile mir also mit, wie du dich entschieden hast.
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
09.12.2013, 00:28
| #5 |
| | Hilfe Cryptlocker 300,-€ Variante - Datei zu groß oder beschädigt! Shadow Explorer zeigt auf partition D: nichts an und auch auf C: sieht man keinen Ordner indem sich die befallenen Dateien befinden. Sorry, aber wo find ich die logs? |
|
09.12.2013, 00:36
| #6 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Hilfe Cryptlocker 300,-€ Variante - Datei zu groß oder beschädigt! Dann sind deine Daten weg. AFAIK hat man nur 72 Stunden Zeit seine Daten von den Heinis wiederzubekommen. Und Schattenkopien bringen nichts bei dir. Den Hinweis zur Rootkit Warnung hast du gelesen? Willst du wirklich den Rechner bereinigen oder nicht doch lieber neu installieren? Zitat:
__________________ --> Hilfe Cryptlocker 300,-€ Variante - Datei zu groß oder beschädigt! |
|
09.12.2013, 00:54
| #7 |
| | Hilfe Cryptlocker 300,-€ Variante - Datei zu groß oder beschädigt! Danke für deine Hilfe und das du dir die Zeit genommen hast. Damals lief bei mir auch ein Countdown. Irgendwas mit 50 Std mein ich. Das war die Zeit in der ich das geld überweisen sollte. Ich würde aber nie im Leben 300€ irgendwohin überweisen. Dann kann ich die 300,- direkt auf die Strasse legen. Das Geld wäre warscheinlich futsch und die Dateien auch. Ich denke ich werd die Platte ausbauen und mir ne neue holen und die hier beiseite legen. Vielleicht gibts irgendwann ein Tool um doch noch an die Dateien zu kommen. Es sind wichtige Fotos drauf und irgendwie muss es gehen. Es wäre "einfach" zu "einfach" wenn Sie nur "gelocked" wären! Ein Hacker programmiert sowas "einfaches" nicht. Zudem es ja einen Schlüssel gibt (wenn man das Geld überweist). Aber trotzdem dankeschön. |
|
09.12.2013, 01:12
| #8 | ||
| /// Winkelfunktion /// TB-Süch-Tiger™ | Hilfe Cryptlocker 300,-€ Variante - Datei zu groß oder beschädigt!Zitat:
Zitat:
 Ich fürchte die Daten wirst du nie wieder sehen...
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu Hilfe Cryptlocker 300,-€ Variante - Datei zu groß oder beschädigt! |
| ahnung, anti-malware, beschädigt, datei, dateien, formatierung, hallo zusammen, helper, kaspersky, kaspersky und malwarebytes, malwarebytes, namen, nicht mehr, nichts, rechtsklick, registry, schutz, trotz, unterschiedlich, variante, virenschutz, virus, virus?, virus??, wichtig, windows, wurm |
Linear-Darstellung
