| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Veränderungen am System - Virus eingefangen?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
19.01.2014, 11:16
| #1 |
 |  Veränderungen am System - Virus eingefangen? Hallo, ich bin mal wieder auf der Suche... Habe seit gestern ein paar Veränderungen festgestellt am System. Heute ging Chrome dann gar nicht mehr vorerst. Davor waren gewisse Veränderungen festzustellen, wie zB war die Lesezeichenliste weg und später Lesezeichen da, die wir vorher nicht hatten. Zudem wurde das System viel langsamer. Hab ich was eingefangen? Avira sagt nichts. Defogger sagt auch nichts. Danke vorweg für die Mühen... Gruß Gerd  FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-01-2014 03
Ran by ... (administrator) on ...-HP on 19-01-2014 11:08:03
Running from C:\Users\...\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(Validity Sensors, Inc.) C:\Windows\System32\vcsFPService.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\HPHotkeyMonitor.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
() C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe
(PDF Complete Inc) C:\Program Files (x86)\PDF Complete\pdfsvc.exe
(Portrait Displays, Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(ArcSoft, Inc.) C:\Windows\SysWOW64\ArcVCapRender\uArcCapture.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(Hewlett-Packard Development Company, L.P) C:\Program Files (x86)\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe
(DigitalPersona, Inc.) C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3050A J611 series\Bin\ScanToPCActivationApp.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\coreshredder.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\QLBController.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpAgent.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe
(Hewlett-Packard Development Company L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPConnectionManager.exe
(Portrait Displays, Inc) C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\SDKCOMServer.exe
(Hewlett-Packard Development Company L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Portrait Displays, Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdiSDKHelperx64.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe
(Google Inc.) C:\Users\...\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\...\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\...\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\...\AppData\Local\Google\Chrome\Application\chrome.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\usrreq.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2887440 2012-08-16] (Synaptics Incorporated)
HKLM\...\Run: [AtherosBtStack] - C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [615584 2011-01-07] (Atheros Communications)
HKLM\...\Run: [AthBtTray] - C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [379040 2011-01-07] (Atheros Commnucations)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [1424896 2012-08-16] (IDT, Inc.)
HKLM\...\Run: [HPPowerAssistant] - C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe [2996792 2011-07-15] (Hewlett-Packard Company)
HKLM-x32\...\Run: [File Sanitizer] - C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\CoreShredder.exe [12274688 2011-02-07] (Hewlett-Packard)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-26] (Intel Corporation)
HKLM-x32\...\Run: [NUSB3MON] - c:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2011-10-14] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [DTRun] - c:\Program Files (x86)\ArcSoft\TotalMedia Suite\TotalMedia Theatre 3\uDTRun.exe [517456 2010-11-24] (ArcSoft Inc.)
HKLM-x32\...\Run: [PDF Complete] - C:\Program Files (x86)\PDF Complete\pdfsty.exe [658424 2011-08-11] (PDF Complete Inc)
HKLM-x32\...\Run: [QLBController] - C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\QLBController.exe [333728 2012-06-20] (Hewlett-Packard Company)
HKLM-x32\...\Run: [HPConnectionManager] - C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe [103992 2011-05-23] (Hewlett-Packard Development Company L.P.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-17] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [KeePass 2 PreLoad] - C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [1960448 2013-04-05] (Dominik Reichl)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
HKLM-x32\...\Run: [mobilegeni daemon] - C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
HKLM-x32\...\Runonce: [Del514522] - cmd.exe /Q /D /c del "C:\Users\GERDKU~1\AppData\Local\Temp\0.del" [x]
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe,
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\DeviceNP-x32: DeviceNP.dll [X]
HKCU\...\Run: [GoogleChromeAutoLaunch_AAFC616226BCC3127F5CDD44D42DFCFD] - C:\Users\...\AppData\Local\Google\Chrome\Application\chrome.exe [866584 2014-01-11] (Google Inc.)
HKCU\...\Run: [HP Deskjet 3050A J611 series (NET)] - C:\Program Files\HP\HP Deskjet 3050A J611 series\Bin\ScanToPCActivationApp.exe [2676584 2011-06-08] (Hewlett-Packard Co.)
HKCU\...\Run: [Google Update] - C:\Users\...\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2012-08-03] (Google Inc.)
HKCU\...\Run: [LiveSupport] - "C:\Program Files (x86)\LiveSupport\LiveSupport.exe" /noshow /log
HKCU\...\Run: [NextLive] - C:\Users\...\AppData\Roaming\newnext.me\nengine.dll [1283584 2013-11-14] (NewNextDotMe)
HKCU\...\Runonce: [Del514522] - cmd.exe /Q /D /c del "C:\Users\GERDKU~1\AppData\Local\Temp\0.del"
AppInit_DLLs-x32: C:\PROGRA~2\Amazon\AMAZON~1\\AMAZON~3.DLL [ ] ()
Lsa: [Notification Packages] DPPassFilter scecli
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.softonic.com/MOY00621/tb_v1?SearchSource=10&cc=&mi=8eaa5d18000000000000446d571a1eb3
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - DefaultScope {08A8EBCA-D913-46C4-A4EE-6E65CFB387D0} URL = hxxp://search.softonic.com/MOY00621/tb_v1?q={searchTerms}&SearchSource=4&cc=&mi=8eaa5d18000000000000446d571a1eb3&r=698
SearchScopes: HKCU - {08A8EBCA-D913-46C4-A4EE-6E65CFB387D0} URL = hxxp://search.softonic.com/MOY00621/tb_v1?q={searchTerms}&SearchSource=4&cc=&mi=8eaa5d18000000000000446d571a1eb3&r=698
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www1.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=8EAA446D571A1EB3&affID=121564&tsp=4954
SearchScopes: HKCU - {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL =
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: No Name - {26B19FA4-E8A1-4A1B-A163-1A1E46F830DD} - No File
BHO-x32: File Sanitizer for HP ProtectTools - {3134413B-49B4-425C-98A5-893C1F195601} - C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\IEBHO.dll (Hewlett-Packard)
BHO-x32: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Chrome:
=======
CHR Extension: (Google Wallet) - C:\Users\...\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23]
CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\DVDVideoSoftBrowserExtension.crx [2013-08-23]
CHR HKLM-x32\...\Chrome\Extension: [bkjllalecbfjgljbohjbjbcnimkeehdd] - C:\Program Files (x86)\uLyrics\124.crx [2013-08-23]
CHR HKLM-x32\...\Chrome\Extension: [gfhdkohbepelnfckgjinfddmecpngnpb] - C:\Program Files (x86)\LyricStar\Chrome.crx [2013-08-23]
==================== Services (Whitelisted) =================
S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 AntiVirFirewallService; C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe [1012280 2013-12-17] (Avira Operations GmbH & Co. KG)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [896056 2013-12-17] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-17] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-12] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1011768 2013-12-17] (Avira Operations GmbH & Co. KG)
R2 Atheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [138400 2011-01-07] (Atheros)
R2 DpHost; c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe [481104 2011-02-12] (DigitalPersona, Inc.)
S3 FLCDLOCK; c:\Windows\SysWOW64\flcdlock.exe [476728 2011-09-05] (Hewlett-Packard Company)
R3 HP ProtectTools Service; c:\Program Files (x86)\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe [36864 2011-01-12] (Hewlett-Packard Development Company, L.P)
R2 hpHotkeyMonitor; C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\HpHotkeyMonitor.exe [523680 2012-06-20] (Hewlett-Packard Company)
R2 McAfee Endpoint Encryption Agent; C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe [1323008 2012-04-05] ()
R2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1128952 2011-08-11] (PDF Complete Inc)
R2 uArcCapture; C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe [502464 2010-11-11] (ArcSoft, Inc.)
S2 XobniService; C:\Program Files (x86)\Xobni\XobniService.exe [62184 2011-03-07] (Xobni Corporation)
S2 BrowserDefendert; C:\ProgramData\BrowserDefender\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserDefender.exe [x]
==================== Drivers (Whitelisted) ====================
R3 ARCVCAM; C:\Windows\System32\DRIVERS\ArcSoftVCapture.sys [32192 2010-11-11] (ArcSoft, Inc.)
R3 avfwim; C:\Windows\System32\DRIVERS\avfwim.sys [114608 2013-02-12] (Avira GmbH)
R1 avfwot; C:\Windows\System32\DRIVERS\avfwot.sys [141376 2013-02-12] (Avira GmbH)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-12] (Avira Operations GmbH & Co. KG)
S3 DAMDrv; C:\Windows\System32\DRIVERS\DAMDrv64.sys [64312 2011-05-10] (Hewlett-Packard Company)
R0 MfeEpeOpal; C:\Windows\System32\Drivers\MfeEpeOpal.sys [100808 2012-04-05] (McAfee, Inc.)
R0 MfeEpePc; C:\Windows\System32\Drivers\MfeEpePc.sys [158920 2012-04-05] (McAfee, Inc.)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1826048 2010-12-21] ()
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-01-19 11:08 - 2014-01-19 11:08 - 00017537 _____ C:\Users\...\Downloads\FRST.txt
2014-01-19 11:08 - 2014-01-19 11:08 - 00000000 ____D C:\FRST
2014-01-19 11:07 - 2014-01-19 11:07 - 02076160 _____ (Farbar) C:\Users\...\Downloads\FRST64.exe
2014-01-19 11:02 - 2014-01-19 11:02 - 00000000 ____D C:\Users\...\Documents\PC Speed Maximizer
2014-01-19 11:01 - 2014-01-19 11:01 - 00000484 _____ C:\Users\...\Downloads\defogger_disable.log
2014-01-19 11:00 - 2014-01-19 11:00 - 00050477 _____ C:\Users\...\Downloads\Defogger.exe
2014-01-19 10:58 - 2014-01-19 11:05 - 00000000 ____D C:\Users\...\AppData\Local\Mobogenie
2014-01-19 10:58 - 2014-01-19 10:58 - 00000000 ____D C:\Users\...\Documents\Mobogenie
2014-01-19 10:58 - 2014-01-19 10:58 - 00000000 ____D C:\Users\...\AppData\Roaming\newnext.me
2014-01-19 10:58 - 2014-01-19 10:58 - 00000000 ____D C:\Users\...\AppData\Local\genienext
2014-01-19 10:58 - 2014-01-19 10:58 - 00000000 ____D C:\Users\...\.android
2014-01-19 10:58 - 2014-01-19 10:58 - 00000000 _____ C:\Users\...\daemonprocess.txt
2014-01-19 10:57 - 2014-01-19 11:05 - 00000000 ____D C:\Program Files (x86)\Mobogenie
2014-01-19 10:57 - 2014-01-19 11:05 - 00000000 ____D C:\Program Files (x86)\Amazon
2014-01-19 10:56 - 2014-01-19 10:58 - 00003274 _____ C:\windows\System32\Tasks\Digital Sites
2014-01-19 10:56 - 2014-01-19 10:58 - 00000310 _____ C:\windows\Tasks\Digital Sites.job
2014-01-19 10:56 - 2014-01-19 10:56 - 00001110 _____ C:\Users\Public\Desktop\Open It!.lnk
2014-01-19 10:56 - 2014-01-19 10:56 - 00000107 _____ C:\Users\...\AppData\Roaming\WB.CFG
2014-01-19 10:56 - 2014-01-19 10:56 - 00000005 _____ C:\Users\...\AppData\Roaming\WBPU-TTL.DAT
2014-01-19 10:56 - 2014-01-19 10:56 - 00000000 ____D C:\Users\...\AppData\Roaming\DigitalSites
2014-01-19 10:56 - 2014-01-19 10:56 - 00000000 ____D C:\Program Files (x86)\OpenIt
2014-01-19 10:55 - 2014-01-19 10:55 - 00680328 _____ ( ) C:\Users\...\Downloads\ZipOpenerSetup.exe
2014-01-19 09:52 - 2014-01-19 10:48 - 00000112 _____ C:\windows\setupact.log
2014-01-19 09:52 - 2014-01-19 09:52 - 00000000 _____ C:\windows\setuperr.log
2014-01-18 09:52 - 2014-01-18 09:52 - 00000000 _____ C:\windows\SysWOW64\sho7C90.tmp
2014-01-17 17:21 - 2014-01-17 17:23 - 00000000 ____D C:\Users\...\Documents\My Games
2014-01-17 17:19 - 2014-01-17 17:19 - 00001283 _____ C:\Users\...\Desktop\Landwirtschafts-Simulator 2009.lnk
2014-01-17 17:19 - 2014-01-17 17:19 - 00000000 ____D C:\Program Files (x86)\Landwirtschafts-Simulator 2009
2014-01-15 12:30 - 2014-01-15 12:30 - 00001125 _____ C:\Users\...\Dokumente - Verknüpfung.lnk
2014-01-15 09:19 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbhub.sys
2014-01-15 09:19 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbport.sys
2014-01-15 09:19 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbccgp.sys
2014-01-15 09:19 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbehci.sys
2014-01-15 09:19 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbuhci.sys
2014-01-15 09:19 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbohci.sys
2014-01-15 09:19 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbd.sys
2014-01-15 09:19 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\windows\system32\Drivers\netio.sys
2014-01-15 09:19 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2014-01-13 12:35 - 2014-01-13 12:35 - 00049507 _____ C:\Users\...\Desktop\Waldpiratenparty.odt
2014-01-13 10:48 - 2014-01-13 10:48 - 00000000 ___SD C:\Users\...\Documents\Meine Datenquellen
2014-01-07 21:45 - 2014-01-07 21:45 - 00000000 _____ C:\windows\SysWOW64\sho8148.tmp
2014-01-05 21:50 - 2014-01-05 21:50 - 00000000 _____ C:\windows\SysWOW64\shoAB97.tmp
2013-12-22 21:02 - 2013-12-22 21:02 - 00000000 ____D C:\Users\...\AppData\Roaming\OpenOffice
2013-12-22 20:59 - 2013-12-22 20:59 - 00001116 _____ C:\Users\Public\Desktop\OpenOffice 4.0.1.lnk
2013-12-22 20:58 - 2013-12-22 20:59 - 00000000 ____D C:\Program Files (x86)\OpenOffice 4
2013-12-22 20:57 - 2013-12-22 20:57 - 00000000 ____D C:\Users\...\Desktop\OpenOffice 4.0.1 (de) Installation Files
2013-12-22 20:53 - 2013-12-22 20:57 - 163606685 _____ C:\Users\...\Downloads\Apache_OpenOffice_4.0.1_Win_x86_install_de.exe
2013-12-21 11:51 - 2013-12-21 11:51 - 00000000 ____D C:\Users\...\Documents\Fax
==================== One Month Modified Files and Folders =======
2014-01-19 11:08 - 2014-01-19 11:08 - 00017537 _____ C:\Users\...\Downloads\FRST.txt
2014-01-19 11:08 - 2014-01-19 11:08 - 00000000 ____D C:\FRST
2014-01-19 11:07 - 2014-01-19 11:07 - 02076160 _____ (Farbar) C:\Users\...\Downloads\FRST64.exe
2014-01-19 11:05 - 2014-01-19 10:58 - 00000000 ____D C:\Users\...\AppData\Local\Mobogenie
2014-01-19 11:05 - 2014-01-19 10:57 - 00000000 ____D C:\Program Files (x86)\Mobogenie
2014-01-19 11:05 - 2014-01-19 10:57 - 00000000 ____D C:\Program Files (x86)\Amazon
2014-01-19 11:02 - 2014-01-19 11:02 - 00000000 ____D C:\Users\...\Documents\PC Speed Maximizer
2014-01-19 11:01 - 2014-01-19 11:01 - 00000484 _____ C:\Users\...\Downloads\defogger_disable.log
2014-01-19 11:01 - 2012-12-26 15:52 - 00000268 _____ C:\windows\Tasks\HP Photo Creations Messager.job
2014-01-19 11:00 - 2014-01-19 11:00 - 00050477 _____ C:\Users\...\Downloads\Defogger.exe
2014-01-19 10:58 - 2014-01-19 10:58 - 00000000 ____D C:\Users\...\Documents\Mobogenie
2014-01-19 10:58 - 2014-01-19 10:58 - 00000000 ____D C:\Users\...\AppData\Roaming\newnext.me
2014-01-19 10:58 - 2014-01-19 10:58 - 00000000 ____D C:\Users\...\AppData\Local\genienext
2014-01-19 10:58 - 2014-01-19 10:58 - 00000000 ____D C:\Users\...\.android
2014-01-19 10:58 - 2014-01-19 10:58 - 00000000 _____ C:\Users\...\daemonprocess.txt
2014-01-19 10:58 - 2014-01-19 10:56 - 00003274 _____ C:\windows\System32\Tasks\Digital Sites
2014-01-19 10:58 - 2014-01-19 10:56 - 00000310 _____ C:\windows\Tasks\Digital Sites.job
2014-01-19 10:58 - 2013-05-17 14:56 - 00000000 ____D C:\Users\...\AppData\Local\cache
2014-01-19 10:58 - 2012-08-03 11:36 - 00000000 ____D C:\Users\...
2014-01-19 10:56 - 2014-01-19 10:56 - 00001110 _____ C:\Users\Public\Desktop\Open It!.lnk
2014-01-19 10:56 - 2014-01-19 10:56 - 00000107 _____ C:\Users\...\AppData\Roaming\WB.CFG
2014-01-19 10:56 - 2014-01-19 10:56 - 00000005 _____ C:\Users\...\AppData\Roaming\WBPU-TTL.DAT
2014-01-19 10:56 - 2014-01-19 10:56 - 00000000 ____D C:\Users\...\AppData\Roaming\DigitalSites
2014-01-19 10:56 - 2014-01-19 10:56 - 00000000 ____D C:\Program Files (x86)\OpenIt
2014-01-19 10:56 - 2009-07-14 05:45 - 00028352 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-19 10:56 - 2009-07-14 05:45 - 00028352 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-19 10:55 - 2014-01-19 10:55 - 00680328 _____ ( ) C:\Users\...\Downloads\ZipOpenerSetup.exe
2014-01-19 10:53 - 2012-05-19 08:12 - 02052362 _____ C:\windows\WindowsUpdate.log
2014-01-19 10:50 - 2012-05-19 08:28 - 00000035 _____ C:\Users\Public\Documents\AtherosServiceConfig.ini
2014-01-19 10:49 - 2011-12-23 01:04 - 00000000 ____D C:\ProgramData\PDFC
2014-01-19 10:49 - 2011-12-23 01:00 - 00000000 ____D C:\ProgramData\HPQLOG
2014-01-19 10:48 - 2014-01-19 09:52 - 00000112 _____ C:\windows\setupact.log
2014-01-19 10:48 - 2009-07-14 06:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2014-01-19 10:33 - 2012-08-03 12:02 - 00003978 _____ C:\windows\System32\Tasks\User_Feed_Synchronization-{477BB218-5673-4B91-8753-26F31D84FD21}
2014-01-19 10:27 - 2012-08-03 12:06 - 00001144 _____ C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3657930280-3738987984-27973596-1002UA.job
2014-01-19 10:16 - 2012-11-12 07:11 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2014-01-19 09:52 - 2014-01-19 09:52 - 00000000 _____ C:\windows\setuperr.log
2014-01-18 09:52 - 2014-01-18 09:52 - 00000000 _____ C:\windows\SysWOW64\sho7C90.tmp
2014-01-18 09:27 - 2012-08-03 12:06 - 00001092 _____ C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3657930280-3738987984-27973596-1002Core.job
2014-01-17 17:23 - 2014-01-17 17:21 - 00000000 ____D C:\Users\...\Documents\My Games
2014-01-17 17:19 - 2014-01-17 17:19 - 00001283 _____ C:\Users\...\Desktop\Landwirtschafts-Simulator 2009.lnk
2014-01-17 17:19 - 2014-01-17 17:19 - 00000000 ____D C:\Program Files (x86)\Landwirtschafts-Simulator 2009
2014-01-17 15:11 - 2013-05-27 10:08 - 00003222 _____ C:\windows\System32\Tasks\HPCeeScheduleFor...
2014-01-17 15:11 - 2013-05-27 10:08 - 00000356 _____ C:\windows\Tasks\HPCeeScheduleFor....job
2014-01-17 09:48 - 2013-03-21 07:55 - 00000000 ____D C:\Users\...\AppData\Roaming\KeePass
2014-01-16 09:01 - 2009-07-14 05:45 - 00370432 _____ C:\windows\system32\FNTCACHE.DAT
2014-01-15 21:54 - 2013-07-19 12:02 - 00000000 ____D C:\windows\system32\MRT
2014-01-15 21:52 - 2012-08-03 12:45 - 86054176 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-01-15 12:30 - 2014-01-15 12:30 - 00001125 _____ C:\Users\...\Dokumente - Verknüpfung.lnk
2014-01-13 12:35 - 2014-01-13 12:35 - 00049507 _____ C:\Users\...\Desktop\Waldpiratenparty.odt
2014-01-13 10:48 - 2014-01-13 10:48 - 00000000 ___SD C:\Users\...\Documents\Meine Datenquellen
2014-01-12 13:28 - 2012-08-09 17:04 - 00000000 ____D C:\Users\...\Bilder
2014-01-10 16:39 - 2013-02-25 11:29 - 00000000 ____D C:\Users\...\AppData\Roaming\SoftGrid Client
2014-01-07 21:45 - 2014-01-07 21:45 - 00000000 _____ C:\windows\SysWOW64\sho8148.tmp
2014-01-05 21:50 - 2014-01-05 21:50 - 00000000 _____ C:\windows\SysWOW64\shoAB97.tmp
2014-01-02 19:40 - 2013-06-02 21:11 - 00000000 ____D C:\Users\...\AppData\Roaming\eM Client
2014-01-02 08:53 - 2009-07-14 06:08 - 00032632 _____ C:\windows\Tasks\SCHEDLGU.TXT
2013-12-30 22:13 - 2012-08-03 11:36 - 00003230 _____ C:\windows\System32\Tasks\HPCeeScheduleFor...-HP$
2013-12-30 22:13 - 2012-08-03 11:36 - 00000354 _____ C:\windows\Tasks\HPCeeScheduleFor...-HP$.job
2013-12-22 21:09 - 2012-08-03 11:59 - 00092560 _____ C:\Users\...\AppData\Local\GDIPFONTCACHEV1.DAT
2013-12-22 21:02 - 2013-12-22 21:02 - 00000000 ____D C:\Users\...\AppData\Roaming\OpenOffice
2013-12-22 20:59 - 2013-12-22 20:59 - 00001116 _____ C:\Users\Public\Desktop\OpenOffice 4.0.1.lnk
2013-12-22 20:59 - 2013-12-22 20:58 - 00000000 ____D C:\Program Files (x86)\OpenOffice 4
2013-12-22 20:57 - 2013-12-22 20:57 - 00000000 ____D C:\Users\...\Desktop\OpenOffice 4.0.1 (de) Installation Files
2013-12-22 20:57 - 2013-12-22 20:53 - 163606685 _____ C:\Users\...\Downloads\Apache_OpenOffice_4.0.1_Win_x86_install_de.exe
2013-12-21 11:51 - 2013-12-21 11:51 - 00000000 ____D C:\Users\...\Documents\Fax
2013-12-21 11:20 - 2012-08-03 12:03 - 00000000 ____D C:\Users\...\AppData\Local\PDFC
Some content of TEMP:
====================
C:\Users\...\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-01-10 13:53
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 17-01-2014 03
Ran by ... at 2014-01-19 11:09:10
Running from C:\Users\...\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)
Agatha Christie - Peril at End House (x32 Version: 2.2.0.95 - WildTangent) Hidden
AMD APP SDK Runtime (Version: 2.5.793.1 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Install Manager (Version: 3.0.851.0 - Advanced Micro Devices, Inc.)
AMD Media Foundation Decoders (Version: 1.0.61013.1636 - Advanced Micro Devices, Inc.) Hidden
Apple Application Support (x32 Version: 2.3.6 - Apple Inc.)
Apple Mobile Device Support (Version: 7.0.0.117 - Apple Inc.)
Apple Software Update (x32 Version: 2.1.3.127 - Apple Inc.)
ArcSoft TotalMedia (x32 Version: 1.0.48.25 - ArcSoft) Hidden
ArcSoft TotalMedia (x32 Version: 2.0.39.12 - ArcSoft)
ArcSoft Webcam Sharing Manager (x32 Version: 2.0.0.30 - ArcSoft)
Atheros Driver Installation Program (x32 Version: 9.2 - Atheros)
Avira Internet Security (x32 Version: 14.0.2.286 - Avira)
Bejeweled 2 Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Blasterball 3 (x32 Version: 2.2.0.95 - WildTangent) Hidden
Bluetooth Win7 Suite (64) (Version: 7.02.000.55 - Atheros Communications)
Bonjour (Version: 3.0.0.10 - Apple Inc.)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center (x32 Version: 2011.1013.1702.28713 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2011.1013.1702.28713 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2011.1013.1702.28713 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2011.1013.1702.28713 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Profiles Mobile (x32 Version: 2011.1013.1702.28713 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2011.1013.1701.28713 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2011.1013.1701.28713 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2011.1013.1701.28713 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2011.1013.1701.28713 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2011.1013.1701.28713 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2011.1013.1701.28713 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2011.1013.1701.28713 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2011.1013.1701.28713 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2011.1013.1701.28713 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2011.1013.1701.28713 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2011.1013.1701.28713 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2011.1013.1701.28713 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2011.1013.1701.28713 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2011.1013.1701.28713 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2011.1013.1701.28713 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2011.1013.1701.28713 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2011.1013.1701.28713 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2011.1013.1701.28713 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2011.1013.1701.28713 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2011.1013.1701.28713 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2011.1013.1701.28713 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2011.1013.1701.28713 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2011.1013.1702.28713 - Advanced Micro Devices, Inc.) Hidden
CCleaner (Version: 4.04 - Piriform)
CDBurnerXP (x32 Version: 4.5.2.4214 - CDBurnerXP)
Cisco EAP-FAST Module (x32 Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (x32 Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (x32 Version: 1.1.6 - Cisco Systems, Inc.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32 Version: - Microsoft)
Device Access Manager for HP ProtectTools (Version: 6.1.0.1 - Hewlett-Packard Company)
dm-Fotowelt (x32 Version: 5.1.2 - CEWE COLOR AG u Co. OHG)
Drive Encryption For HP ProtectTools (Version: 6.0.99.30652 - Hewlett-Packard Company)
ElsterFormular (x32 Version: 14.4.20130909 - Landesfinanzdirektion Thüringen)
Energy Star Digital Logo (x32 Version: 1.0.1 - Hewlett-Packard)
Face Recognition for HP ProtectTools (Version: 6.00.4407 - Hewlett-Packard Company)
Farm Frenzy (x32 Version: 2.2.0.95 - WildTangent) Hidden
File Sanitizer For HP ProtectTools (x32 Version: 6.0.0.8 - Hewlett-Packard Company)
Football Manager 2006 (x32 Version: 6.0.0 - SEGA)
Free YouTube to MP3 Converter version 3.12.17.1127 (x32 Version: 3.12.17.1127 - DVDVideoSoft Ltd.)
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Google Chrome (HKCU Version: 32.0.1700.76 - Google Inc.)
Hewlett-Packard ACLM.NET v1.1.2.0 (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
HP 3D DriveGuard (Version: 4.1.14.1 - Hewlett-Packard Company)
HP Auto (Version: 1.0.12494.3472 - Hewlett-Packard Company) Hidden
HP Connection Manager (x32 Version: 4.1.22.1 - Hewlett-Packard Company)
HP Customer Experience Enhancements (x32 Version: 6.0.1.7 - Hewlett-Packard) Hidden
HP Deskjet 3050A J611 series - Grundlegende Software für das Gerät (Version: 25.0.571.0 - Hewlett-Packard Co.)
HP Deskjet 3050A J611 series Hilfe (x32 Version: 140.0.2.2 - Hewlett Packard)
HP Documentation (x32 Version: 1.3.0.0 - Hewlett-Packard)
HP ESU for Microsoft Windows 7 (x32 Version: 2.0.6.1 - Hewlett-Packard Company)
HP Game Console (x32 Version: - WildTangent) Hidden
HP Games (x32 Version: 1.0.1.5 - WildTangent)
HP Hotkey Support (x32 Version: 4.6.4.1 - Hewlett-Packard Company)
HP Photo Creations (x32 Version: 1.0.0.5192 - HP Photo Creations)
HP Power Assistant (Version: 2.1.0.6 - Hewlett-Packard Company)
HP ProtectTools Security Manager (Version: 6.00.888 - Hewlett-Packard Company)
HP ProtectTools Security Manager (Version: 6.00.888 - Hewlett-Packard Company) Hidden
HP QuickWeb (x32 Version: 3.1.2.10229 - Hewlett-Packard Company)
HP Setup (x32 Version: 8.5.4526.3645 - Hewlett-Packard Company)
HP SoftPaq Download Manager (x32 Version: 3.2.0.0 - Hewlett-Packard Company)
HP Software Framework (x32 Version: 4.5.12.1 - Hewlett-Packard Company)
HP Software Setup (x32 Version: 8.2.1.1 - Hewlett-Packard Company)
HP Support Assistant (x32 Version: 6.1.12.1 - Hewlett-Packard Company)
HP System Default Settings (x32 Version: 2.3.1.2 - Hewlett-Packard Company)
HP Update (x32 Version: 5.005.000.001 - Hewlett-Packard)
HP Wallpaper (x32 Version: 2.00 - Hewlett-Packard Company)
HP Webcam Driver (x32 Version: 5.8.50058.0 - Sonix)
HPDiagnosticAlert (x32 Version: 1.00.0000 - Microsoft) Hidden
IDT Audio (x32 Version: 1.0.6367.0 - IDT)
Intel(R) Identity Protection Technology 1.0.71.0 (x32 Version: 1.0.71.0 - Intel Corporation)
Intel(R) Management Engine Components (x32 Version: 7.0.0.1144 - Intel Corporation)
Intel(R) Rapid Storage Technology (x32 Version: 10.1.2.1004 - Intel Corporation)
iTunes (Version: 11.1.3.8 - Apple Inc.)
JDownloader 0.9 (x32 Version: 0.9 - AppWork GmbH)
JDownloader Download Manager Packages (HKCU Version: - )
Jewel Quest II (x32 Version: 2.2.0.95 - WildTangent) Hidden
Jewel Quest Solitaire (x32 Version: 2.2.0.95 - WildTangent) Hidden
JMicron Flash Media Controller Driver (x32 Version: 1.0.57.2 - JMicron Technology Corp.)
John Deere Drive Green (x32 Version: 2.2.0.95 - WildTangent) Hidden
KeePass Password Safe 2.22 (x32 Version: - Dominik Reichl)
Landwirtschafts-Simulator 2009 (x32 Version: - GIANTS Software)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Home and Student 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Klick-und-Los 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Single Image 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (x32 Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Microsoft_VC90_CRT_x86 (x32 Version: 1.0.0 - Microsoft Corporation)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MyTomTom 3.2.0.1220 (x32 Version: 3.2.0.1220 - TomTom)
Open It! (x32 Version: 1.1.1 - OpenIt)
OpenOffice 4.0.1 (x32 Version: 4.01.9714 - Apache Software Foundation)
PDF Complete Special Edition (x32 Version: 4.0.64 - PDF Complete, Inc)
PDF24 Creator 5.4.0 (x32 Version: - PDF24.org)
Privacy Manager for HP ProtectTools (Version: 6.00.831 - Hewlett-Packard Company)
PX Profile Update (x32 Version: 1.00.1. - AMD) Hidden
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
RarZilla Free Unrar (x32 Version: 5.10 - Philipp Winterberg)
Realtek Ethernet Controller All-In-One Windows Driver (x32 Version: 1.12.0016 - Realtek)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.32.0 - Renesas Electronics Corporation)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.32.0 - Renesas Electronics Corporation) Hidden
Rossmann Fotowelt Software 4.13 (x32 Version: 4.13 - ORWO Net)
Schlaumäuse 2 (x32 Version: - Schlaumäuse)
SDK (x32 Version: 2.26.012 - Portrait Displays, Inc.) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version: - Microsoft) Hidden
Ski Challenge 14 (HKCU Version: - )
Synaptics Pointing Device Driver (Version: 16.0.3.0 - Synaptics Incorporated)
Theft Recovery for HP ProtectTools (x32 Version: 6.0.0.33 - Hewlett-Packard Company)
Theft Recovery for HP ProtectTools (x32 Version: 6.0.0.33 - Hewlett-Packard Company) Hidden
TomTom HOME (x32 Version: 2.9.6 - Ihr Firmenname)
TomTom HOME Visual Studio Merge Modules (x32 Version: 1.0.2 - TomTom International B.V.)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2836939) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2836939v3) (x32 Version: 3 - Microsoft Corporation)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Word 2010 (KB2837593) 32-Bit Edition (x32 Version: - Microsoft)
Update for Zip Opener (HKCU Version: - Update for Zip Opener) <==== ATTENTION
Validity Fingerprint Sensor Driver (Version: 4.3.117.0 - Validity Sensors, Inc.)
VIP Access SDK x64(1.0.0.50) (x32 Version: 1.0.0.50 - Symantec Inc.)
Visual Studio C++ 10.0 Runtime (x32 Version: 10.0.0 - TomTom International B.V.)
Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
WinZip 14.5 (x32 Version: 14.5.9095 - WinZip Computing, S.L. )
Xobni (x32 Version: 1.9.5.13282 - Xobni Corp.)
Xobni Core (x32 Version: 1.0.0 - Xobni, Inc.) Hidden
==================== Restore Points =========================
24-12-2013 09:58:30 Windows Update
28-12-2013 08:31:47 Windows Update
29-12-2013 18:00:08 Windows-Sicherung
31-12-2013 09:33:46 Windows Update
02-01-2014 18:39:28 Removed eM Client
06-01-2014 09:25:17 Windows-Sicherung
07-01-2014 13:11:39 Windows Update
13-01-2014 08:03:29 Windows-Sicherung
15-01-2014 08:19:29 Windows Update
15-01-2014 20:51:55 Windows Update
19-01-2014 10:02:41 Removed Amazon 1Button App
==================== Hosts content: ==========================
2009-07-14 03:34 - 2013-07-19 11:27 - 00000027 ____A C:\windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
Task: {02CFDF24-2679-4079-B5D1-D1A622949348} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-07-22] (Piriform Ltd)
Task: {216F9F56-5E80-42F2-ABFF-9BF708BCDF0C} - System32\Tasks\BrowserDefendert => Sc.exe start BrowserDefendert
Task: {49C5F7E3-448C-4F2C-B645-DE12CF2E51C4} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {4AF76957-167D-4888-9A46-0333E60128E6} - System32\Tasks\Digital Sites => C:\Users\...\AppData\Roaming\DigitalSites\UpdateProc\UpdateTask.exe [2013-04-12] () <==== ATTENTION
Task: {4DA571A8-11E9-402D-8D1F-21F3BE833308} - System32\Tasks\HPCeeScheduleFor...-HP$ => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14] (Hewlett-Packard)
Task: {4E8277B0-66F2-40B5-9175-00EE0CADBA38} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPSFMessenger\HPSFMsgr.exe [2011-09-09] (Hewlett-Packard Company)
Task: {54CF2057-7A24-452F-9AD8-158E31F40E6E} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2011-09-09] (Hewlett-Packard Company)
Task: {6C46E945-90B5-4B7F-9751-E9CBC6E0B025} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3657930280-3738987984-27973596-1002UA => C:\Users\...\AppData\Local\Google\Update\GoogleUpdate.exe [2012-08-03] (Google Inc.)
Task: {75260CB0-8A87-47E1-BE58-933B5DA6E057} - System32\Tasks\Google Updater and Installer => C:\Users\...\AppData\Local\Google\Update\GoogleUpdate.exe [2012-08-03] (Google Inc.)
Task: {832B9E2B-3B7E-4CB0-AD74-5FA7B5016DCC} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2011-09-09] (Hewlett-Packard Company)
Task: {97E07920-7682-4779-A72B-C93A15B24AB7} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Total Care Tune-Up => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPTuneUp.exe [2011-03-22] (Hewlett-Packard Company)
Task: {A204639D-DC7C-4450-843D-BCF0C3B34E8E} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-11] (Adobe Systems Incorporated)
Task: {ADAB16C1-EF04-4D53-8487-AB7E1DAF97FF} - System32\Tasks\HPCeeScheduleFor... => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14] (Hewlett-Packard)
Task: {B74F0623-F2CA-4586-8954-6242F0C48AA4} - System32\Tasks\HP Photo Creations Messager => C:\ProgramData\HP Photo Creations\MessageCheck.exe [2011-02-15] ()
Task: {C6F08E71-5358-4382-8A2C-F7C51A51F60A} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater\HPSFUpdater.exe [2013-02-19] (Hewlett-Packard)
Task: {F3873761-232B-420B-ABED-4EBEA33703FA} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {F4AC27E5-8A9A-45BC-A3AA-2A4F51CA7D3B} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3657930280-3738987984-27973596-1002Core => C:\Users\...\AppData\Local\Google\Update\GoogleUpdate.exe [2012-08-03] (Google Inc.)
Task: {F63EF6DB-8BD3-42FA-B00E-09EC3CC2C40A} - \You Lyrics Update No Task File
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\Digital Sites.job => C:\Users\GERDKU~1\AppData\Roaming\DIGITA~2\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3657930280-3738987984-27973596-1002Core.job => C:\Users\...\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3657930280-3738987984-27973596-1002UA.job => C:\Users\...\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\HP Photo Creations Messager.job => C:\ProgramData\HP Photo Creations\MessageCheck.exe
Task: C:\windows\Tasks\HPCeeScheduleFor...-HP$.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
Task: C:\windows\Tasks\HPCeeScheduleFor....job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
==================== Loaded Modules (whitelisted) =============
2012-05-18 22:45 - 2011-08-31 14:13 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2011-11-09 17:55 - 2011-11-09 17:55 - 00016384 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2011-11-02 22:03 - 2011-11-02 22:03 - 00024576 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\BrandingResources.dll
2011-10-14 00:01 - 2011-10-14 00:01 - 00369152 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2011-12-23 01:06 - 2011-06-11 11:42 - 01083392 _____ () C:\Program Files\Hewlett-Packard\HP Power Assistant\System.Data.SQLite.dll
2011-04-08 08:57 - 2011-04-08 08:57 - 01102336 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\System.Data.SQLite.dll
2012-11-08 09:50 - 2013-08-28 17:29 - 00394824 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2012-08-27 21:33 - 2012-08-27 21:33 - 00087912 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2012-08-27 21:33 - 2012-08-27 21:33 - 01242512 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2012-04-05 17:17 - 2012-04-05 17:17 - 02830336 _____ () C:\Program Files\Hewlett-Packard\Drive Encryption\EpePcEncryptionProviderPlugin.dll
2012-04-05 16:40 - 2012-04-05 16:40 - 00126976 _____ () C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHostInterface.dll
2012-04-05 17:20 - 2012-04-05 17:20 - 02863104 _____ () C:\Program Files\Hewlett-Packard\Drive Encryption\EpeHpDpHostPlugin.dll
2012-04-05 17:18 - 2012-04-05 17:18 - 00053248 _____ () C:\Program Files\Hewlett-Packard\Drive Encryption\EpeOpalATASec4SATA.dll
2012-04-05 16:44 - 2012-04-05 16:44 - 02035712 _____ () C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeCoreEncryptionPlugin.dll
2012-04-05 16:45 - 2012-04-05 16:45 - 01945600 _____ () C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeProductDetectionPlugin.dll
2012-04-05 17:15 - 2012-04-05 17:15 - 03092480 _____ () C:\Program Files\Hewlett-Packard\Drive Encryption\EpeOpalEncryptionProviderPlugin.dll
2012-11-08 09:50 - 2012-08-03 12:14 - 00447848 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\libxml2.dll
2012-11-08 09:50 - 2012-08-03 12:13 - 00060264 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\cares.dll
2010-09-06 12:18 - 2010-09-06 12:18 - 01412608 _____ () C:\windows\system32\LIBEAY32.dll
2013-08-22 16:27 - 2013-08-22 16:27 - 00169472 _____ () C:\windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\9ab0e818cb3d1b6930eba54179f89300\IsdiInterop.ni.dll
2012-05-19 08:16 - 2011-01-13 02:56 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2011-04-08 08:57 - 2011-04-08 08:57 - 00514570 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\sqlite3.dll
2014-01-17 19:42 - 2014-01-11 11:28 - 00715544 _____ () C:\Users\...\AppData\Local\Google\Chrome\Application\32.0.1700.76\libglesv2.dll
2014-01-17 19:42 - 2014-01-11 11:28 - 00100120 _____ () C:\Users\...\AppData\Local\Google\Chrome\Application\32.0.1700.76\libegl.dll
2014-01-17 19:43 - 2014-01-11 11:29 - 04055320 _____ () C:\Users\...\AppData\Local\Google\Chrome\Application\32.0.1700.76\pdf.dll
2014-01-17 19:43 - 2014-01-11 11:29 - 00399640 _____ () C:\Users\...\AppData\Local\Google\Chrome\Application\32.0.1700.76\ppGoogleNaClPluginChrome.dll
2014-01-17 19:42 - 2014-01-11 11:28 - 01634584 _____ () C:\Users\...\AppData\Local\Google\Chrome\Application\32.0.1700.76\ffmpegsumo.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (01/19/2014 10:48:58 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (01/19/2014 09:53:39 AM) (Source: Windows Search Service) (User: )
Description: Der Index kann nicht initialisiert werden.
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (01/19/2014 09:53:39 AM) (Source: Windows Search Service) (User: )
Description: Die Anwendung kann nicht initialisiert werden.
Kontext: Windows Anwendung
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (01/19/2014 09:53:39 AM) (Source: Windows Search Service) (User: )
Description: Das Gatherer-Objekt kann nicht initialisiert werden.
Kontext: Windows Anwendung, SystemIndex Katalog
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (01/19/2014 09:53:39 AM) (Source: Windows Search Service) (User: )
Description: Plug-In in <Search.TripoliIndexer> kann nicht initialisiert werden.
Kontext: Windows Anwendung, SystemIndex Katalog
Details:
Element nicht gefunden. (HRESULT : 0x80070490) (0x80070490)
Error: (01/19/2014 09:53:39 AM) (Source: Windows Search Service) (User: )
Description: Plug-In in <Search.JetPropStore> kann nicht initialisiert werden.
Kontext: Windows Anwendung, SystemIndex Katalog
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (01/19/2014 09:53:39 AM) (Source: Windows Search Service) (User: )
Description: Die Eigenschaftenspeicherdaten können von Windows Search nicht geladen werden.
Kontext: Windows Anwendung, SystemIndex Katalog
Details:
Die Inhaltsindexdatenbank ist fehlerhaft. (HRESULT : 0xc0041800) (0xc0041800)
Error: (01/19/2014 09:53:39 AM) (Source: Windows Search Service) (User: )
Description: Windows Search wird aufgrund eines Problems bei der Indizierung The catalog is corrupt beendet.
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (01/19/2014 09:53:39 AM) (Source: Windows Search Service) (User: )
Description: Vom Suchdienst wurden beschädigte Datendateien im Index {id=4700} erkannt. Vom Dienst wird versucht, dieses Problem durch Neuerstellung des Indexes automatisch zu beheben.
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (01/19/2014 09:53:39 AM) (Source: Windows Search Service) (User: )
Description: Der Jet-Eigenschaftenspeicher kann von Windows Search nicht geöffnet werden.
Details:
0x%08x (0xc0041800 - Die Inhaltsindexdatenbank ist fehlerhaft. (HRESULT : 0xc0041800))
System errors:
=============
Error: (01/19/2014 11:09:00 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "BrowserDefendert" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (01/19/2014 11:08:00 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "BrowserDefendert" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (01/19/2014 11:07:00 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "BrowserDefendert" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (01/19/2014 11:06:00 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "BrowserDefendert" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (01/19/2014 11:05:00 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "BrowserDefendert" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (01/19/2014 11:04:19 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Update Jump Flip" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 5000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (01/19/2014 11:04:00 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "BrowserDefendert" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (01/19/2014 11:03:00 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "BrowserDefendert" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (01/19/2014 11:02:00 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "BrowserDefendert" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (01/19/2014 11:01:00 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "BrowserDefendert" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Microsoft Office Sessions:
=========================
Error: (01/19/2014 10:48:58 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (01/19/2014 09:53:39 AM) (Source: Windows Search Service)(User: )
Description:
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (01/19/2014 09:53:39 AM) (Source: Windows Search Service)(User: )
Description: Kontext: Windows Anwendung
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (01/19/2014 09:53:39 AM) (Source: Windows Search Service)(User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Error: (01/19/2014 09:53:39 AM) (Source: Windows Search Service)(User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog
Details:
Element nicht gefunden. (HRESULT : 0x80070490) (0x80070490)
Search.TripoliIndexer
Error: (01/19/2014 09:53:39 AM) (Source: Windows Search Service)(User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
Search.JetPropStore
Error: (01/19/2014 09:53:39 AM) (Source: Windows Search Service)(User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog
Details:
Die Inhaltsindexdatenbank ist fehlerhaft. (HRESULT : 0xc0041800) (0xc0041800)
Error: (01/19/2014 09:53:39 AM) (Source: Windows Search Service)(User: )
Description:
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
The catalog is corrupt
Error: (01/19/2014 09:53:39 AM) (Source: Windows Search Service)(User: )
Description:
Details:
Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801)
4700
Error: (01/19/2014 09:53:39 AM) (Source: Windows Search Service)(User: )
Description:
Details:
0x%08x (0xc0041800 - Die Inhaltsindexdatenbank ist fehlerhaft. (HRESULT : 0xc0041800))
CodeIntegrity Errors:
===================================
Date: 2013-07-19 12:21:44.868
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-07-19 12:21:44.806
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Percentage of memory in use: 58%
Total physical RAM: 4030.36 MB
Available physical RAM: 1664.21 MB
Total Pagefile: 8058.89 MB
Available Pagefile: 4643.51 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:571.86 GB) (Free:484.83 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (HP_RECOVERY) (Fixed) (Total:19.02 GB) (Free:2.9 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive f: (HP_TOOLS) (Fixed) (Total:4.98 GB) (Free:0 GB) FAT32
Drive g: (FM 2006) (CDROM) (Total:0.64 GB) (Free:0 GB) CDFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 596 GB) (Disk ID: 12DEB3A0)
Partition 1: (Active) - (Size=300 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=572 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=19 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=5 GB) - (Type=0C)
==================== End Of Log ============================
|
|
19.01.2014, 11:32
| #2 | |
| /// the machine /// TB-Ausbilder    | Veränderungen am System - Virus eingefangen?Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!Downloade dir bitte Combofix vom folgenden Downloadspiegel Link 1 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
__________________ |
|
19.01.2014, 12:13
| #3 |
| | Veränderungen am System - Virus eingefangen? So hier die beiden, Gmer war noch am laufen lt den Anweisungen für den Einstieg, wollte es nicht abbrechen nach deiner schnellen Antwort.
__________________Bei Defogger lädt man übrigens gleich noch einige Programme dazu runter wie Amazon und so was  Code:
ATTFilter GMER 2.1.19324 - hxxp://www.gmer.net
Rootkit scan 2014-01-19 11:41:18
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Hitachi_ rev.JEDO 596,17GB
Running: 4kssopzn.exe; Driver: C:\Users\GERDKU~1\AppData\Local\Temp\kfdiraoc.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff80002e00000 52 bytes [FF, FF, FF, FF, FF, FF, FF, ...]
INITKDBG C:\windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 582 fffff80002e00036 27 bytes [FF, FF, FF, FF, FF, FF, FF, ...]
---- User code sections - GMER 2.1 ----
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[3056] C:\Windows\SysWOW64\ksuser.dll!KsCreatePin + 35 00000000719111a8 2 bytes [91, 71]
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[3056] C:\Windows\SysWOW64\ksuser.dll!KsCreateAllocator + 21 00000000719113a8 2 bytes [91, 71]
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[3056] C:\Windows\SysWOW64\ksuser.dll!KsCreateClock + 21 0000000071911422 2 bytes [91, 71]
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[3056] C:\Windows\SysWOW64\ksuser.dll!KsCreateTopologyNode + 19 0000000071911498 2 bytes [91, 71]
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[3056] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdWaitForVerticalBlank + 195 0000000071731b41 2 bytes [73, 71]
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[3056] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdWaitForVerticalBlank + 362 0000000071731be8 2 bytes [73, 71]
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[3056] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdWaitForVerticalBlank + 418 0000000071731c20 2 bytes [73, 71]
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[3056] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdWaitForVerticalBlank + 596 0000000071731cd2 2 bytes [73, 71]
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[3056] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdWaitForVerticalBlank + 628 0000000071731cf2 2 bytes [73, 71]
? C:\windows\system32\mssprxy.dll [3296] entry point in ".rdata" section 00000000717071e6
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3424] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075e01465 2 bytes [E0, 75]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3424] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075e014bb 2 bytes [E0, 75]
.text ... * 2
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[4540] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075e01465 2 bytes [E0, 75]
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[4540] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075e014bb 2 bytes [E0, 75]
.text ... * 2
.text c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe[2532] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075e01465 2 bytes [E0, 75]
.text c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe[2532] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075e014bb 2 bytes [E0, 75]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\SDKCOMServer.exe[3948] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075e01465 2 bytes [E0, 75]
.text C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\SDKCOMServer.exe[3948] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075e014bb 2 bytes [E0, 75]
.text ... * 2
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe[3328] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075e01465 2 bytes [E0, 75]
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe[3328] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075e014bb 2 bytes [E0, 75]
.text ... * 2
.text C:\windows\SysWOW64\rundll32.exe[6576] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075e01465 2 bytes [E0, 75]
.text C:\windows\SysWOW64\rundll32.exe[6576] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075e014bb 2 bytes [E0, 75]
.text ... * 2
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\446d571a7bab
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\446d571a7bab (not active ControlSet)
---- EOF - GMER 2.1 ----
Code:
ATTFilter ComboFix 14-01-16.03 - GerdKueller 19.01.2014 11:53:24.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.4030.1730 [GMT 1:00]
ausgeführt von:: c:\users\GerdKueller\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\GerdKueller\AppData\Local\Google\Chrome\User Data\Default\bProtector Web Data
c:\users\GerdKueller\AppData\Local\Google\Chrome\User Data\Default\bProtectorPreferences
c:\users\GerdKueller\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_eooncjejnppfjjklapaamhcdmjbilmde_0.localstorage
.
.
((((((((((((((((((((((((((((((((((((((( Treiber/Dienste )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_BrowserDefendert
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-12-19 bis 2014-01-19 ))))))))))))))))))))))))))))))
.
.
2014-01-19 10:08 . 2014-01-19 10:08 -------- d-----w- C:\FRST
2014-01-19 09:58 . 2014-01-19 09:58 -------- d-----w- c:\users\GerdKueller\.android
2014-01-19 09:58 . 2014-01-19 10:47 -------- d-----w- c:\users\GerdKueller\AppData\Roaming\newnext.me
2014-01-19 09:58 . 2014-01-19 10:05 -------- d-----w- c:\users\GerdKueller\AppData\Local\Mobogenie
2014-01-19 09:58 . 2014-01-19 09:58 -------- d-----w- c:\users\GerdKueller\AppData\Local\genienext
2014-01-19 09:57 . 2014-01-19 10:05 -------- d-----w- c:\program files (x86)\Amazon
2014-01-19 09:57 . 2014-01-19 10:05 -------- d-----w- c:\program files (x86)\Mobogenie
2014-01-19 09:56 . 2014-01-19 09:56 -------- d-----w- c:\program files (x86)\OpenIt
2014-01-19 09:56 . 2014-01-19 09:56 -------- d-----w- c:\users\GerdKueller\AppData\Roaming\DigitalSites
2014-01-18 08:52 . 2014-01-18 08:52 0 ----a-w- c:\windows\SysWow64\sho7C90.tmp
2014-01-17 18:40 . 2014-01-19 10:02 75888 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{76E4B879-CB95-425C-9D80-9A0424906383}\offreg.dll
2014-01-17 16:19 . 2014-01-17 16:19 -------- d-----w- c:\program files (x86)\Landwirtschafts-Simulator 2009
2014-01-17 08:26 . 2013-12-04 03:28 10315576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{76E4B879-CB95-425C-9D80-9A0424906383}\mpengine.dll
2014-01-15 08:19 . 2013-11-27 01:41 343040 ----a-w- c:\windows\system32\drivers\usbhub.sys
2014-01-15 08:19 . 2013-11-27 01:41 99840 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2014-01-15 08:19 . 2013-11-27 01:41 53248 ----a-w- c:\windows\system32\drivers\usbehci.sys
2014-01-15 08:19 . 2013-11-27 01:41 325120 ----a-w- c:\windows\system32\drivers\usbport.sys
2014-01-15 08:19 . 2013-11-27 01:41 25600 ----a-w- c:\windows\system32\drivers\usbohci.sys
2014-01-15 08:19 . 2013-11-27 01:41 30720 ----a-w- c:\windows\system32\drivers\usbuhci.sys
2014-01-15 08:19 . 2013-11-27 01:41 7808 ----a-w- c:\windows\system32\drivers\usbd.sys
2014-01-15 08:19 . 2013-11-26 10:32 3156480 ----a-w- c:\windows\system32\win32k.sys
2014-01-15 08:19 . 2013-11-26 11:40 376768 ----a-w- c:\windows\system32\drivers\netio.sys
2014-01-07 20:45 . 2014-01-07 20:45 0 ----a-w- c:\windows\SysWow64\sho8148.tmp
2014-01-05 20:50 . 2014-01-05 20:50 0 ----a-w- c:\windows\SysWow64\shoAB97.tmp
2013-12-22 20:02 . 2013-12-22 20:02 -------- d-----w- c:\users\GerdKueller\AppData\Roaming\OpenOffice
2013-12-22 19:58 . 2013-12-22 19:59 -------- d-----w- c:\program files (x86)\OpenOffice 4
2013-12-22 19:03 . 2013-12-22 19:03 -------- d-----w- c:\program files (x86)\Common Files\Intel Corporation
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-01-15 20:52 . 2012-08-03 11:45 86054176 ----a-w- c:\windows\system32\MRT.exe
2013-12-18 21:44 . 2013-12-18 21:44 0 ----a-w- c:\windows\SysWow64\sho67CC.tmp
2013-12-18 09:10 . 2013-12-18 09:10 49152 ----a-r- c:\users\GerdKueller\AppData\Roaming\Microsoft\Installer\{49CFD5D9-0556-4037-B7D6-E13ED4BEA4C5}\editor_EC0AB585B2794A778BB564C403E43EE7.exe
2013-12-17 12:06 . 2013-05-02 12:25 84720 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2013-12-17 12:06 . 2013-03-27 12:49 131576 ----a-w- c:\windows\system32\drivers\avipbb.sys
2013-12-17 12:06 . 2013-03-27 12:49 108440 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2013-12-11 15:32 . 2012-11-12 06:11 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-12-11 15:32 . 2012-11-12 06:11 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-12-11 15:32 . 2013-12-11 15:32 9293192 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe
2013-12-03 14:41 . 2013-12-03 14:41 0 ----a-w- c:\windows\SysWow64\sho379B.tmp
2013-11-28 10:25 . 2013-11-28 10:25 0 ----a-w- c:\windows\SysWow64\shoDC18.tmp
2013-11-27 08:09 . 2013-11-27 08:09 940032 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-11-27 08:09 . 2013-11-27 08:09 194048 ----a-w- c:\windows\SysWow64\elshyph.dll
2013-11-27 08:09 . 2013-11-27 08:09 71680 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2013-11-27 08:09 . 2013-11-27 08:09 645120 ----a-w- c:\windows\SysWow64\jsIntl.dll
2013-11-27 08:09 . 2013-11-27 08:09 235008 ----a-w- c:\windows\system32\elshyph.dll
2013-11-27 08:09 . 2013-11-27 08:09 182272 ----a-w- c:\windows\SysWow64\msls31.dll
2013-11-27 08:09 . 2013-11-27 08:09 62464 ----a-w- c:\windows\SysWow64\tdc.ocx
2013-11-27 08:09 . 2013-11-27 08:09 34816 ----a-w- c:\windows\SysWow64\JavaScriptCollectionAgent.dll
2013-11-27 08:09 . 2013-11-27 08:09 337408 ----a-w- c:\windows\SysWow64\html.iec
2013-11-27 08:09 . 2013-11-27 08:09 61952 ----a-w- c:\windows\SysWow64\iesetup.dll
2013-11-27 08:09 . 2013-11-27 08:09 454656 ----a-w- c:\windows\SysWow64\vbscript.dll
2013-11-27 08:09 . 2013-11-27 08:09 24576 ----a-w- c:\windows\SysWow64\licmgr10.dll
2013-11-27 08:09 . 2013-11-27 08:09 151552 ----a-w- c:\windows\SysWow64\iexpress.exe
2013-11-27 08:09 . 2013-11-27 08:09 139264 ----a-w- c:\windows\SysWow64\wextract.exe
2013-11-27 08:09 . 2013-11-27 08:09 1051136 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-11-27 08:09 . 2013-11-27 08:09 86016 ----a-w- c:\windows\SysWow64\iesysprep.dll
2013-11-27 08:09 . 2013-11-27 08:09 74240 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-11-27 08:09 . 2013-11-27 08:09 61952 ----a-w- c:\windows\SysWow64\MshtmlDac.dll
2013-11-27 08:09 . 2013-11-27 08:09 51200 ----a-w- c:\windows\SysWow64\ieetwproxystub.dll
2013-11-27 08:09 . 2013-11-27 08:09 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2013-11-27 08:09 . 2013-11-27 08:09 36352 ----a-w- c:\windows\SysWow64\imgutil.dll
2013-11-27 08:09 . 2013-11-27 08:09 13312 ----a-w- c:\windows\SysWow64\mshta.exe
2013-11-27 08:09 . 2013-11-27 08:09 112128 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2013-11-27 08:09 . 2013-11-27 08:09 111616 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-11-27 08:09 . 2013-11-27 08:09 942592 ----a-w- c:\windows\system32\jsIntl.dll
2013-11-27 08:09 . 2013-11-27 08:09 86016 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2013-11-27 08:09 . 2013-11-27 08:09 247808 ----a-w- c:\windows\system32\msls31.dll
2013-11-27 08:09 . 2013-11-27 08:09 90112 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-11-27 08:09 . 2013-11-27 08:09 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2013-11-27 08:09 . 2013-11-27 08:09 195584 ----a-w- c:\windows\system32\msrating.dll
2013-11-27 08:09 . 2013-11-27 08:09 13312 ----a-w- c:\windows\system32\msfeedssync.exe
2013-11-27 08:09 . 2013-11-27 08:09 131072 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-11-27 08:09 . 2013-11-27 08:09 84992 ----a-w- c:\windows\system32\mshtmled.dll
2013-11-27 08:09 . 2013-11-27 08:09 81408 ----a-w- c:\windows\system32\icardie.dll
2013-11-27 08:09 . 2013-11-27 08:09 77312 ----a-w- c:\windows\system32\tdc.ocx
2013-11-27 08:09 . 2013-11-27 08:09 626176 ----a-w- c:\windows\system32\msfeeds.dll
2013-11-27 08:09 . 2013-11-27 08:09 616104 ----a-w- c:\windows\system32\ieapfltr.dat
2013-11-27 08:09 . 2013-11-27 08:09 548352 ----a-w- c:\windows\system32\vbscript.dll
2013-11-27 08:09 . 2013-11-27 08:09 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-11-27 08:09 . 2013-11-27 08:09 453120 ----a-w- c:\windows\system32\dxtmsft.dll
2013-11-27 08:09 . 2013-11-27 08:09 413696 ----a-w- c:\windows\system32\html.iec
2013-11-27 08:09 . 2013-11-27 08:09 40448 ----a-w- c:\windows\system32\JavaScriptCollectionAgent.dll
2013-11-27 08:09 . 2013-11-27 08:09 30208 ----a-w- c:\windows\system32\licmgr10.dll
2013-11-27 08:09 . 2013-11-27 08:09 296960 ----a-w- c:\windows\system32\dxtrans.dll
2013-11-27 08:09 . 2013-11-27 08:09 263376 ----a-w- c:\windows\system32\iedkcs32.dll
2013-11-27 08:09 . 2013-11-27 08:09 243200 ----a-w- c:\windows\system32\webcheck.dll
2013-11-27 08:09 . 2013-11-27 08:09 235520 ----a-w- c:\windows\system32\url.dll
2013-11-27 08:09 . 2013-11-27 08:09 167424 ----a-w- c:\windows\system32\iexpress.exe
2013-11-27 08:09 . 2013-11-27 08:09 143872 ----a-w- c:\windows\system32\wextract.exe
2013-11-27 08:09 . 2013-11-27 08:09 1228800 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-11-27 08:09 . 2013-11-27 08:09 105984 ----a-w- c:\windows\system32\iesysprep.dll
2013-11-27 08:09 . 2013-11-27 08:09 101376 ----a-w- c:\windows\system32\inseng.dll
2013-11-27 08:09 . 2013-11-27 08:09 83968 ----a-w- c:\windows\system32\MshtmlDac.dll
2013-11-27 08:09 . 2013-11-27 08:09 774144 ----a-w- c:\windows\system32\jscript.dll
2013-11-27 08:09 . 2013-11-27 08:09 62464 ----a-w- c:\windows\system32\pngfilt.dll
2013-11-27 08:09 . 2013-11-27 08:09 48128 ----a-w- c:\windows\system32\imgutil.dll
2013-11-27 08:09 . 2013-11-27 08:09 147968 ----a-w- c:\windows\system32\occache.dll
2013-11-27 08:09 . 2013-11-27 08:09 13824 ----a-w- c:\windows\system32\mshta.exe
2013-11-27 08:09 . 2013-11-27 08:09 135680 ----a-w- c:\windows\system32\iepeers.dll
2013-11-26 19:43 . 2013-11-26 19:43 0 ----a-w- c:\windows\SysWow64\shoE510.tmp
2013-11-26 11:54 . 2013-12-13 19:43 23183360 ----a-w- c:\windows\system32\mshtml.dll
2013-11-26 10:19 . 2013-12-13 19:43 2724864 ----a-w- c:\windows\system32\mshtml.tlb
2013-11-26 10:18 . 2013-12-13 19:43 4096 ----a-w- c:\windows\system32\ieetwcollectorres.dll
2013-11-26 09:48 . 2013-12-13 19:43 66048 ----a-w- c:\windows\system32\iesetup.dll
2013-11-26 09:46 . 2013-12-13 19:43 48640 ----a-w- c:\windows\system32\ieetwproxystub.dll
2013-11-26 09:41 . 2013-12-13 19:43 2764288 ----a-w- c:\windows\system32\iertutil.dll
2013-11-26 09:29 . 2013-12-13 19:43 53760 ----a-w- c:\windows\system32\jsproxy.dll
2013-11-26 09:27 . 2013-12-13 19:43 33792 ----a-w- c:\windows\system32\iernonce.dll
2013-11-26 09:23 . 2013-12-13 19:43 2724864 ----a-w- c:\windows\SysWow64\mshtml.tlb
2013-11-26 09:21 . 2013-12-13 19:43 574976 ----a-w- c:\windows\system32\ieui.dll
2013-11-26 09:18 . 2013-12-13 19:43 139264 ----a-w- c:\windows\system32\ieUnatt.exe
2013-11-26 09:18 . 2013-12-13 19:43 111616 ----a-w- c:\windows\system32\ieetwcollector.exe
2013-11-26 09:16 . 2013-12-13 19:43 708608 ----a-w- c:\windows\system32\jscript9diag.dll
2013-11-26 08:57 . 2013-12-13 19:43 218624 ----a-w- c:\windows\system32\ie4uinit.exe
2013-11-26 08:35 . 2013-12-13 19:43 5769216 ----a-w- c:\windows\system32\jscript9.dll
2013-11-26 08:28 . 2013-12-13 19:43 553472 ----a-w- c:\windows\SysWow64\jscript9diag.dll
2013-11-26 08:16 . 2013-12-13 19:43 4243968 ----a-w- c:\windows\SysWow64\jscript9.dll
2013-11-26 08:02 . 2013-12-13 19:43 1995264 ----a-w- c:\windows\system32\inetcpl.cpl
2013-11-26 07:48 . 2013-12-13 19:43 12996608 ----a-w- c:\windows\system32\ieframe.dll
2013-11-26 07:32 . 2013-12-13 19:43 1928192 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2013-11-26 07:07 . 2013-12-13 19:43 2334208 ----a-w- c:\windows\system32\wininet.dll
2013-11-26 06:40 . 2013-12-13 19:43 1395200 ----a-w- c:\windows\system32\urlmon.dll
2013-11-26 06:34 . 2013-12-13 19:43 817664 ----a-w- c:\windows\system32\ieapfltr.dll
2013-11-26 06:33 . 2013-12-13 19:43 1820160 ----a-w- c:\windows\SysWow64\wininet.dll
2013-11-23 18:26 . 2013-12-11 08:22 417792 ----a-w- c:\windows\SysWow64\WMPhoto.dll
2013-11-23 17:47 . 2013-12-11 08:22 465920 ----a-w- c:\windows\system32\WMPhoto.dll
2013-11-19 02:33 . 2010-11-21 03:27 267936 ------w- c:\windows\system32\MpSigStub.exe
2013-11-12 12:31 . 2013-03-27 12:49 28600 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2013-11-12 02:23 . 2013-12-11 08:22 2048 ----a-w- c:\windows\system32\tzres.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GoogleChromeAutoLaunch_AAFC616226BCC3127F5CDD44D42DFCFD"="c:\users\GerdKueller\AppData\Local\Google\Chrome\Application\chrome.exe" [2014-01-11 866584]
"HP Deskjet 3050A J611 series (NET)"="c:\program files\HP\HP Deskjet 3050A J611 series\Bin\ScanToPCActivationApp.exe" [2011-06-08 2676584]
"NextLive"="c:\users\GerdKueller\AppData\Roaming\newnext.me\nengine.dll" [2013-11-14 1283584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"File Sanitizer"="c:\program files (x86)\Hewlett-Packard\File Sanitizer\CoreShredder.exe" [2011-02-07 12274688]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-01-26 283160]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-11-17 113288]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-10-13 343168]
"DTRun"="c:\program files (x86)\ArcSoft\TotalMedia Suite\TotalMedia Theatre 3\uDTRun.exe" [2010-11-24 517456]
"PDF Complete"="c:\program files (x86)\PDF Complete\pdfsty.exe" [2011-08-11 658424]
"QLBController"="c:\program files (x86)\Hewlett-Packard\HP Hotkey Support\QLBController.exe" [2012-06-20 333728]
"HPConnectionManager"="c:\program files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe" [2011-05-23 103992]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-12-17 684600]
"KeePass 2 PreLoad"="c:\program files (x86)\KeePass Password Safe 2\KeePass.exe" [2013-04-05 1960448]
"HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2011-10-28 49208]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-11-01 152392]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableSecureUIAPath"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DeviceNP]
2011-05-09 23:43 75320 ----a-w- c:\windows\System32\DeviceNP.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ DPPassFilter scecli
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"HPQuickWebProxy"="c:\program files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 HP Power Assistant Service;HP Power Assistant Service;c:\program files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe;c:\program files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe [x]
R2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [x]
R2 XobniService;XobniService;c:\program files (x86)\Xobni\XobniService.exe;c:\program files (x86)\Xobni\XobniService.exe [x]
R3 DAMDrv;DAMDrv;c:\windows\system32\DRIVERS\DAMDrv64.sys;c:\windows\SYSNATIVE\DRIVERS\DAMDrv64.sys [x]
R3 FLCDLOCK;HP ProtectTools Device Locking / Auditing;c:\windows\SysWOW64\flcdlock.exe;c:\windows\SysWOW64\flcdlock.exe [x]
R3 hpCMSrv;HP Connection Manager 4 Service;c:\program files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe;c:\program files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
S0 MfeEpeOpal;MfeEpeOpal; [x]
S0 MfeEpePc;MfeEpePc; [x]
S1 avfwot;avfwot;c:\windows\system32\DRIVERS\avfwot.sys;c:\windows\SYSNATIVE\DRIVERS\avfwot.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe;c:\program files\IDT\WDM\AESTSr64.exe [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AntiVirFirewallService;Avira FireWall;c:\program files (x86)\Avira\AntiVir Desktop\avfwsvc.exe;c:\program files (x86)\Avira\AntiVir Desktop\avfwsvc.exe [x]
S2 AntiVirMailService;Avira Email Schutz;c:\program files (x86)\Avira\AntiVir Desktop\avmailc.exe;c:\program files (x86)\Avira\AntiVir Desktop\avmailc.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [x]
S2 Atheros Bt&Wlan Coex Agent;Atheros Bt&Wlan Coex Agent;c:\program files (x86)\Bluetooth Suite\Ath_CoexAgent.exe;c:\program files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [x]
S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Bluetooth Suite\adminservice.exe;c:\program files (x86)\Bluetooth Suite\adminservice.exe [x]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x]
S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [x]
S2 HPFSService;File Sanitizer for HP ProtectTools;c:\program files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe;c:\program files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe [x]
S2 hpHotkeyMonitor;hpHotkeyMonitor;c:\program files (x86)\Hewlett-Packard\HP Hotkey Support\HpHotkeyMonitor.exe;c:\program files (x86)\Hewlett-Packard\HP Hotkey Support\HpHotkeyMonitor.exe [x]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe;c:\windows\SYSNATIVE\Hpservice.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 jhi_service;Intel(R) Identity Protection Technology Host Interface Service;c:\program files (x86)\Intel\Services\IPT\jhi_service.exe;c:\program files (x86)\Intel\Services\IPT\jhi_service.exe [x]
S2 McAfee Endpoint Encryption Agent;McAfee Endpoint Encryption Agent;c:\program files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe;c:\program files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe [x]
S2 pdfcDispatcher;PDF Document Manager;c:\program files (x86)\PDF Complete\pdfsvc.exe;c:\program files (x86)\PDF Complete\pdfsvc.exe [x]
S2 PdiService;Portrait Displays SDK Service;c:\program files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe;c:\program files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe [x]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [x]
S2 TomTomHOMEService;TomTomHOMEService;c:\program files (x86)\TomTom HOME 2\TomTomHOMEService.exe;c:\program files (x86)\TomTom HOME 2\TomTomHOMEService.exe [x]
S2 uArcCapture;ArcCapture;c:\windows\SysWow64\ArcVCapRender\uArcCapture.exe;c:\windows\SysWow64\ArcVCapRender\uArcCapture.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S2 vcsFPService;Validity VCS Fingerprint Service;c:\windows\system32\vcsFPService.exe;c:\windows\SYSNATIVE\vcsFPService.exe [x]
S3 ARCVCAM;ARCVCAM, ArcSoft Webcam Sharing Manager Driver;c:\windows\system32\DRIVERS\ArcSoftVCapture.sys;c:\windows\SYSNATIVE\DRIVERS\ArcSoftVCapture.sys [x]
S3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_flt.sys [x]
S3 avfwim;AvFw Packet Filter Miniport;c:\windows\system32\DRIVERS\avfwim.sys;c:\windows\SYSNATIVE\DRIVERS\avfwim.sys [x]
S3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys;c:\windows\SYSNATIVE\drivers\btath_a2dp.sys [x]
S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys;c:\windows\SYSNATIVE\DRIVERS\btath_bus.sys [x]
S3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys;c:\windows\SYSNATIVE\DRIVERS\btath_hcrp.sys [x]
S3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_lwflt.sys [x]
S3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys;c:\windows\SYSNATIVE\DRIVERS\btath_rcp.sys [x]
S3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys;c:\windows\SYSNATIVE\DRIVERS\btfilter.sys [x]
S3 HP ProtectTools Service;HP ProtectTools Service;c:\program files (x86)\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe;c:\program files (x86)\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe [x]
S3 intelkmd;intelkmd;c:\windows\system32\DRIVERS\igdpmd64.sys;c:\windows\SYSNATIVE\DRIVERS\igdpmd64.sys [x]
S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys;c:\windows\SYSNATIVE\DRIVERS\jmcr.sys [x]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2014-01-19 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-11-12 15:32]
.
2014-01-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3657930280-3738987984-27973596-1002Core.job
- c:\users\GerdKueller\AppData\Local\Google\Update\GoogleUpdate.exe [2012-08-03 11:06]
.
2014-01-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3657930280-3738987984-27973596-1002UA.job
- c:\users\GerdKueller\AppData\Local\Google\Update\GoogleUpdate.exe [2012-08-03 11:06]
.
2014-01-19 c:\windows\Tasks\HP Photo Creations Messager.job
- c:\programdata\HP Photo Creations\MessageCheck.exe [2011-02-15 10:11]
.
2013-12-30 c:\windows\Tasks\HPCeeScheduleForGERDKUELLER-HP$.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 06:15]
.
2014-01-17 c:\windows\Tasks\HPCeeScheduleForGerdKueller.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 06:15]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AtherosBtStack"="c:\program files (x86)\Bluetooth Suite\BtvStack.exe" [2011-01-07 615584]
"AthBtTray"="c:\program files (x86)\Bluetooth Suite\AthBtTray.exe" [2011-01-07 379040]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-08-31 167704]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-08-31 392472]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-08-31 416024]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2012-08-16 1424896]
"HPPowerAssistant"="c:\program files\Hewlett-Packard\HP Power Assistant\DelayedAppStarter.exe" [2011-07-15 14904]
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://search.softonic.com/MOY00621/tb_v1?SearchSource=10&cc=&mi=8eaa5d18000000000000446d571a1eb3
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com
IE: An OneNote s&enden - c:\progra~2\MICROS~2\Office14\ONBttnIE.dll/105
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~2\Office14\EXCEL.EXE/3000
LSP: c:\program files (x86)\Avira\AntiVir Desktop\avsda.dll
TCP: DhcpNameServer = 192.168.2.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{26B19FA4-E8A1-4A1B-A163-1A1E46F830DD} - (no file)
Wow6432Node-HKCU-Run-LiveSupport - c:\program files (x86)\LiveSupport\LiveSupport.exe
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
Wow6432Node-HKLM-Run-mobilegeni daemon - c:\program files (x86)\Mobogenie\DaemonProcess.exe
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-{6F44AF95-3CDE-4513-AD3F-6D45F17BF324} - c:\program files (x86)\InstallShield Installation Information\{6F44AF95-3CDE-4513-AD3F-6D45F17BF324}\setup.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\pdfcDispatcher]
"ImagePath"="c:\program files (x86)\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_170_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_170_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Hewlett-Packard\HP Software Framework\{F7A31DE6-534B-4564-808A-7D170A9F74A1}\DeviceDbcc\È]p*€n*]
@="?pbn"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Hewlett-Packard\HP Software Framework\{F7A31DE6-534B-4564-808A-7D170A9F74A1}\DeviceDbcc\Øx/*hö,*]
@="?/?,"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Hewlett-Packard\HP Software Framework\{F7A31DE6-534B-4564-808A-7D170A9F74A1}\DeviceDbcc\€|/*]
@="?/"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
c:\program files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2014-01-19 12:09:32 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2014-01-19 11:09
.
Vor Suchlauf: 16 Verzeichnis(se), 520.502.054.912 Bytes frei
Nach Suchlauf: 18 Verzeichnis(se), 520.514.211.840 Bytes frei
.
- - End Of File - - 1527A4D2070FFF27407E0C08F6D85332
|
|
20.01.2014, 09:54
| #4 | |
| /// the machine /// TB-Ausbilder | Veränderungen am System - Virus eingefangen?Zitat:
 Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
20.01.2014, 20:20
| #5 |
| | Veränderungen am System - Virus eingefangen?Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2014.01.20.04 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 11.0.9600.16476 GerdKueller :: GERDKUELLER-HP [Administrator] 20.01.2014 12:21:02 mbam-log-2014-01-20 (12-21-02).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 210423 Laufzeit: 4 Minute(n), 44 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 1 C:\Users\GerdKueller\AppData\Roaming\newnext.me\nengine.dll (PUP.Optional.NextLive.A) -> Löschen bei Neustart. Infizierte Registrierungsschlüssel: 5 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Digital Sites (PUP.Optional.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\Software\Distromatic\Toolbars (PUP.Optional.AlexaTB.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\Software\InstallCore\1I1T1Q1S (PUP.Optional.InstallCore.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\INSTALLCORE (PUP.Optional.InstallCore.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings (PUP.Optional.BProtector.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Registrierungswerte: 2 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|NextLive (PUP.Optional.NextLive.A) -> Daten: C:\windows\SysWOW64\rundll32.exe "C:\Users\GerdKueller\AppData\Roaming\newnext.me\nengine.dll",EntryPoint -m l -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\Software\InstallCore|tb (PUP.Optional.InstallCore.A) -> Daten: 0H1L1J1L1S1R1N -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 6 C:\Users\GerdKueller\AppData\Roaming\DigitalSites\UpdateProc (PUP.Optional.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\GerdKueller\AppData\Roaming\OpenCandy (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\GerdKueller\AppData\Roaming\OpenCandy\4514C4495C654682A92E75DFD36AF9F8 (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\GerdKueller\AppData\Roaming\OpenCandy\A09262365B5A49F497BB5934F2B4A47B (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\GerdKueller\AppData\Roaming\newnext.me (PUP.Optional.NextLive.A) -> Löschen bei Neustart. C:\Users\GerdKueller\AppData\Roaming\newnext.me\cache (PUP.Optional.NextLive.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateien: 11 C:\Users\GerdKueller\Downloads\InstallRarZilla.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\GerdKueller\AppData\Roaming\DigitalSites\UpdateProc\UpdateTask.exe (PUP.Optional.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\GerdKueller\AppData\Roaming\DigitalSites\UpdateProc\config.dat (PUP.Optional.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\GerdKueller\AppData\Roaming\DigitalSites\UpdateProc\prod.dat (PUP.Optional.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\GerdKueller\AppData\Roaming\DigitalSites\UpdateProc\STTL.DAT (PUP.Optional.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\GerdKueller\AppData\Roaming\DigitalSites\UpdateProc\TTL.DAT (PUP.Optional.Updater) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\GerdKueller\AppData\Roaming\newnext.me\nengine.dll (PUP.Optional.NextLive.A) -> Löschen bei Neustart. C:\Users\GerdKueller\AppData\Roaming\OpenCandy\4514C4495C654682A92E75DFD36AF9F8\Setupsft_chr_p1v7.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\GerdKueller\AppData\Roaming\OpenCandy\A09262365B5A49F497BB5934F2B4A47B\Trial-14.0.1000.89_de-DE_1004732_DE-1.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\GerdKueller\AppData\Roaming\newnext.me\nengine.cookie (PUP.Optional.NextLive.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\GerdKueller\AppData\Roaming\newnext.me\cache\spark.bin (PUP.Optional.NextLive.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) Code:
ATTFilter # AdwCleaner v3.017 - Bericht erstellt am 20/01/2014 um 13:22:09
# Aktualisiert 12/01/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : GerdKueller - GERDKUELLER-HP
# Gestartet von : C:\Users\GerdKueller\Desktop\adwcleaner.exe
# Option : Suchen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Datei Gefunden : C:\Users\GerdKueller\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_igdhbblpcellaljokkpfhcjlagemhgjl_0.localstorage
Datei Gefunden : C:\windows\System32\Tasks\BrowserDefendert
Ordner Gefunden C:\Program Files (x86)\Mobogenie
Ordner Gefunden C:\ProgramData\Babylon
Ordner Gefunden C:\ProgramData\BrowserDefender
Ordner Gefunden C:\Users\GerdKueller\AppData\Local\genienext
Ordner Gefunden C:\Users\GerdKueller\AppData\Local\Mobogenie
Ordner Gefunden C:\Users\GerdKueller\AppData\LocalLow\Softonic
Ordner Gefunden C:\Users\GerdKueller\Documents\Mobogenie
Ordner Gefunden C:\Users\GerdKueller\Documents\PC Speed Maximizer
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gefunden : HKCU\Software\53538f88b168ed49
Schlüssel Gefunden : HKCU\Software\Delta
Schlüssel Gefunden : HKCU\Software\distromatic
Schlüssel Gefunden : HKCU\Software\dsiteproducts
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{483830EE-A4CD-4B71-B0A3-3D82E62A6909}
Schlüssel Gefunden : [x64] HKCU\Software\Delta
Schlüssel Gefunden : [x64] HKCU\Software\distromatic
Schlüssel Gefunden : [x64] HKCU\Software\dsiteproducts
Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{483830EE-A4CD-4B71-B0A3-3D82E62A6909}
Schlüssel Gefunden : HKLM\SOFTWARE\53538f88b168ed49
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{7ABBFE1C-E485-44AA-8F36-353751B4124D}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\driverscanner
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\speedupmypc
Schlüssel Gefunden : HKLM\Software\DataMngr
Schlüssel Gefunden : HKLM\Software\Delta
Schlüssel Gefunden : HKLM\Software\FLEXnet
Schlüssel Gefunden : HKLM\SOFTWARE\Google\Chrome\Extensions\bkjllalecbfjgljbohjbjbcnimkeehdd
Schlüssel Gefunden : HKLM\SOFTWARE\Google\Chrome\Extensions\gfhdkohbepelnfckgjinfddmecpngnpb
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\BingBar_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\driverscanner_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\driverscanner_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\smartbar_rasapi32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\smartbar_rasmancs
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MobogenieAdd
Schlüssel Gefunden : HKLM\Software\Uniblue
Schlüssel Gefunden : HKLM\Software\Uniblue\DriverScanner
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Optimizer Pro_is1
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.16428
Einstellung Gefunden : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page] - hxxp://search.softonic.com/MOY00621/tb_v1?SearchSource=10&cc=&mi=8eaa5d18000000000000446d571a1eb3
-\\ Google Chrome v
[ Datei : C:\Users\GerdKueller\AppData\Local\Google\Chrome\User Data\Default\preferences ]
*************************
AdwCleaner[R0].txt - [4027 octets] - [20/01/2014 13:22:09]
########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [4087 octets] ##########
Code:
ATTFilter # AdwCleaner v3.017 - Bericht erstellt am 20/01/2014 um 13:25:25
# Aktualisiert 12/01/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : GerdKueller - GERDKUELLER-HP
# Gestartet von : C:\Users\GerdKueller\Desktop\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\ProgramData\BrowserDefender
Ordner Gelöscht : C:\Program Files (x86)\Mobogenie
Ordner Gelöscht : C:\Users\GerdKueller\AppData\Local\genienext
Ordner Gelöscht : C:\Users\GerdKueller\AppData\Local\Mobogenie
Ordner Gelöscht : C:\Users\GerdKueller\AppData\LocalLow\Softonic
Ordner Gelöscht : C:\Users\GerdKueller\Documents\Mobogenie
Ordner Gelöscht : C:\Users\GerdKueller\Documents\PC Speed Maximizer
Datei Gelöscht : C:\Users\GerdKueller\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_igdhbblpcellaljokkpfhcjlagemhgjl_0.localstorage
Datei Gelöscht : C:\windows\System32\Tasks\BrowserDefendert
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\bkjllalecbfjgljbohjbjbcnimkeehdd
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\gfhdkohbepelnfckgjinfddmecpngnpb
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\driverscanner
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\speedupmypc
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BingBar_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\driverscanner_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\driverscanner_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\smartbar_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\smartbar_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MobogenieAdd
Schlüssel Gelöscht : HKCU\Software\53538f88b168ed49
Schlüssel Gelöscht : HKLM\SOFTWARE\53538f88b168ed49
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{7ABBFE1C-E485-44AA-8F36-353751B4124D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{483830EE-A4CD-4B71-B0A3-3D82E62A6909}
Schlüssel Gelöscht : HKCU\Software\Delta
Schlüssel Gelöscht : HKCU\Software\distromatic
Schlüssel Gelöscht : HKCU\Software\dsiteproducts
Schlüssel Gelöscht : HKLM\Software\DataMngr
Schlüssel Gelöscht : HKLM\Software\Delta
Schlüssel Gelöscht : HKLM\Software\FLEXnet
Schlüssel Gelöscht : HKLM\Software\Uniblue
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Optimizer Pro_is1
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.16428
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
-\\ Google Chrome v
[ Datei : C:\Users\GerdKueller\AppData\Local\Google\Chrome\User Data\Default\preferences ]
*************************
AdwCleaner[R0].txt - [4191 octets] - [20/01/2014 13:22:09]
AdwCleaner[S0].txt - [3573 octets] - [20/01/2014 13:25:25]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [3633 octets] ##########
FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 19-01-2014 04
Ran by GerdKueller (administrator) on GERDKUELLER-HP on 20-01-2014 15:19:00
Running from C:\Users\GerdKueller\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(Validity Sensors, Inc.) C:\Windows\System32\vcsFPService.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\HPHotkeyMonitor.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
() C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe
(PDF Complete Inc) C:\Program Files (x86)\PDF Complete\pdfsvc.exe
(Portrait Displays, Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(ArcSoft, Inc.) C:\Windows\SysWOW64\ArcVCapRender\uArcCapture.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(Hewlett-Packard Development Company, L.P) C:\Program Files (x86)\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe
(DigitalPersona, Inc.) C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3050A J611 series\Bin\ScanToPCActivationApp.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\coreshredder.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\QLBController.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpAgent.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe
(Portrait Displays, Inc) C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\SDKCOMServer.exe
(Hewlett-Packard Development Company L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPConnectionManager.exe
(Portrait Displays, Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdiSDKHelperx64.exe
(Hewlett-Packard Development Company L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2887440 2012-08-16] (Synaptics Incorporated)
HKLM\...\Run: [AtherosBtStack] - C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [615584 2011-01-07] (Atheros Communications)
HKLM\...\Run: [AthBtTray] - C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [379040 2011-01-07] (Atheros Commnucations)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [1424896 2012-08-16] (IDT, Inc.)
HKLM\...\Run: [HPPowerAssistant] - C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe [2996792 2011-07-15] (Hewlett-Packard Company)
HKLM-x32\...\Run: [File Sanitizer] - C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\CoreShredder.exe [12274688 2011-02-07] (Hewlett-Packard)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-26] (Intel Corporation)
HKLM-x32\...\Run: [NUSB3MON] - c:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2011-10-14] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [DTRun] - c:\Program Files (x86)\ArcSoft\TotalMedia Suite\TotalMedia Theatre 3\uDTRun.exe [517456 2010-11-24] (ArcSoft Inc.)
HKLM-x32\...\Run: [PDF Complete] - C:\Program Files (x86)\PDF Complete\pdfsty.exe [658424 2011-08-11] (PDF Complete Inc)
HKLM-x32\...\Run: [QLBController] - C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\QLBController.exe [333728 2012-06-20] (Hewlett-Packard Company)
HKLM-x32\...\Run: [HPConnectionManager] - C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe [103992 2011-05-23] (Hewlett-Packard Development Company L.P.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-17] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [KeePass 2 PreLoad] - C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [1960448 2013-04-05] (Dominik Reichl)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe,
Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\DeviceNP-x32: DeviceNP.dll [X]
HKCU\...\Run: [GoogleChromeAutoLaunch_AAFC616226BCC3127F5CDD44D42DFCFD] - C:\Users\GerdKueller\AppData\Local\Google\Chrome\Application\chrome.exe [866584 2014-01-11] (Google Inc.)
HKCU\...\Run: [HP Deskjet 3050A J611 series (NET)] - C:\Program Files\HP\HP Deskjet 3050A J611 series\Bin\ScanToPCActivationApp.exe [2676584 2011-06-08] (Hewlett-Packard Co.)
Lsa: [Notification Packages] DPPassFilter scecli
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {08A8EBCA-D913-46C4-A4EE-6E65CFB387D0} URL = hxxp://search.softonic.com/MOY00621/tb_v1?q={searchTerms}&SearchSource=4&cc=&mi=8eaa5d18000000000000446d571a1eb3&r=698
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: No Name - {26B19FA4-E8A1-4A1B-A163-1A1E46F830DD} - No File
BHO-x32: File Sanitizer for HP ProtectTools - {3134413B-49B4-425C-98A5-893C1F195601} - C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\IEBHO.dll (Hewlett-Packard)
BHO-x32: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Chrome:
=======
CHR Extension: (Adblock Plus) - C:\Users\GerdKueller\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-01-20]
CHR Extension: (Google Wallet) - C:\Users\GerdKueller\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23]
CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\DVDVideoSoftBrowserExtension.crx [2013-08-23]
==================== Services (Whitelisted) =================
S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 AntiVirFirewallService; C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe [1012280 2013-12-17] (Avira Operations GmbH & Co. KG)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [896056 2013-12-17] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-17] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-12] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1011768 2013-12-17] (Avira Operations GmbH & Co. KG)
R2 Atheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [138400 2011-01-07] (Atheros)
R2 DpHost; c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe [481104 2011-02-12] (DigitalPersona, Inc.)
S3 FLCDLOCK; c:\Windows\SysWOW64\flcdlock.exe [476728 2011-09-05] (Hewlett-Packard Company)
R3 HP ProtectTools Service; c:\Program Files (x86)\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe [36864 2011-01-12] (Hewlett-Packard Development Company, L.P)
R2 hpHotkeyMonitor; C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\HpHotkeyMonitor.exe [523680 2012-06-20] (Hewlett-Packard Company)
R2 McAfee Endpoint Encryption Agent; C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe [1323008 2012-04-05] ()
R2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1128952 2011-08-11] (PDF Complete Inc)
R2 uArcCapture; C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe [502464 2010-11-11] (ArcSoft, Inc.)
S2 XobniService; C:\Program Files (x86)\Xobni\XobniService.exe [62184 2011-03-07] (Xobni Corporation)
==================== Drivers (Whitelisted) ====================
R3 ARCVCAM; C:\Windows\System32\DRIVERS\ArcSoftVCapture.sys [32192 2010-11-11] (ArcSoft, Inc.)
R3 avfwim; C:\Windows\System32\DRIVERS\avfwim.sys [114608 2013-02-12] (Avira GmbH)
R1 avfwot; C:\Windows\System32\DRIVERS\avfwot.sys [141376 2013-02-12] (Avira GmbH)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-12] (Avira Operations GmbH & Co. KG)
S3 DAMDrv; C:\Windows\System32\DRIVERS\DAMDrv64.sys [64312 2011-05-10] (Hewlett-Packard Company)
R0 MfeEpeOpal; C:\Windows\System32\Drivers\MfeEpeOpal.sys [100808 2012-04-05] (McAfee, Inc.)
R0 MfeEpePc; C:\Windows\System32\Drivers\MfeEpePc.sys [158920 2012-04-05] (McAfee, Inc.)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1826048 2010-12-21] ()
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-01-20 15:19 - 2014-01-20 15:19 - 00015423 _____ C:\Users\GerdKueller\Desktop\FRST.txt
2014-01-20 15:18 - 2014-01-20 15:18 - 00000000 ____D C:\Users\GerdKueller\Desktop\FRST-OlderVersion
2014-01-20 13:22 - 2014-01-20 13:25 - 00000000 ____D C:\AdwCleaner
2014-01-20 13:18 - 2014-01-20 13:26 - 00000112 _____ C:\windows\setupact.log
2014-01-20 13:18 - 2014-01-20 13:18 - 00004072 _____ C:\windows\PFRO.log
2014-01-20 13:18 - 2014-01-20 13:18 - 00000000 _____ C:\windows\setuperr.log
2014-01-20 10:34 - 2014-01-20 10:34 - 01037068 _____ (Thisisu) C:\Users\GerdKueller\Downloads\JRT.exe
2014-01-20 10:33 - 2014-01-20 10:34 - 01236282 _____ C:\Users\GerdKueller\Desktop\adwcleaner.exe
2014-01-19 12:09 - 2014-01-19 12:09 - 00034152 _____ C:\ComboFix.txt
2014-01-19 11:51 - 2014-01-19 12:09 - 00000000 ____D C:\Qoobox
2014-01-19 11:51 - 2011-06-26 07:45 - 00256000 _____ C:\windows\PEV.exe
2014-01-19 11:51 - 2010-11-07 18:20 - 00208896 _____ C:\windows\MBR.exe
2014-01-19 11:51 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2014-01-19 11:51 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2014-01-19 11:51 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2014-01-19 11:51 - 2000-08-31 01:00 - 00098816 _____ C:\windows\sed.exe
2014-01-19 11:51 - 2000-08-31 01:00 - 00080412 _____ C:\windows\grep.exe
2014-01-19 11:51 - 2000-08-31 01:00 - 00068096 _____ C:\windows\zip.exe
2014-01-19 11:49 - 2014-01-19 11:50 - 05167985 ____R (Swearware) C:\Users\GerdKueller\Desktop\ComboFix.exe
2014-01-19 11:41 - 2014-01-19 11:41 - 00006524 _____ C:\Users\GerdKueller\Desktop\Gmer.txt
2014-01-19 11:16 - 2014-01-19 11:16 - 00379904 _____ C:\Users\GerdKueller\Desktop\4kssopzn.exe
2014-01-19 11:09 - 2014-01-19 11:09 - 00037225 _____ C:\Users\GerdKueller\Downloads\Addition.txt
2014-01-19 11:08 - 2014-01-20 15:18 - 00000000 ____D C:\FRST
2014-01-19 11:08 - 2014-01-19 11:09 - 00030235 _____ C:\Users\GerdKueller\Downloads\FRST.txt
2014-01-19 11:07 - 2014-01-20 15:18 - 02076672 _____ (Farbar) C:\Users\GerdKueller\Desktop\FRST64.exe
2014-01-19 11:01 - 2014-01-19 11:01 - 00000484 _____ C:\Users\GerdKueller\Downloads\defogger_disable.log
2014-01-19 11:00 - 2014-01-19 11:00 - 00050477 _____ C:\Users\GerdKueller\Desktop\Defogger.exe
2014-01-19 10:58 - 2014-01-19 10:58 - 00000000 ____D C:\Users\GerdKueller\.android
2014-01-19 10:58 - 2014-01-19 10:58 - 00000000 _____ C:\Users\GerdKueller\daemonprocess.txt
2014-01-19 10:57 - 2014-01-19 11:05 - 00000000 ____D C:\Program Files (x86)\Amazon
2014-01-19 10:56 - 2014-01-20 13:14 - 00000000 ____D C:\Users\GerdKueller\AppData\Roaming\DigitalSites
2014-01-19 10:56 - 2014-01-19 10:56 - 00000107 _____ C:\Users\GerdKueller\AppData\Roaming\WB.CFG
2014-01-19 10:56 - 2014-01-19 10:56 - 00000005 _____ C:\Users\GerdKueller\AppData\Roaming\WBPU-TTL.DAT
2014-01-19 10:55 - 2014-01-19 10:55 - 00680328 _____ ( ) C:\Users\GerdKueller\Downloads\ZipOpenerSetup.exe
2014-01-18 09:52 - 2014-01-18 09:52 - 00000000 _____ C:\windows\SysWOW64\sho7C90.tmp
2014-01-17 17:21 - 2014-01-17 17:23 - 00000000 ____D C:\Users\GerdKueller\Documents\My Games
2014-01-17 17:19 - 2014-01-17 17:19 - 00001283 _____ C:\Users\GerdKueller\Desktop\Landwirtschafts-Simulator 2009.lnk
2014-01-17 17:19 - 2014-01-17 17:19 - 00000000 ____D C:\Program Files (x86)\Landwirtschafts-Simulator 2009
2014-01-15 12:30 - 2014-01-15 12:30 - 00001125 _____ C:\Users\GerdKueller\Dokumente - Verknüpfung.lnk
2014-01-15 09:19 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbhub.sys
2014-01-15 09:19 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbport.sys
2014-01-15 09:19 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbccgp.sys
2014-01-15 09:19 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbehci.sys
2014-01-15 09:19 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbuhci.sys
2014-01-15 09:19 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbohci.sys
2014-01-15 09:19 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbd.sys
2014-01-15 09:19 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\windows\system32\Drivers\netio.sys
2014-01-15 09:19 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2014-01-13 12:35 - 2014-01-13 12:35 - 00049507 _____ C:\Users\GerdKueller\Desktop\Waldpiratenparty.odt
2014-01-13 10:48 - 2014-01-13 10:48 - 00000000 ___SD C:\Users\GerdKueller\Documents\Meine Datenquellen
2014-01-07 21:45 - 2014-01-07 21:45 - 00000000 _____ C:\windows\SysWOW64\sho8148.tmp
2014-01-05 21:50 - 2014-01-05 21:50 - 00000000 _____ C:\windows\SysWOW64\shoAB97.tmp
2013-12-22 21:02 - 2013-12-22 21:02 - 00000000 ____D C:\Users\GerdKueller\AppData\Roaming\OpenOffice
2013-12-22 20:59 - 2013-12-22 20:59 - 00001116 _____ C:\Users\Public\Desktop\OpenOffice 4.0.1.lnk
2013-12-22 20:58 - 2013-12-22 20:59 - 00000000 ____D C:\Program Files (x86)\OpenOffice 4
2013-12-22 20:57 - 2013-12-22 20:57 - 00000000 ____D C:\Users\GerdKueller\Desktop\OpenOffice 4.0.1 (de) Installation Files
2013-12-22 20:53 - 2013-12-22 20:57 - 163606685 _____ C:\Users\GerdKueller\Downloads\Apache_OpenOffice_4.0.1_Win_x86_install_de.exe
2013-12-21 11:51 - 2013-12-21 11:51 - 00000000 ____D C:\Users\GerdKueller\Documents\Fax
==================== One Month Modified Files and Folders =======
2014-01-20 15:19 - 2014-01-20 15:19 - 00015423 _____ C:\Users\GerdKueller\Desktop\FRST.txt
2014-01-20 15:18 - 2014-01-20 15:18 - 00000000 ____D C:\Users\GerdKueller\Desktop\FRST-OlderVersion
2014-01-20 15:18 - 2014-01-19 11:08 - 00000000 ____D C:\FRST
2014-01-20 15:18 - 2014-01-19 11:07 - 02076672 _____ (Farbar) C:\Users\GerdKueller\Desktop\FRST64.exe
2014-01-20 15:16 - 2012-11-12 07:11 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2014-01-20 15:01 - 2012-12-26 15:52 - 00000268 _____ C:\windows\Tasks\HP Photo Creations Messager.job
2014-01-20 14:27 - 2012-08-03 12:06 - 00001144 _____ C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3657930280-3738987984-27973596-1002UA.job
2014-01-20 13:34 - 2009-07-14 05:45 - 00028352 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-20 13:34 - 2009-07-14 05:45 - 00028352 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-20 13:28 - 2012-08-03 11:36 - 00000000 ____D C:\Users\GerdKueller
2014-01-20 13:27 - 2012-05-19 08:28 - 00000035 _____ C:\Users\Public\Documents\AtherosServiceConfig.ini
2014-01-20 13:27 - 2011-12-23 01:04 - 00000000 ____D C:\ProgramData\PDFC
2014-01-20 13:27 - 2011-12-23 01:00 - 00000000 ____D C:\ProgramData\HPQLOG
2014-01-20 13:26 - 2014-01-20 13:18 - 00000112 _____ C:\windows\setupact.log
2014-01-20 13:26 - 2009-07-14 06:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2014-01-20 13:25 - 2014-01-20 13:22 - 00000000 ____D C:\AdwCleaner
2014-01-20 13:25 - 2012-05-19 08:12 - 01100979 _____ C:\windows\WindowsUpdate.log
2014-01-20 13:18 - 2014-01-20 13:18 - 00004072 _____ C:\windows\PFRO.log
2014-01-20 13:18 - 2014-01-20 13:18 - 00000000 _____ C:\windows\setuperr.log
2014-01-20 13:18 - 2013-05-27 10:08 - 00000356 _____ C:\windows\Tasks\HPCeeScheduleForGerdKueller.job
2014-01-20 13:14 - 2014-01-19 10:56 - 00000000 ____D C:\Users\GerdKueller\AppData\Roaming\DigitalSites
2014-01-20 12:29 - 2012-08-03 12:02 - 00003978 _____ C:\windows\System32\Tasks\User_Feed_Synchronization-{477BB218-5673-4B91-8753-26F31D84FD21}
2014-01-20 10:34 - 2014-01-20 10:34 - 01037068 _____ (Thisisu) C:\Users\GerdKueller\Downloads\JRT.exe
2014-01-20 10:34 - 2014-01-20 10:33 - 01236282 _____ C:\Users\GerdKueller\Desktop\adwcleaner.exe
2014-01-20 10:14 - 2012-08-03 12:06 - 00001092 _____ C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3657930280-3738987984-27973596-1002Core.job
2014-01-20 09:19 - 2013-05-27 10:08 - 00003222 _____ C:\windows\System32\Tasks\HPCeeScheduleForGerdKueller
2014-01-19 12:09 - 2014-01-19 12:09 - 00034152 _____ C:\ComboFix.txt
2014-01-19 12:09 - 2014-01-19 11:51 - 00000000 ____D C:\Qoobox
2014-01-19 12:04 - 2009-07-14 03:34 - 00000215 _____ C:\windows\system.ini
2014-01-19 12:01 - 2013-07-19 10:37 - 00000000 ____D C:\windows\erdnt
2014-01-19 11:50 - 2014-01-19 11:49 - 05167985 ____R (Swearware) C:\Users\GerdKueller\Desktop\ComboFix.exe
2014-01-19 11:41 - 2014-01-19 11:41 - 00006524 _____ C:\Users\GerdKueller\Desktop\Gmer.txt
2014-01-19 11:16 - 2014-01-19 11:16 - 00379904 _____ C:\Users\GerdKueller\Desktop\4kssopzn.exe
2014-01-19 11:09 - 2014-01-19 11:09 - 00037225 _____ C:\Users\GerdKueller\Downloads\Addition.txt
2014-01-19 11:09 - 2014-01-19 11:08 - 00030235 _____ C:\Users\GerdKueller\Downloads\FRST.txt
2014-01-19 11:05 - 2014-01-19 10:57 - 00000000 ____D C:\Program Files (x86)\Amazon
2014-01-19 11:01 - 2014-01-19 11:01 - 00000484 _____ C:\Users\GerdKueller\Downloads\defogger_disable.log
2014-01-19 11:00 - 2014-01-19 11:00 - 00050477 _____ C:\Users\GerdKueller\Desktop\Defogger.exe
2014-01-19 10:58 - 2014-01-19 10:58 - 00000000 ____D C:\Users\GerdKueller\.android
2014-01-19 10:58 - 2014-01-19 10:58 - 00000000 _____ C:\Users\GerdKueller\daemonprocess.txt
2014-01-19 10:58 - 2013-05-17 14:56 - 00000000 ____D C:\Users\GerdKueller\AppData\Local\cache
2014-01-19 10:56 - 2014-01-19 10:56 - 00000107 _____ C:\Users\GerdKueller\AppData\Roaming\WB.CFG
2014-01-19 10:56 - 2014-01-19 10:56 - 00000005 _____ C:\Users\GerdKueller\AppData\Roaming\WBPU-TTL.DAT
2014-01-19 10:55 - 2014-01-19 10:55 - 00680328 _____ ( ) C:\Users\GerdKueller\Downloads\ZipOpenerSetup.exe
2014-01-18 09:52 - 2014-01-18 09:52 - 00000000 _____ C:\windows\SysWOW64\sho7C90.tmp
2014-01-17 17:23 - 2014-01-17 17:21 - 00000000 ____D C:\Users\GerdKueller\Documents\My Games
2014-01-17 17:19 - 2014-01-17 17:19 - 00001283 _____ C:\Users\GerdKueller\Desktop\Landwirtschafts-Simulator 2009.lnk
2014-01-17 17:19 - 2014-01-17 17:19 - 00000000 ____D C:\Program Files (x86)\Landwirtschafts-Simulator 2009
2014-01-17 09:48 - 2013-03-21 07:55 - 00000000 ____D C:\Users\GerdKueller\AppData\Roaming\KeePass
2014-01-16 09:01 - 2009-07-14 05:45 - 00370432 _____ C:\windows\system32\FNTCACHE.DAT
2014-01-15 21:54 - 2013-07-19 12:02 - 00000000 ____D C:\windows\system32\MRT
2014-01-15 21:52 - 2012-08-03 12:45 - 86054176 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-01-15 12:30 - 2014-01-15 12:30 - 00001125 _____ C:\Users\GerdKueller\Dokumente - Verknüpfung.lnk
2014-01-13 12:35 - 2014-01-13 12:35 - 00049507 _____ C:\Users\GerdKueller\Desktop\Waldpiratenparty.odt
2014-01-13 10:48 - 2014-01-13 10:48 - 00000000 ___SD C:\Users\GerdKueller\Documents\Meine Datenquellen
2014-01-12 13:28 - 2012-08-09 17:04 - 00000000 ____D C:\Users\GerdKueller\Bilder
2014-01-10 16:39 - 2013-02-25 11:29 - 00000000 ____D C:\Users\GerdKueller\AppData\Roaming\SoftGrid Client
2014-01-07 21:45 - 2014-01-07 21:45 - 00000000 _____ C:\windows\SysWOW64\sho8148.tmp
2014-01-05 21:50 - 2014-01-05 21:50 - 00000000 _____ C:\windows\SysWOW64\shoAB97.tmp
2014-01-02 19:40 - 2013-06-02 21:11 - 00000000 ____D C:\Users\GerdKueller\AppData\Roaming\eM Client
2014-01-02 08:53 - 2009-07-14 06:08 - 00032632 _____ C:\windows\Tasks\SCHEDLGU.TXT
2013-12-30 22:13 - 2012-08-03 11:36 - 00003230 _____ C:\windows\System32\Tasks\HPCeeScheduleForGERDKUELLER-HP$
2013-12-30 22:13 - 2012-08-03 11:36 - 00000354 _____ C:\windows\Tasks\HPCeeScheduleForGERDKUELLER-HP$.job
2013-12-22 21:09 - 2012-08-03 11:59 - 00092560 _____ C:\Users\GerdKueller\AppData\Local\GDIPFONTCACHEV1.DAT
2013-12-22 21:02 - 2013-12-22 21:02 - 00000000 ____D C:\Users\GerdKueller\AppData\Roaming\OpenOffice
2013-12-22 20:59 - 2013-12-22 20:59 - 00001116 _____ C:\Users\Public\Desktop\OpenOffice 4.0.1.lnk
2013-12-22 20:59 - 2013-12-22 20:58 - 00000000 ____D C:\Program Files (x86)\OpenOffice 4
2013-12-22 20:57 - 2013-12-22 20:57 - 00000000 ____D C:\Users\GerdKueller\Desktop\OpenOffice 4.0.1 (de) Installation Files
2013-12-22 20:57 - 2013-12-22 20:53 - 163606685 _____ C:\Users\GerdKueller\Downloads\Apache_OpenOffice_4.0.1_Win_x86_install_de.exe
2013-12-21 11:51 - 2013-12-21 11:51 - 00000000 ____D C:\Users\GerdKueller\Documents\Fax
2013-12-21 11:20 - 2012-08-03 12:03 - 00000000 ____D C:\Users\GerdKueller\AppData\Local\PDFC
Some content of TEMP:
====================
C:\Users\GerdKueller\AppData\Local\Temp\avgnt.exe
C:\Users\GerdKueller\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-01-10 13:53
==================== End Of Log ============================
--- --- --- --- --- --- --- --- --- Hier das richtige  Hat evtl. Chrome ein Problem aktuell weil sich das immer noch ständig ändert in den Einstellungen wie von Geisterhand... Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.0 (01.07.2014:1)
OS: Windows 7 Home Premium x64
Ran by GerdKueller on 20.01.2014 at 18:04:36,39
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3657930280-3738987984-27973596-1002\Software\sweetim
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\caphyon
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{08A8EBCA-D913-46C4-A4EE-6E65CFB387D0}
~~~ Files
Successfully deleted: [File] C:\windows\syswow64\sho379B.tmp
Successfully deleted: [File] C:\windows\syswow64\sho67CC.tmp
Successfully deleted: [File] C:\windows\syswow64\sho7C90.tmp
Successfully deleted: [File] C:\windows\syswow64\sho8148.tmp
Successfully deleted: [File] C:\windows\syswow64\shoAB97.tmp
Successfully deleted: [File] C:\windows\syswow64\shoDC18.tmp
Successfully deleted: [File] C:\windows\syswow64\shoE510.tmp
~~~ Folders
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 20.01.2014 at 18:10:08,60
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Weder Chrome noch IE... Geändert von GerdKueller (20.01.2014 um 13:37 Uhr) |
|
21.01.2014, 11:48
| #6 |
| /// the machine /// TB-Ausbilder | Veränderungen am System - Virus eingefangen? Reboote mal den Rechner? Immer noch?
__________________ --> Veränderungen am System - Virus eingefangen? |
|
21.01.2014, 13:11
| #7 |
| | Veränderungen am System - Virus eingefangen? Geht wieder. Zur Zeit... |
|
22.01.2014, 09:38
| #8 |
| /// the machine /// TB-Ausbilder | Veränderungen am System - Virus eingefangen?ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
23.01.2014, 09:26
| #9 |
| | Veränderungen am System - Virus eingefangen? Soweit keine Probleme mehr. War jetzt eigentlich was drauf? Glaube das mit den Lesezeichen ist ein Chromeproblem...die schreiben aber nicht zurück woran das liegen könnte... Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=2e16056cec67364c8465edde2d1be851
# engine=16760
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-01-23 08:21:25
# local_time=2014-01-23 09:21:25 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776573 100 94 139806 142095135 0 0
# scanned=259735
# found=0
# cleaned=0
# scan_time=3947
Code:
ATTFilter Results of screen317's Security Check version 0.99.79
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Avira Desktop
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
Adobe Flash Player 11.9.900.170
Google Chrome 31.0.1650.63
Google Chrome 32.0.1700.76
````````Process Check: objlist.exe by Laurent````````
Avira Antivir avgnt.exe
Avira Antivir avguard.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
Geändert von GerdKueller (23.01.2014 um 09:47 Uhr) |
|
23.01.2014, 19:44
| #10 |
| /// the machine /// TB-Ausbilder | Veränderungen am System - Virus eingefangen? Wir haben schon einiges an Adware rausgehauen Fertig Falls Du Lob oder Kritik loswerden möchtest kannst Du das hier tun Die Reihenfolge ist hier entscheidend.
Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
24.01.2014, 19:52
| #11 |
| | Veränderungen am System - Virus eingefangen? Ich spende wieder ein paar Euronen, habt ihr mehr davon. Vielen Dank. Läuft alles soweit... Bis zum nächsten Mal   |
|
25.01.2014, 13:23
| #12 |
| /// the machine /// TB-Ausbilder | Veränderungen am System - Virus eingefangen? Gern Geschehen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Veränderungen am System - Virus eingefangen? |
| antivir, branding, combofix, device driver, dvdvideosoft ltd., error, google, iexplore.exe, installation, mobogenie, mobogenie entfernen, nextlive, pup.optional.alexatb.a, pup.optional.bprotector.a, pup.optional.installcore.a, pup.optional.nextlive.a, pup.optional.opencandy, pup.optional.updater, rundll, services.exe, svchost.exe, symantec, virus |
Linear-Darstellung
