| |
| |||||||
Log-Analyse und Auswertung: Windows: BKA-Virus im BrowserWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
24.01.2014, 01:03
| #1 |
 |  Windows: BKA-Virus im Browser hallo, seit vorgestern werde ich von einer tumblr Seite, die ich vorher immer ohne Probleme öffnen konnte, immer wenn ich meinen Computer starte auf die BKA-Seite weitergeleitet. Die Seite kommt sowohl im Firefox als auch im Chrome. Die Browser lassen sich dann nur noch mit dem Taskmanager beenden. Wenn ich dann den Browser neustarte funktioniert wieder alles und ich kann auch wieder auf die tumblr Seite zugreifen. Avira hat nichts gefunden. Malwarebytes wurde von Avira blockiert. Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 23:44 on 23/01/2014 (Laura_Admin)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-01-2014 02
Ran by Laura (ATTENTION: The logged in user is not administrator) on MAGGIE on 23-01-2014 23:46:47
Running from C:\Users\Laura\Desktop\Neuer Ordner
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
(Wacom Technology, Corp.) C:\Windows\System32\WTablet\Pen_TabletUser.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\Teco.exe
(Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Spotify Ltd) C:\Users\Laura\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Toshiba) C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe
(Dropbox, Inc.) C:\Users\Laura\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(CANON INC.) C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosBtMng.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosLeSrvUseMng.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosLeBtMng.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosLeSrvProvider.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosA2dp.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosBtHid.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosBtHSP.exe
(Wacom Technology, Corp.) C:\Program Files\WTouch\WTouchUser.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [] - [x]
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12446824 2012-02-01] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2867984 2011-12-23] (Synaptics Incorporated)
HKLM\...\Run: [SRS Premium Sound HD] - C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe [2165120 2012-02-06] (SRS Labs, Inc.)
HKLM\...\Run: [TPwrMain] - C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [590256 2011-09-23] (TOSHIBA Corporation)
HKLM\...\Run: [TCrdMain] - C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [989056 2011-12-14] (TOSHIBA Corporation)
HKLM\...\Run: [Teco] - C:\Program Files\TOSHIBA\TECO\Teco.exe [1548208 2011-11-24] (TOSHIBA Corporation)
HKLM\...\Run: [TosWaitSrv] - C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [712096 2011-12-14] (TOSHIBA Corporation)
HKLM\...\Run: [TosSENotify] - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [710560 2011-11-26] (TOSHIBA Corporation)
HKLM\...\Run: [TosVolRegulator] - C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation)
HKLM\...\Run: [Toshiba TEMPRO] - C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe [1546720 2011-02-10] (Toshiba Europe GmbH)
HKLM\...\Run: [Toshiba Registration] - C:\Program Files\TOSHIBA\Registration\ToshibaReminder.exe [150992 2012-03-07] (Toshiba Europe GmbH)
HKLM\...\Run: [LogMeIn GUI] - C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe [57928 2012-06-08] (LogMeIn, Inc.)
HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2779024 2011-03-14] (CANON INC.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [444904 2012-09-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [NBAgent] - C:\Program Files (x86)\Nero\Nero 11\Nero BackItUp\NBAgent.exe [1492264 2011-11-18] (Nero AG)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2012-01-20] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [ITSecMng] - C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe [80840 2011-04-02] (TOSHIBA CORPORATION)
HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-01-05] (Intel Corporation)
HKLM-x32\...\Run: [TSleepSrv] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Sleep Utility\TSleepSrv.exe [253312 2011-11-21] (TOSHIBA)
HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [CanonSolutionMenuEx] - C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1612920 2011-08-04] (CANON INC.)
HKLM-x32\...\Run: [IJNetworkScannerSelectorEX] - C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe [452016 2011-01-15] (CANON INC.)
HKLM-x32\...\Run: [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS5.5ServiceManager] - C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe [1523360 2011-01-12] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe [41336 2013-09-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe [840568 2013-09-03] (Adobe Systems Inc.)
HKLM-x32\...\Run: [DivXMediaServer] - C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-17] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [DivXUpdate] - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1861968 2013-11-15] ()
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.)
HKCU\...\Run: [Spotify Web Helper] - C:\Users\Laura\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171968 2014-01-16] (Spotify Ltd)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Laura\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Laura_Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TEUA&bmod=TEUA
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://t.de.msn.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x212A1F26A0E0CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM - {AEE17A01-F07D-4110-B520-CECBE6DD0C09} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TEUA;
SearchScopes: HKLM-x32 - {AEE17A01-F07D-4110-B520-CECBE6DD0C09} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TEUA;
SearchScopes: HKCU - {AEE17A01-F07D-4110-B520-CECBE6DD0C09} URL =
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: TOSHIBA Media Controller Plug-in - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\x64\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)
BHO-x32: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files (x86)\Adobe\Adobe Contribute CS5.1\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
BHO-x32: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: TOSHIBA Media Controller Plug-in - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)
BHO-x32: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Toolbar: HKLM-x32 - Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files (x86)\Adobe\Adobe Contribute CS5.1\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKCU - No Name - {977AE9CC-AF83-45E8-9E03-E2798216E2D5} - No File
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.10 192.168.1.130
Tcpip\..\Interfaces\{851F8DFE-A14D-48CE-BAAF-AF193F5F5B1B}: [NameServer]192.168.1.10 192.168.1.130
FireFox:
========
FF ProfilePath: C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default
FF Homepage: hxxp://www.google.de/
FF NetworkProxy: "autoconfig_url", "https://mediahint.com/default.pac"
FF NetworkProxy: "http", "178.219.201.131"
FF NetworkProxy: "http_port", 3128
FF NetworkProxy: "type", 2
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_12_0_0_43.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.5 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_43.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\windows\system32\Adobe\Director\np32dsw_1204144.dll No File
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @Nero.com/KM - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll ()
FF Plugin-x32: Adobe Acrobat - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: YouTube Unblocker - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default\Extensions\youtubeunblocker@unblocker.yt [2014-01-22]
FF Extension: Flashblock - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default\Extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a} [2014-01-22]
FF Extension: DownloadHelper - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-01-22]
FF Extension: Chrome View - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default\Extensions\chromeview@systemantics.net.xpi [2014-01-22]
FF Extension: Media Hint - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default\Extensions\mediahint@jetpack.xpi [2014-01-22]
FF Extension: ZIP File Wizard Free - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default\Extensions\{1be13464-8e12-4d18-8601-bbae1257b460}.xpi [2014-01-22]
FF Extension: Locale Switcher - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default\Extensions\{338e0b96-2285-4424-b4c8-e25560750fa3}.xpi [2014-01-22]
FF Extension: NoScript - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-01-23]
FF Extension: {828814c3-7178-41b7-a60b-15969f642ba3} - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default\Extensions\{828814c3-7178-41b7-a60b-15969f642ba3}.xpi [2014-01-22]
FF Extension: View Cookies - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default\Extensions\{8F6A6FD9-0619-459f-B9D0-81DE065D4E21}.xpi [2014-01-22]
FF Extension: Password Exporter - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default\Extensions\{B17C1C5A-04B1-11DB-9804-B622A1EF5492}.xpi [2014-01-22]
FF Extension: Adblock Plus - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-22]
FF HKLM-x32\...\Firefox\Extensions: [{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}] - C:\Program Files (x86)\Adobe\Adobe Contribute CS5.1\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}
FF Extension: Adobe Contribute Toolbar - C:\Program Files (x86)\Adobe\Adobe Contribute CS5.1\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9} [2013-01-05]
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2013-01-05]
Chrome:
=======
CHR HomePage: hxxp://www.google.de/
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.83\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll No File
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java Deployment Toolkit 6.0.300.12) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U30) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll No File
CHR Plugin: (Nero Kwik Media Helper) - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll No File
CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Plugin: (McAfee SecurityCenter) - c:\progra~2\mcafee\msc\npmcsn~1.dll No File
CHR Extension: (Adblock Plus) - C:\Users\Laura\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2013-01-02]
CHR Extension: (FlashBlock) - C:\Users\Laura\AppData\Local\Google\Chrome\User Data\Default\Extensions\gofhjkjmkpinhpoiabjplobcaignabnl [2013-01-02]
CHR Extension: (Google Wallet) - C:\Users\Laura\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-24]
CHR Extension: (YouTube Unblocker) - C:\Users\Laura\AppData\Local\Google\Chrome\User Data\Default\Extensions\npnkeeiehehhefofiekoflfedgehcdhl [2013-12-17]
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-17] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG)
R2 lmhosts; C:\Windows\system32\svchost.exe [27648 2011-03-01] (Microsoft Corporation)
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [376144 2014-01-22] (LogMeIn, Inc.)
R2 LMIMaint; C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe [226640 2014-01-22] (LogMeIn, Inc.)
R2 LogMeIn; C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe [407424 2012-06-08] (LogMeIn, Inc.)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 NlaSvc; C:\Windows\System32\svchost.exe [27648 2011-03-01] (Microsoft Corporation)
R2 nsi; C:\Windows\system32\svchost.exe [27648 2011-03-01] (Microsoft Corporation)
R2 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [112080 2011-02-10] (Toshiba Europe GmbH)
R2 WTouchService; C:\Program Files\WTouch\WTouchService.exe [127272 2009-07-15] (Wacom Technology, Corp.)
==================== Drivers (Whitelisted) ====================
S3 androidusb; C:\Windows\System32\Drivers\androidusb.sys [31744 2012-06-05] (Google Inc)
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2013-05-16] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2013-05-16] ()
R2 LMIInfo; C:\Program Files (x86)\LogMeIn\x64\RaInfo.sys [16056 2013-05-29] (LogMeIn, Inc.)
S4 LMIRfsClientNP; No ImagePath
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 SmbDrv; C:\Windows\System32\DRIVERS\Smb_driver.sys [21264 2011-12-23] (Synaptics Incorporated)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27648 2011-03-01] (Microsoft Corporation)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-01-23 23:46 - 2014-01-23 23:46 - 00000000 ____D C:\FRST
2014-01-23 23:45 - 2014-01-23 23:46 - 00000000 ____D C:\Users\Laura\Desktop\Neuer Ordner
2014-01-23 23:42 - 2014-01-23 23:43 - 00000000 ____D C:\Users\Laura_Admin\AppData\Roaming\Skype
2014-01-23 23:41 - 2014-01-23 23:44 - 00000000 _____ C:\Users\Laura_Admin\defogger_reenable
2014-01-23 19:01 - 2014-01-23 19:04 - 00000000 ___SD C:\32788R22FWJFW
2014-01-23 19:01 - 2014-01-23 19:01 - 00000000 ____D C:\windows\erdnt
2014-01-23 19:01 - 2014-01-23 19:01 - 00000000 ____D C:\Qoobox
2014-01-23 17:53 - 2014-01-23 17:53 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Malwarebytes
2014-01-23 15:26 - 2014-01-23 15:26 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-23 15:26 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2014-01-23 15:20 - 2014-01-23 15:20 - 00000000 ____D C:\Users\Laura\AppData\Local\LogMeInIgnition
2014-01-22 17:00 - 2014-01-22 17:00 - 01037068 _____ (Thisisu) C:\Users\Laura\Downloads\JRT.exe
2014-01-22 16:48 - 2014-01-22 16:50 - 00000000 ____D C:\AdwCleaner
2014-01-22 13:34 - 2014-01-22 13:34 - 00000000 ____D C:\Users\Laura_Admin\AppData\Roaming\Malwarebytes
2014-01-22 13:34 - 2014-01-22 13:34 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-22 13:33 - 2014-01-23 15:25 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Laura\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-15 09:42 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbhub.sys
2014-01-15 09:42 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbport.sys
2014-01-15 09:42 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbccgp.sys
2014-01-15 09:42 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbehci.sys
2014-01-15 09:42 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbuhci.sys
2014-01-15 09:42 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbohci.sys
2014-01-15 09:42 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbd.sys
2014-01-15 09:42 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\windows\system32\Drivers\netio.sys
2014-01-15 09:42 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2014-01-08 23:32 - 2014-01-08 23:32 - 00001101 _____ C:\Users\Public\Desktop\TeamViewer 9.lnk
2014-01-07 18:28 - 2014-01-07 18:28 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2014-01-07 17:49 - 2014-01-07 17:49 - 00000928 _____ C:\Users\Public\Desktop\Steam.lnk
2014-01-07 17:48 - 2014-01-20 15:51 - 00000000 ____D C:\Program Files (x86)\Steam
2013-12-29 17:19 - 2013-12-29 17:19 - 00000000 ____D C:\Users\Laura\Documents\Amazon Music Importer
2013-12-29 17:19 - 2013-12-29 17:19 - 00000000 ____D C:\Users\Laura\AppData\Roaming\com.amazon.music.uploader
2013-12-29 17:18 - 2013-12-29 17:18 - 09629432 _____ C:\Users\Laura\Downloads\AmazonMusicImporterInstaller-2.1.0._V371017662_.exe
2013-12-29 17:18 - 2013-12-29 17:18 - 00000000 ____D C:\Program Files (x86)\Amazon
2013-12-29 17:00 - 2013-12-29 17:00 - 36152456 _____ (Amazon) C:\Users\Laura\Downloads\AmazonCloudPlayerInstaller_399.exe
2013-12-25 18:47 - 2013-12-25 18:47 - 00000000 ____D C:\Program Files\DivX
==================== One Month Modified Files and Folders =======
2014-01-23 23:46 - 2014-01-23 23:46 - 00000000 ____D C:\FRST
2014-01-23 23:46 - 2014-01-23 23:45 - 00000000 ____D C:\Users\Laura\Desktop\Neuer Ordner
2014-01-23 23:44 - 2014-01-23 23:41 - 00000000 _____ C:\Users\Laura_Admin\defogger_reenable
2014-01-23 23:44 - 2012-08-22 12:31 - 00000000 ____D C:\Users\Laura_Admin
2014-01-23 23:43 - 2014-01-23 23:42 - 00000000 ____D C:\Users\Laura_Admin\AppData\Roaming\Skype
2014-01-23 23:42 - 2012-08-22 13:29 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Skype
2014-01-23 23:42 - 2012-08-22 12:36 - 00118064 _____ C:\Users\Laura_Admin\AppData\Local\GDIPFONTCACHEV1.DAT
2014-01-23 23:42 - 2012-08-22 12:36 - 00001432 _____ C:\Users\Laura_Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-01-23 23:42 - 2012-08-22 12:36 - 00000000 ___RD C:\Users\Laura_Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-01-23 23:42 - 2012-08-22 12:31 - 00000000 ___RD C:\Users\Laura_Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-01-23 23:42 - 2012-03-07 01:21 - 00001120 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-23 23:38 - 2013-10-01 18:35 - 00000593 _____ C:\windows\system32\Drivers\etc\hosts.ics
2014-01-23 23:34 - 2009-07-14 05:45 - 00024608 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-23 23:34 - 2009-07-14 05:45 - 00024608 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-23 23:29 - 2012-06-14 17:30 - 01488063 _____ C:\windows\WindowsUpdate.log
2014-01-23 23:27 - 2013-12-06 14:29 - 00000000 ___RD C:\Users\Laura\Dropbox
2014-01-23 23:27 - 2013-12-06 14:26 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Dropbox
2014-01-23 23:25 - 2012-08-31 15:10 - 00000000 ____D C:\Users\Laura\AppData\Roaming\WTablet
2014-01-23 23:24 - 2009-07-14 06:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2014-01-23 23:24 - 2009-07-14 05:51 - 00141865 _____ C:\windows\setupact.log
2014-01-23 19:17 - 2012-03-07 01:21 - 00001124 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-23 19:04 - 2014-01-23 19:01 - 00000000 ___SD C:\32788R22FWJFW
2014-01-23 19:01 - 2014-01-23 19:01 - 00000000 ____D C:\windows\erdnt
2014-01-23 19:01 - 2014-01-23 19:01 - 00000000 ____D C:\Qoobox
2014-01-23 17:53 - 2014-01-23 17:53 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Malwarebytes
2014-01-23 17:49 - 2010-11-21 04:47 - 00115436 _____ C:\windows\PFRO.log
2014-01-23 15:26 - 2014-01-23 15:26 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-23 15:25 - 2014-01-22 13:33 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Laura\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-23 15:20 - 2014-01-23 15:20 - 00000000 ____D C:\Users\Laura\AppData\Local\LogMeInIgnition
2014-01-23 09:31 - 2012-08-22 17:16 - 00000000 ____D C:\Users\Laura\AppData\Local\Adobe
2014-01-23 09:30 - 2012-08-22 13:17 - 00000000 ____D C:\ProgramData\LogMeIn
2014-01-22 17:00 - 2014-01-22 17:00 - 01037068 _____ (Thisisu) C:\Users\Laura\Downloads\JRT.exe
2014-01-22 16:50 - 2014-01-22 16:48 - 00000000 ____D C:\AdwCleaner
2014-01-22 16:48 - 2013-07-04 19:03 - 01236282 _____ C:\Users\Laura\Downloads\adwcleaner.exe
2014-01-22 16:46 - 2012-08-22 15:57 - 00000000 ____D C:\Users\Laura\Desktop\Alles Mögliche
2014-01-22 16:45 - 2012-10-08 14:53 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Spotify
2014-01-22 16:23 - 2012-09-13 15:09 - 00000000 ____D C:\Program Files (x86)\DivX
2014-01-22 16:23 - 2012-09-13 15:08 - 00000000 ____D C:\ProgramData\DivX
2014-01-22 16:21 - 2013-08-26 12:19 - 00993600 _____ (DivX, LLC) C:\Users\Laura\Downloads\DivXInstaller.exe
2014-01-22 13:34 - 2014-01-22 13:34 - 00000000 ____D C:\Users\Laura_Admin\AppData\Roaming\Malwarebytes
2014-01-22 13:34 - 2014-01-22 13:34 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-22 07:50 - 2012-08-22 13:17 - 00000000 ____D C:\Program Files (x86)\LogMeIn
2014-01-22 07:49 - 2012-08-22 13:17 - 00107368 _____ (LogMeIn, Inc.) C:\windows\system32\LMIRfsClientNP.dll
2014-01-22 07:49 - 2012-08-22 13:17 - 00092488 _____ (LogMeIn, Inc.) C:\windows\system32\LMIinit.dll
2014-01-22 07:49 - 2012-08-22 13:17 - 00035656 _____ (LogMeIn, Inc.) C:\windows\system32\LMIport.dll
2014-01-20 18:51 - 2012-10-08 14:53 - 00000000 ____D C:\Users\Laura\AppData\Local\Spotify
2014-01-20 15:51 - 2014-01-07 17:48 - 00000000 ____D C:\Program Files (x86)\Steam
2014-01-19 13:27 - 2012-03-07 01:44 - 00000000 ____D C:\ProgramData\McAfee
2014-01-19 13:27 - 2012-03-07 01:05 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2014-01-19 13:27 - 2012-03-07 01:05 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-01-19 13:26 - 2012-08-23 07:38 - 00000000 ____D C:\Users\Laura_Admin\AppData\Local\Adobe
2014-01-17 10:30 - 2012-03-07 01:22 - 00002186 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2014-01-17 00:22 - 2013-12-06 19:09 - 00001027 _____ C:\Users\Laura\Desktop\Dropbox.lnk
2014-01-17 00:22 - 2013-12-06 19:08 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-01-17 00:22 - 2012-08-22 13:28 - 00000000 ___RD C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-01-16 16:42 - 2009-07-14 05:45 - 05009400 _____ C:\windows\system32\FNTCACHE.DAT
2014-01-16 09:37 - 2013-08-15 02:01 - 00000000 ____D C:\windows\system32\MRT
2014-01-16 09:37 - 2012-08-23 00:17 - 00000000 ____D C:\ProgramData\Microsoft Help
2014-01-16 09:34 - 2012-08-22 14:00 - 86054176 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-01-15 13:43 - 2013-09-17 22:43 - 00000000 ____D C:\Users\Laura\Desktop\uni
2014-01-11 00:17 - 2009-07-14 04:20 - 00000000 ____D C:\windows\system32\NDF
2014-01-09 00:06 - 2012-08-22 13:28 - 00118064 _____ C:\Users\Laura\AppData\Local\GDIPFONTCACHEV1.DAT
2014-01-08 23:32 - 2014-01-08 23:32 - 00001101 _____ C:\Users\Public\Desktop\TeamViewer 9.lnk
2014-01-08 23:32 - 2013-01-05 00:18 - 00000000 ____D C:\Program Files (x86)\TeamViewer
2014-01-07 18:28 - 2014-01-07 18:28 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2014-01-07 17:49 - 2014-01-07 17:49 - 00000928 _____ C:\Users\Public\Desktop\Steam.lnk
2014-01-07 17:49 - 2012-08-22 13:28 - 00000000 ____D C:\Users\Laura
2014-01-03 18:14 - 2009-07-14 06:08 - 00032632 _____ C:\windows\Tasks\SCHEDLGU.TXT
2013-12-30 23:54 - 2013-07-04 18:44 - 907171148 _____ C:\windows\MEMORY.DMP
2013-12-30 23:54 - 2013-07-04 18:44 - 00000000 ____D C:\windows\Minidump
2013-12-30 23:53 - 2009-07-14 04:20 - 00000000 ____D C:\windows\LiveKernelReports
2013-12-29 18:22 - 2011-02-11 09:21 - 00654400 _____ C:\windows\system32\perfh007.dat
2013-12-29 18:22 - 2011-02-11 09:21 - 00130240 _____ C:\windows\system32\perfc007.dat
2013-12-29 18:22 - 2009-07-14 06:13 - 01498742 _____ C:\windows\system32\PerfStringBackup.INI
2013-12-29 17:19 - 2013-12-29 17:19 - 00000000 ____D C:\Users\Laura\Documents\Amazon Music Importer
2013-12-29 17:19 - 2013-12-29 17:19 - 00000000 ____D C:\Users\Laura\AppData\Roaming\com.amazon.music.uploader
2013-12-29 17:18 - 2013-12-29 17:18 - 09629432 _____ C:\Users\Laura\Downloads\AmazonMusicImporterInstaller-2.1.0._V371017662_.exe
2013-12-29 17:18 - 2013-12-29 17:18 - 00000000 ____D C:\Program Files (x86)\Amazon
2013-12-29 17:00 - 2013-12-29 17:00 - 36152456 _____ (Amazon) C:\Users\Laura\Downloads\AmazonCloudPlayerInstaller_399.exe
2013-12-25 18:47 - 2013-12-25 18:47 - 00000000 ____D C:\Program Files\DivX
Some content of TEMP:
====================
C:\Users\Laura\AppData\Local\Temp\AskSLib.dll
C:\Users\Laura\AppData\Local\Temp\avgnt.exe
C:\Users\Laura\AppData\Local\Temp\DivXSetup.exe
C:\Users\Laura\AppData\Local\Temp\drm_dyndata_7320010.dll
C:\Users\Laura\AppData\Local\Temp\i4jdel0.exe
C:\Users\Laura\AppData\Local\Temp\MSETUP4.EXE
C:\Users\Laura\AppData\Local\Temp\Shockwave_Installer_FF.exe
C:\Users\Laura\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Laura_Admin\AppData\Local\Temp\AskSLib.dll
C:\Users\Laura_Admin\AppData\Local\Temp\AutoRun.exe
C:\Users\Laura_Admin\AppData\Local\Temp\AutoRunGUI.dll
C:\Users\Laura_Admin\AppData\Local\Temp\avgnt.exe
C:\Users\Laura_Admin\AppData\Local\Temp\iview435_setup.exe
C:\Users\Laura_Admin\AppData\Local\Temp\iv_uninstall.exe
C:\Users\Laura_Admin\AppData\Local\Temp\MSETUP4.EXE
C:\Users\Laura_Admin\AppData\Local\Temp\msvcp60.dll
C:\Users\Laura_Admin\AppData\Local\Temp\ose00000.exe
C:\Users\Laura_Admin\AppData\Local\Temp\Quarantine.exe
C:\Users\Laura_Admin\AppData\Local\Temp\twapi-2.0a2.dll
C:\Users\Laura_Admin\AppData\Local\Temp\VP6Install.exe
C:\Users\Laura_Admin\AppData\Local\Temp\VP6VFW.dll
C:\Users\Laura_Admin\AppData\Local\Temp\_is7384.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 23-01-2014 02
Ran by Laura at 2014-01-23 23:47:50
Running from C:\Users\Laura\Desktop\Neuer Ordner
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
7-Zip 9.20 (x64 edition) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Acrobat X Pro - English, Français, Deutsch (x32 Version: 10.1.8 - Adobe Systems)
Adobe AIR (x32 Version: 3.4.0.2710 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 3.4.0.2710 - Adobe Systems Incorporated) Hidden
Adobe Community Help (x32 Version: 3.4.980 - Adobe Systems Incorporated.)
Adobe Community Help (x32 Version: 3.4.980 - Adobe Systems Incorporated.) Hidden
Adobe Content Viewer (x32 Version: 1.4.0 - Adobe Systems Incorporated)
Adobe Content Viewer (x32 Version: 1.4.0 - Adobe Systems Incorporated) Hidden
Adobe Creative Suite 5.5 Master Collection (x32 Version: 5.5 - Adobe Systems Incorporated)
Adobe Flash Player 11 ActiveX (x32 Version: 11.3.300.271 - Adobe Systems Incorporated)
Adobe Flash Player 12 Plugin (x32 Version: 12.0.0.43 - Adobe Systems Incorporated)
Adobe Photoshop Elements 7.0 (x32 Version: 7.0 - Adobe Systems Incorporated)
Adobe Photoshop Elements 7.0 (x32 Version: 7.0.0.3 - Adobe Systems Incorporated) Hidden
Adobe Reader X (10.1.8) MUI (x32 Version: 10.1.8 - Adobe Systems Incorporated)
Adobe Story (x32 Version: 1.0.571 - Adobe Systems Incorporated)
Adobe Story (x32 Version: 1.0.571 - Adobe Systems Incorporated) Hidden
Adobe Widget Browser (x32 Version: 2.0 Build 230 - Adobe Systems Incorporated.)
Adobe Widget Browser (x32 Version: 2.0.230 - Adobe Systems Incorporated.) Hidden
Agatha Christie - Death on the Nile (x32 Version: 2.2.0.98 - WildTangent) Hidden
Aloha TriPeaks (x32 Version: 2.2.0.98 - WildTangent) Hidden
Amazon Kindle (HKCU Version: - Amazon)
AMD APP SDK Runtime (Version: 10.0.851.6 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Install Manager (Version: 3.0.859.0 - Advanced Micro Devices, Inc.)
Assassin's Creed (x32 Version: 1.02 - Ubisoft)
Assassin's Creed II (x32 Version: 1.01 - Ubisoft)
Atheros Bluetooth Filter Driver Package (Version: 1.0.0.12 - Atheros Communications)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (x32 Version: 2.0.12.13 - Atheros Communications Inc.)
Atheros Driver Installation Program (x32 Version: 9.2 - Atheros)
Avira Free Antivirus (x32 Version: 14.0.2.286 - Avira)
Bamboo (x32 Version: - Wacom Technology Corp.)
Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Bluetooth Stack for Windows by Toshiba (Version: v9.00.00(T) - TOSHIBA CORPORATION)
Cake Mania (x32 Version: 2.2.0.98 - WildTangent) Hidden
Canon Easy-PhotoPrint EX (x32 Version: - )
Canon Easy-WebPrint EX (x32 Version: - )
Canon IJ Network Scanner Selector EX (x32 Version: - )
Canon IJ Network Tool (x32 Version: - )
Canon MG5300 series Benutzerregistrierung (x32 Version: - )
Canon MG5300 series MP Drivers (Version: - )
Canon MP Navigator EX 5.0 (x32 Version: - )
Canon My Printer (x32 Version: - )
Canon Solution Menu EX (x32 Version: - )
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center (x32 Version: 2012.0120.420.7502 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2012.0120.420.7502 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2012.0120.420.7502 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2012.0120.420.7502 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2012.0120.0419.7502 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2012.0120.0419.7502 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2012.0120.0419.7502 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2012.0120.0419.7502 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2012.0120.0419.7502 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2012.0120.0419.7502 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2012.0120.0419.7502 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2012.0120.0419.7502 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2012.0120.0419.7502 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2012.0120.0419.7502 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2012.0120.0419.7502 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2012.0120.0419.7502 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2012.0120.0419.7502 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2012.0120.0419.7502 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2012.0120.0419.7502 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2012.0120.0419.7502 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2012.0120.0419.7502 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2012.0120.0419.7502 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2012.0120.0419.7502 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2012.0120.0419.7502 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2012.0120.0419.7502 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2012.0120.0419.7502 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2012.0120.420.7502 - Advanced Micro Devices, Inc.) Hidden
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Contrôle ActiveX Windows Live Mesh pour connexions à distance (x32 Version: 15.4.5722.2 - Microsoft Corporation)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Die Sims™ 2 Deluxe (x32 Version: - )
DivX-Setup (x32 Version: 2.6.1.90 - DivX, LLC)
Dropbox (HKCU Version: 2.4.11 - Dropbox, Inc.)
First PDF (x32 Version: - )
Free Audio Converter version 5.0.24.419 (x32 Version: 5.0.24.419 - DVDVideoSoft Ltd.)
Free YouTube to MP3 Converter version 3.12.2.419 (x32 Version: 3.12.2.419 - DVDVideoSoft Ltd.)
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
GeoGebra (HKCU Version: 4.0.41.0 - International GeoGebra Institute)
GIMP 2.8.4 (Version: 2.8.4 - The GIMP Team)
Google Chrome (x32 Version: 32.0.1700.76 - Google Inc.)
Google Earth Plug-in (x32 Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.22.3 - Google Inc.) Hidden
Helium (x32 Version: 1.0.0 - ClockworkMod)
High-Definition Video Playback (x32 Version: 11.1.10500.2.65 - Nero AG) Hidden
Insaniquarium Deluxe (x32 Version: 2.2.0.97 - WildTangent) Hidden
Intel(R) Management Engine Components (x32 Version: 8.0.1.1399 - Intel Corporation)
Intel(R) Rapid Storage Technology (x32 Version: 11.0.0.1032 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (x32 Version: 1.0.1.209 - Intel Corporation)
IrfanView (remove only) (x32 Version: 4.32 - Irfan Skiljan)
Java 7 Update 45 (x32 Version: 7.0.450 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Jewel Quest Solitaire 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
LogMeIn (x32 Version: 4.1.2504 - LogMeIn, Inc.)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300 - Malwarebytes Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden
Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden
Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 (x32 Version: 9.0.30411 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Microsoft_VC80_ATL_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_ATL_x86_x64 (Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_CRT_x86_x64 (Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFC_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFC_x86_x64 (Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFCLOC_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFCLOC_x86_x64 (Version: 80.50727.4053 - Adobe) Hidden
Microsoft_VC90_ATL_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_ATL_x86_x64 (Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_CRT_x86_x64 (Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_MFC_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_MFC_x86_x64 (Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_MFCLOC_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_MFCLOC_x86_x64 (Version: 1.00.0000 - Adobe) Hidden
Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0 - Mozilla)
Mozilla Maintenance Service (x32 Version: 26.0 - Mozilla)
Mozilla Thunderbird 15.0.1 (x86 de) (x32 Version: 15.0.1 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
Mystery P.I. - The London Caper (x32 Version: 2.2.0.95 - WildTangent) Hidden
Nero 11 Essentials (x32 Version: 11.0.00300 - Nero AG)
Nero 11 Kwik Themes Basic (x32 Version: 11.0.11200.12.0 - Nero AG) Hidden
Nero BackItUp 11 (x32 Version: 6.0.18000.19.100 - Nero AG) Hidden
Nero BackItUp 11 Help (CHM) (x32 Version: 11.0.10200 - Nero AG) Hidden
Nero Backup Drivers (Version: 1.0.11100.8.0 - Nero AG)
Nero BurnRights 11 (x32 Version: 5.0.10300.4.100 - Nero AG) Hidden
Nero BurnRights 11 Help (CHM) (x32 Version: 11.0.10100 - Nero AG) Hidden
Nero ControlCenter 11 (x32 Version: 11.0.12700.0.27 - Nero AG) Hidden
Nero ControlCenter 11 Help (CHM) (x32 Version: 11.0.10300 - Nero AG) Hidden
Nero Core Components 11 (x32 Version: 11.0.15500.1.16 - Nero AG) Hidden
Nero Express 11 (x32 Version: 11.0.11900.24.100 - Nero AG) Hidden
Nero Express 11 Help (CHM) (x32 Version: 11.0.10300 - Nero AG) Hidden
Nero Kwik Media (x32 Version: 1.10.24800.146.100 - Nero AG) Hidden
Nero Kwik Media Help (CHM) (x32 Version: 11.0.10200 - Nero AG) Hidden
Nero RescueAgent 11 (x32 Version: 4.0.10600.10.100 - Nero AG) Hidden
Nero RescueAgent 11 Help (CHM) (x32 Version: 11.0.10400 - Nero AG) Hidden
Nero Update (x32 Version: 11.0.11400.27.0 - Nero AG) Hidden
nero.prerequisites.msi (x32 Version: 11.0.20008 - Nero AG) Hidden
No23 Recorder (x32 Version: 2.1.0.3 - No23)
NVIDIA PhysX (x32 Version: 9.09.0203 - NVIDIA Corporation)
OpenOffice.org 3.4 (x32 Version: 3.4.9590 - OpenOffice.org)
PDF Settings CS5 (x32 Version: 10.0 - Adobe Systems Incorporated) Hidden
Picasa 3 (x32 Version: 3.9 - Google, Inc.)
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden
PlayReady PC Runtime amd64 (Version: 1.3.0 - Microsoft Corporation)
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Portal 2 (x32 Version: - Valve)
Premium Sound HD (Version: 1.12.0300 - SRS Labs, Inc.)
PxMergeModule (x32 Version: 1.00.0000 - Your Company Name) Hidden
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6559 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Reader Driver (x32 Version: 6.1.7601.39013 - Realtek Semiconductor Corp.)
Risen (x32 Version: 1.00.0000 - Deep Silver)
Skype™ 6.11 (x32 Version: 6.11.102 - Skype Technologies S.A.)
Spotify (HKCU Version: 0.9.7.16.g4b197456 - Spotify AB)
Steam (x32 Version: 1.0.0.0 - Valve Corporation)
Synaptics Pointing Device Driver (Version: 15.3.39.0 - Synaptics Incorporated)
TeamViewer 9 (x32 Version: 9.0.24951 - TeamViewer)
TOSHIBA Assist (x32 Version: 4.2.3.1 - TOSHIBA CORPORATION)
TOSHIBA Disc Creator (Version: 2.1.0.11 for x64 - TOSHIBA Corporation)
TOSHIBA eco Utility (Version: 1.3.10.64 - TOSHIBA Corporation)
TOSHIBA Hardware Setup (x32 Version: 2.1.0.8 - TOSHIBA Corporation)
TOSHIBA HDD/SSD Alert (Version: 3.1.64.11 - TOSHIBA Corporation)
Toshiba Manuals (x32 Version: 10.04 - TOSHIBA)
TOSHIBA Media Controller (x32 Version: 1.0.87.4 - TOSHIBA CORPORATION)
TOSHIBA Media Controller Plug-in (x32 Version: 1.0.7.7 - TOSHIBA CORPORATION)
TOSHIBA Online Product Information (x32 Version: 4.01.0000 - TOSHIBA)
TOSHIBA PC Health Monitor (Version: 1.7.15.64 - TOSHIBA Corporation)
TOSHIBA Places Icon Utility (x32 Version: 1.1.1.4 - TOSHIBA Corporation)
TOSHIBA Recovery Media Creator (x32 Version: 2.1.6.52020009 - TOSHIBA CORPORATION)
TOSHIBA Recovery Media Creator Reminder (x32 Version: 1.00.0019 - TOSHIBA)
TOSHIBA Recovery Media Creator Reminder (x32 Version: 1.00.0019 - TOSHIBA) Hidden
TOSHIBA Resolution+ Plug-in for Windows Media Player (x32 Version: 1.1.2004 - TOSHIBA Corporation)
TOSHIBA Service Station (x32 Version: 2.2.13 - TOSHIBA)
TOSHIBA Sleep Utility (x32 Version: 1.4.0022.000104 - TOSHIBA Corporation)
TOSHIBA Supervisor Password (x32 Version: 2.1.0.3 - TOSHIBA Corporation)
TOSHIBA TEMPRO (x32 Version: 3.35 - Toshiba Europe GmbH)
TOSHIBA Value Added Package (Version: 1.6.0021.640203 - TOSHIBA Corporation) Hidden
TOSHIBA Value Added Package (x32 Version: 1.6.0021.640203 - TOSHIBA Corporation)
TOSHIBA Value Added Package (x32 Version: 1.6.0021.640203 - TOSHIBA Corporation) Hidden
TOSHIBA Web Camera Application (x32 Version: 2.0.3.33 - TOSHIBA Corporation)
TOSHIBA Web Camera Application (x32 Version: 2.0.3.33 - TOSHIBA Corporation) Hidden
Ubisoft Game Launcher (x32 Version: 1.0.0.0 - UBISOFT)
Update for 2007 Microsoft Office System (KB967642) (x32 Version: - Microsoft)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3 - Microsoft Corporation)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2850085) 32-Bit Edition (x32 Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (x32 Version: - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (x32 Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (x32 Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (x32 Version: - Microsoft)
Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
Virtual Villagers 4 - The Tree of Life (x32 Version: 2.2.0.98 - WildTangent) Hidden
VLC media player 2.0.3 (x32 Version: 2.0.3 - VideoLAN)
VLC media player 2.0.5 (Version: 2.0.5 - VideoLAN)
welcome (x32 Version: 11.0.22500.0.0 - Nero AG) Hidden
WildTangent Games (x32 Version: 1.0.2.5 - WildTangent)
WildTangent Games App (Toshiba Games) (x32 Version: 4.0.10.15 - WildTangent) Hidden
Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 15.4.3538.0513 - Microsoft Corporation)
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen (x32 Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX control for remote connections (x32 Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (x32 Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Messenger (x32 Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
WinRAR 4.20 (32-Bit) (x32 Version: 4.20.0 - win.rar GmbH)
==================== Restore Points =========================
Could not list Restore Points. Check WMI.
==================== Hosts content: ==========================
2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => ?
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => ?
==================== Loaded Modules (whitelisted) =============
2011-08-22 23:19 - 2011-08-22 23:19 - 11204992 _____ () C:\Program Files\TOSHIBA\FlashCards\BlackPng.dll
2011-11-24 21:20 - 2011-11-24 21:20 - 00593856 _____ () C:\Program Files\TOSHIBA\TECO\TecoPower.dll
2010-12-15 23:19 - 2010-12-15 23:19 - 00124320 _____ () C:\Program Files\TOSHIBA\TECO\MUIHelp.dll
2012-03-07 01:05 - 2011-12-15 15:56 - 00022400 _____ () C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\de\TosDILangPack.resources.dll
2012-03-07 01:05 - 2011-12-15 15:55 - 00063360 _____ () C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIInternal.XmlSerializers.dll
2012-01-20 12:13 - 2012-01-20 12:13 - 00369152 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2011-11-09 17:55 - 2011-11-09 17:55 - 00016384 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2011-11-26 02:51 - 2011-11-26 02:51 - 00079784 _____ () C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosIPCWraper.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PEVSystemStart => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\procexp90.Sys => ""="Driver"
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (01/23/2014 11:42:47 PM) (Source: TabletServicePen) (User: )
Description: Could not init tablet driver
Error: (01/23/2014 11:26:28 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (01/23/2014 07:06:45 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (01/23/2014 05:51:37 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (01/23/2014 03:10:45 PM) (Source: RasClient) (User: )
Description: CoID={4FE72C65-9C35-49D5-A708-07EE1F3CCB56}: Der Benutzer "Maggie\Laura" hat eine Verbindung mit dem Namen "StudNet" gewählt, die Verbindung konnte jedoch nicht hergestellt werden. Der durch den Fehler zurückgegebene Ursachencode lautet: 998.
Error: (01/23/2014 03:10:43 PM) (Source: RasClient) (User: )
Description: CoID={76F64299-2C7C-49C5-B67B-6C7DC6D008D2}: Der Benutzer "Maggie\Laura" hat eine Verbindung mit dem Namen "StudNet" gewählt, die Verbindung konnte jedoch nicht hergestellt werden. Der durch den Fehler zurückgegebene Ursachencode lautet: 998.
Error: (01/22/2014 05:29:55 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Acrobat.exe, Version: 10.1.8.24, Zeitstempel: 0x5225d619
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea8e7
Ausnahmecode: 0xc0000374
Fehleroffset: 0x000ce753
ID des fehlerhaften Prozesses: 0x2100
Startzeit der fehlerhaften Anwendung: 0xAcrobat.exe0
Pfad der fehlerhaften Anwendung: Acrobat.exe1
Pfad des fehlerhaften Moduls: Acrobat.exe2
Berichtskennung: Acrobat.exe3
Error: (01/22/2014 04:53:54 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (01/22/2014 04:49:15 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: firefox.exe, Version: 26.0.0.5087, Zeitstempel: 0x52a0d273
Name des fehlerhaften Moduls: xul.dll, Version: 26.0.0.5087, Zeitstempel: 0x52a0d20a
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0014e1a8
ID des fehlerhaften Prozesses: 0x93c
Startzeit der fehlerhaften Anwendung: 0xfirefox.exe0
Pfad der fehlerhaften Anwendung: firefox.exe1
Pfad des fehlerhaften Moduls: firefox.exe2
Berichtskennung: firefox.exe3
Error: (01/22/2014 04:39:02 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (01/23/2014 11:39:53 PM) (Source: ipnathlp) (User: )
Description: 0
Error: (01/23/2014 11:34:53 PM) (Source: ipnathlp) (User: )
Description: 0
Error: (01/23/2014 11:26:52 PM) (Source: ipnathlp) (User: )
Description: 0
Error: (01/23/2014 11:26:51 PM) (Source: ipnathlp) (User: )
Description: 0
Error: (01/23/2014 11:26:25 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
Error: (01/23/2014 07:20:05 PM) (Source: ipnathlp) (User: )
Description: 0
Error: (01/23/2014 07:12:14 PM) (Source: ipnathlp) (User: )
Description: 0
Error: (01/23/2014 07:12:12 PM) (Source: ipnathlp) (User: )
Description: 0
Error: (01/23/2014 07:10:09 PM) (Source: ipnathlp) (User: )
Description: 0
Error: (01/23/2014 07:07:06 PM) (Source: ipnathlp) (User: )
Description: 0
Microsoft Office Sessions:
=========================
Error: (11/04/2012 02:47:36 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6662.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 3674 seconds with 2520 seconds of active time. This session ended with a crash.
Error: (09/17/2012 10:58:31 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6661.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 2529 seconds with 1800 seconds of active time. This session ended with a crash.
Error: (09/05/2012 03:59:27 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6661.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 1199 seconds with 1020 seconds of active time. This session ended with a crash.
==================== Memory info ===========================
Percentage of memory in use: 43%
Total physical RAM: 8154.8 MB
Available physical RAM: 4624.66 MB
Total Pagefile: 16307.79 MB
Available Pagefile: 11762.51 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB
==================== Drives ================================
Drive c: (TI30886900A) (Fixed) (Total:448.43 GB) (Free:254.75 GB) NTFS ==>[System with boot components (obtained from reading drive)]
==================== MBR & Partition Table ==================
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19355 - hxxp://www.gmer.net
Rootkit scan 2014-01-24 00:26:48
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 TOSHIBA_ rev.GT00 465,76GB
Running: gmer.exe; Driver: C:\Users\LAURA_~1\AppData\Local\Temp\awddypod.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff800035a9000 45 bytes [00, 00, 00, 00, 00, 00, 00, ...]
INITKDBG C:\windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 575 fffff800035a902f 16 bytes [00, 00, 00, 00, 00, 00, 00, ...]
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2272] C:\windows\syswow64\psapi.dll!GetModuleInformation + 69 00000000771a1465 2 bytes [1A, 77]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2272] C:\windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000771a14bb 2 bytes [1A, 77]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[5992] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000771a1465 2 bytes [1A, 77]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[5992] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000771a14bb 2 bytes [1A, 77]
.text ... * 2
.text C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[5636] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000771a1465 2 bytes [1A, 77]
.text C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[5636] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000771a14bb 2 bytes [1A, 77]
.text ... * 2
? C:\windows\system32\mssprxy.dll [5636] entry point in ".rdata" section 00000000676371e6
.text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[8532] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000771a1465 2 bytes [1A, 77]
.text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[8532] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000771a14bb 2 bytes [1A, 77]
.text ... * 2
.text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5644] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000771a1465 2 bytes [1A, 77]
.text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5644] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000771a14bb 2 bytes [1A, 77]
.text ... * 2
.text C:\program files (x86)\avira\antivir desktop\avcenter.exe[10208] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000771a1465 2 bytes [1A, 77]
.text C:\program files (x86)\avira\antivir desktop\avcenter.exe[10208] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000771a14bb 2 bytes [1A, 77]
.text ... * 2
---- Processes - GMER 2.1 ----
Library C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{9DF25BDA-537E-4737-954E-5CEFA39841FC}\mpengine.dll (*** suspicious ***) @ C:\windows\System32\svchost.exe [2928] (Microsoft Malware Protection Engine/Microsoft Corporation SIGNED)(2014-01-21 07:01:03) 000007fee4450000
Library C:\Users\Laura\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (*** suspicious ***) @ C:\windows\Explorer.EXE [4320] 000007fef15a0000
Process C:\Users\Laura\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (*** suspicious ***) @ C:\Users\Laura\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [4844] 0000000000400000
Library C:\Users\Laura\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (*** suspicious ***) @ C:\Program Files (x86)\WinRAR\WinRAR.exe [4340] 0000000073850000
Process C:\Users\Laura\AppData\Local\Temp\Rar$EXa0.631\gmer.exe (*** suspicious ***) @ C:\Users\Laura\AppData\Local\Temp\Rar$EXa0.631\gmer.exe [8264](2014-01-23 22:51:40) 0000000000400000
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Epoch@Epoch 8115
Reg HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Epoch2@Epoch 10130
Reg HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{7A4A2A3D-7397-4D43-A5D1-D9A8E82BE279}@DhcpServer 192.168.1.130
Reg HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{7A4A2A3D-7397-4D43-A5D1-D9A8E82BE279}@LeaseObtainedTime 1390517838
Reg HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{7A4A2A3D-7397-4D43-A5D1-D9A8E82BE279}@T1 1390517988
Reg HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{7A4A2A3D-7397-4D43-A5D1-D9A8E82BE279}@T2 1390518100
Reg HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{7A4A2A3D-7397-4D43-A5D1-D9A8E82BE279}@LeaseTerminatesTime 1390518138
---- EOF - GMER 2.1 ----
|
|
24.01.2014, 07:11
| #2 |
| /// the machine /// TB-Ausbilder    | Windows: BKA-Virus im Browser Hi,
__________________unsere Tools brauchen immer Adminrechte! Scan mit Combofix
__________________ |
|
24.01.2014, 10:04
| #3 |
| | Windows: BKA-Virus im Browser avira ließ sich nicht wirklich deaktivieren. nur den Echzeit-Scanner konnte ich ausstellen.
__________________Code:
ATTFilter ComboFix 14-01-23.02 - Laura_Admin 24.01.2014 9:46.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.8155.5831 [GMT 1:00]
ausgeführt von:: c:\users\Laura\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Laura\AppData\Local\lame_enc.dll
c:\users\Laura\AppData\Local\no23xwrapper.dll
c:\users\Laura\AppData\Local\ogg.dll
c:\users\Laura\AppData\Local\vorbis.dll
c:\users\Laura\AppData\Local\vorbisenc.dll
c:\users\Laura\AppData\Local\vorbisfile.dll
c:\users\Laura\AppData\Roaming\WTouch
c:\users\Laura\AppData\Roaming\WTouch\WTouch.xml
c:\users\Laura_Admin\AppData\Roaming\WTouch
c:\users\Laura_Admin\AppData\Roaming\WTouch\WTouch.xml
c:\users\****\AppData\Roaming\WTouch
c:\users\****\AppData\Roaming\WTouch\WTouch.xml
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-12-24 bis 2014-01-24 ))))))))))))))))))))))))))))))
.
.
2014-01-24 08:53 . 2014-01-24 08:53 75888 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{AE281024-2B42-4973-808B-89E2448A2393}\offreg.dll
2014-01-24 08:53 . 2014-01-24 08:53 -------- d-----w- c:\users\****\AppData\Local\temp
2014-01-24 08:53 . 2014-01-24 08:53 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-01-23 16:53 . 2014-01-23 16:53 -------- d-----w- c:\users\Laura\AppData\Roaming\Malwarebytes
2014-01-23 14:26 . 2014-01-23 14:26 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2014-01-23 14:26 . 2013-04-04 13:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-01-23 14:20 . 2014-01-23 14:20 -------- d-----w- c:\users\Laura\AppData\Local\LogMeInIgnition
2014-01-22 15:48 . 2014-01-22 15:50 -------- d-----w- C:\AdwCleaner
2014-01-22 12:34 . 2014-01-22 12:34 -------- d-----w- c:\users\Laura_Admin\AppData\Roaming\Malwarebytes
2014-01-22 12:34 . 2014-01-22 12:34 -------- d-----w- c:\programdata\Malwarebytes
2014-01-15 08:42 . 2013-11-27 01:41 343040 ----a-w- c:\windows\system32\drivers\usbhub.sys
2014-01-15 08:42 . 2013-11-27 01:41 99840 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2014-01-15 08:42 . 2013-11-27 01:41 53248 ----a-w- c:\windows\system32\drivers\usbehci.sys
2014-01-15 08:42 . 2013-11-27 01:41 325120 ----a-w- c:\windows\system32\drivers\usbport.sys
2014-01-15 08:42 . 2013-11-27 01:41 25600 ----a-w- c:\windows\system32\drivers\usbohci.sys
2014-01-15 08:42 . 2013-11-27 01:41 30720 ----a-w- c:\windows\system32\drivers\usbuhci.sys
2014-01-15 08:42 . 2013-11-27 01:41 7808 ----a-w- c:\windows\system32\drivers\usbd.sys
2014-01-15 08:42 . 2013-11-26 10:32 3156480 ----a-w- c:\windows\system32\win32k.sys
2014-01-15 08:42 . 2013-11-26 11:40 376768 ----a-w- c:\windows\system32\drivers\netio.sys
2014-01-07 16:49 . 2014-01-08 23:09 -------- d-----w- c:\program files (x86)\Common Files\Steam
2014-01-07 16:48 . 2014-01-20 14:51 -------- d-----w- c:\program files (x86)\Steam
2013-12-29 16:19 . 2013-12-29 16:19 -------- d-----w- c:\users\Laura\AppData\Roaming\com.amazon.music.uploader
2013-12-29 16:18 . 2013-12-29 16:18 -------- d-----w- c:\program files (x86)\Amazon
2013-12-25 17:47 . 2013-12-25 17:47 -------- d-----w- c:\program files\DivX
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-01-22 06:49 . 2012-08-22 12:17 35656 ----a-w- c:\windows\system32\LMIport.dll
2014-01-22 06:49 . 2012-08-22 12:17 107368 ----a-w- c:\windows\system32\LMIRfsClientNP.dll
2014-01-22 06:49 . 2012-08-22 12:17 92488 ----a-w- c:\windows\system32\LMIinit.dll
2014-01-19 12:27 . 2012-03-07 00:05 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-01-19 12:27 . 2012-03-07 00:05 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-01-16 08:34 . 2012-08-22 13:00 86054176 ----a-w- c:\windows\system32\MRT.exe
2013-12-20 13:50 . 2012-08-22 12:17 107368 ----a-w- c:\windows\system32\LMIRfsClientNP.dll.000.bak
2013-12-18 06:11 . 2013-12-18 06:11 354656 ----a-w- c:\windows\SysWow64\DivXControlPanelApplet.cpl
2013-12-18 05:13 . 2010-11-21 03:27 270496 ------w- c:\windows\system32\MpSigStub.exe
2013-12-17 12:45 . 2013-05-06 10:21 84720 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2013-12-17 12:45 . 2013-03-29 11:35 131576 ----a-w- c:\windows\system32\drivers\avipbb.sys
2013-12-17 12:45 . 2013-03-29 11:35 108440 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2013-12-05 10:57 . 2013-12-05 10:57 940032 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-12-05 10:57 . 2013-12-05 10:57 194048 ----a-w- c:\windows\SysWow64\elshyph.dll
2013-12-05 10:57 . 2013-12-05 10:57 71680 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2013-12-05 10:57 . 2013-12-05 10:57 645120 ----a-w- c:\windows\SysWow64\jsIntl.dll
2013-12-05 10:57 . 2013-12-05 10:57 62464 ----a-w- c:\windows\SysWow64\tdc.ocx
2013-12-05 10:57 . 2013-12-05 10:57 34816 ----a-w- c:\windows\SysWow64\JavaScriptCollectionAgent.dll
2013-12-05 10:57 . 2013-12-05 10:57 337408 ----a-w- c:\windows\SysWow64\html.iec
2013-12-05 10:57 . 2013-12-05 10:57 235008 ----a-w- c:\windows\system32\elshyph.dll
2013-12-05 10:57 . 2013-12-05 10:57 182272 ----a-w- c:\windows\SysWow64\msls31.dll
2013-12-05 10:57 . 2013-12-05 10:57 942592 ----a-w- c:\windows\system32\jsIntl.dll
2013-12-05 10:57 . 2013-12-05 10:57 90112 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-12-05 10:57 . 2013-12-05 10:57 86016 ----a-w- c:\windows\SysWow64\iesysprep.dll
2013-12-05 10:57 . 2013-12-05 10:57 86016 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2013-12-05 10:57 . 2013-12-05 10:57 74240 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-12-05 10:57 . 2013-12-05 10:57 61952 ----a-w- c:\windows\SysWow64\MshtmlDac.dll
2013-12-05 10:57 . 2013-12-05 10:57 61952 ----a-w- c:\windows\SysWow64\iesetup.dll
2013-12-05 10:57 . 2013-12-05 10:57 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2013-12-05 10:57 . 2013-12-05 10:57 51200 ----a-w- c:\windows\SysWow64\ieetwproxystub.dll
2013-12-05 10:57 . 2013-12-05 10:57 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2013-12-05 10:57 . 2013-12-05 10:57 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-12-05 10:57 . 2013-12-05 10:57 454656 ----a-w- c:\windows\SysWow64\vbscript.dll
2013-12-05 10:57 . 2013-12-05 10:57 36352 ----a-w- c:\windows\SysWow64\imgutil.dll
2013-12-05 10:57 . 2013-12-05 10:57 247808 ----a-w- c:\windows\system32\msls31.dll
2013-12-05 10:57 . 2013-12-05 10:57 24576 ----a-w- c:\windows\SysWow64\licmgr10.dll
2013-12-05 10:57 . 2013-12-05 10:57 195584 ----a-w- c:\windows\system32\msrating.dll
2013-12-05 10:57 . 2013-12-05 10:57 151552 ----a-w- c:\windows\SysWow64\iexpress.exe
2013-12-05 10:57 . 2013-12-05 10:57 139264 ----a-w- c:\windows\SysWow64\wextract.exe
2013-12-05 10:57 . 2013-12-05 10:57 13312 ----a-w- c:\windows\SysWow64\mshta.exe
2013-12-05 10:57 . 2013-12-05 10:57 13312 ----a-w- c:\windows\system32\msfeedssync.exe
2013-12-05 10:57 . 2013-12-05 10:57 131072 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-12-05 10:57 . 2013-12-05 10:57 112128 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2013-12-05 10:57 . 2013-12-05 10:57 111616 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-12-05 10:57 . 2013-12-05 10:57 105984 ----a-w- c:\windows\system32\iesysprep.dll
2013-12-05 10:57 . 2013-12-05 10:57 1051136 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-12-05 10:57 . 2013-12-05 10:57 84992 ----a-w- c:\windows\system32\mshtmled.dll
2013-12-05 10:57 . 2013-12-05 10:57 83968 ----a-w- c:\windows\system32\MshtmlDac.dll
2013-12-05 10:57 . 2013-12-05 10:57 81408 ----a-w- c:\windows\system32\icardie.dll
2013-12-05 10:57 . 2013-12-05 10:57 774144 ----a-w- c:\windows\system32\jscript.dll
2013-12-05 10:57 . 2013-12-05 10:57 77312 ----a-w- c:\windows\system32\tdc.ocx
2013-12-05 10:57 . 2013-12-05 10:57 626176 ----a-w- c:\windows\system32\msfeeds.dll
2013-12-05 10:57 . 2013-12-05 10:57 62464 ----a-w- c:\windows\system32\pngfilt.dll
2013-12-05 10:57 . 2013-12-05 10:57 616104 ----a-w- c:\windows\system32\ieapfltr.dat
2013-12-05 10:57 . 2013-12-05 10:57 548352 ----a-w- c:\windows\system32\vbscript.dll
2013-12-05 10:57 . 2013-12-05 10:57 48128 ----a-w- c:\windows\system32\imgutil.dll
2013-12-05 10:57 . 2013-12-05 10:57 453120 ----a-w- c:\windows\system32\dxtmsft.dll
2013-12-05 10:57 . 2013-12-05 10:57 413696 ----a-w- c:\windows\system32\html.iec
2013-12-05 10:57 . 2013-12-05 10:57 40448 ----a-w- c:\windows\system32\JavaScriptCollectionAgent.dll
2013-12-05 10:57 . 2013-12-05 10:57 30208 ----a-w- c:\windows\system32\licmgr10.dll
2013-12-05 10:57 . 2013-12-05 10:57 296960 ----a-w- c:\windows\system32\dxtrans.dll
2013-12-05 10:57 . 2013-12-05 10:57 263376 ----a-w- c:\windows\system32\iedkcs32.dll
2013-12-05 10:57 . 2013-12-05 10:57 243200 ----a-w- c:\windows\system32\webcheck.dll
2013-12-05 10:57 . 2013-12-05 10:57 235520 ----a-w- c:\windows\system32\url.dll
2013-12-05 10:57 . 2013-12-05 10:57 167424 ----a-w- c:\windows\system32\iexpress.exe
2013-12-05 10:57 . 2013-12-05 10:57 147968 ----a-w- c:\windows\system32\occache.dll
2013-12-05 10:57 . 2013-12-05 10:57 143872 ----a-w- c:\windows\system32\wextract.exe
2013-12-05 10:57 . 2013-12-05 10:57 13824 ----a-w- c:\windows\system32\mshta.exe
2013-12-05 10:57 . 2013-12-05 10:57 135680 ----a-w- c:\windows\system32\iepeers.dll
2013-12-05 10:57 . 2013-12-05 10:57 1228800 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-12-05 10:57 . 2013-12-05 10:57 101376 ----a-w- c:\windows\system32\inseng.dll
2013-11-26 11:54 . 2013-12-13 09:18 23183360 ----a-w- c:\windows\system32\mshtml.dll
2013-11-26 10:19 . 2013-12-13 09:18 2724864 ----a-w- c:\windows\system32\mshtml.tlb
2013-11-26 10:18 . 2013-12-13 09:18 4096 ----a-w- c:\windows\system32\ieetwcollectorres.dll
2013-11-26 09:48 . 2013-12-13 09:18 66048 ----a-w- c:\windows\system32\iesetup.dll
2013-11-26 09:46 . 2013-12-13 09:18 48640 ----a-w- c:\windows\system32\ieetwproxystub.dll
2013-11-26 09:41 . 2013-12-13 09:18 2764288 ----a-w- c:\windows\system32\iertutil.dll
2013-11-26 09:29 . 2013-12-13 09:18 53760 ----a-w- c:\windows\system32\jsproxy.dll
2013-11-26 09:27 . 2013-12-13 09:18 33792 ----a-w- c:\windows\system32\iernonce.dll
2013-11-26 09:23 . 2013-12-13 09:18 2724864 ----a-w- c:\windows\SysWow64\mshtml.tlb
2013-11-26 09:21 . 2013-12-13 09:18 574976 ----a-w- c:\windows\system32\ieui.dll
2013-11-26 09:18 . 2013-12-13 09:18 139264 ----a-w- c:\windows\system32\ieUnatt.exe
2013-11-26 09:18 . 2013-12-13 09:18 111616 ----a-w- c:\windows\system32\ieetwcollector.exe
2013-11-26 09:16 . 2013-12-13 09:18 708608 ----a-w- c:\windows\system32\jscript9diag.dll
2013-11-26 08:57 . 2013-12-13 09:18 218624 ----a-w- c:\windows\system32\ie4uinit.exe
2013-11-26 08:35 . 2013-12-13 09:18 5769216 ----a-w- c:\windows\system32\jscript9.dll
2013-11-26 08:28 . 2013-12-13 09:18 553472 ----a-w- c:\windows\SysWow64\jscript9diag.dll
2013-11-26 08:16 . 2013-12-13 09:18 4243968 ----a-w- c:\windows\SysWow64\jscript9.dll
2013-11-26 08:02 . 2013-12-13 09:18 1995264 ----a-w- c:\windows\system32\inetcpl.cpl
2013-11-26 07:48 . 2013-12-13 09:18 12996608 ----a-w- c:\windows\system32\ieframe.dll
2013-11-26 07:32 . 2013-12-13 09:18 1928192 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2013-11-26 07:07 . 2013-12-13 09:18 2334208 ----a-w- c:\windows\system32\wininet.dll
2013-11-26 06:40 . 2013-12-13 09:18 1395200 ----a-w- c:\windows\system32\urlmon.dll
2013-11-26 06:34 . 2013-12-13 09:18 817664 ----a-w- c:\windows\system32\ieapfltr.dll
2013-11-26 06:33 . 2013-12-13 09:18 1820160 ----a-w- c:\windows\SysWow64\wininet.dll
2013-11-25 20:24 . 2013-03-29 11:35 28600 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2013-11-23 18:26 . 2013-12-12 08:03 417792 ----a-w- c:\windows\SysWow64\WMPhoto.dll
2013-11-23 17:47 . 2013-12-12 08:03 465920 ----a-w- c:\windows\system32\WMPhoto.dll
2013-11-12 02:23 . 2013-12-12 08:03 2048 ----a-w- c:\windows\system32\tzres.dll
2013-11-12 02:07 . 2013-12-12 08:03 2048 ----a-w- c:\windows\SysWow64\tzres.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TOPI.EXE"="c:\program files (x86)\TOSHIBA\TOSHIBA Online Product Information\TOPI.exe" [2011-05-16 846936]
"GoogleChromeAutoLaunch_58745EC29AEFD66A21D5C736098E5E70"="c:\program files (x86)\Google\Chrome\Application\chrome.exe" [2014-01-11 866584]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-11-14 20584608]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"NBAgent"="c:\program files (x86)\Nero\Nero 11\Nero BackItUp\NBAgent.exe" [2011-11-18 1492264]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-01-20 343168]
"ITSecMng"="c:\program files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2011-04-02 80840]
"USB3MON"="c:\program files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [2012-01-05 291608]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"CanonSolutionMenuEx"="c:\program files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE" [2011-08-04 1612920]
"IJNetworkScannerSelectorEX"="c:\program files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe" [2011-01-15 452016]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS5.5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 1523360]
"Adobe Acrobat Speed Launcher"="c:\program files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" [2013-09-03 41336]
"Acrobat Assistant 8.0"="c:\program files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [2013-09-03 840568]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-12-17 684600]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2013-11-15 1861968]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"TOPI.EXE"="c:\program files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe" [2011-05-16 846936]
.
c:\users\****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
TRDCReminder.lnk - c:\program files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe [2009-9-1 481184]
.
c:\users\Laura_Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
TRDCReminder.lnk - c:\program files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe [2009-9-1 481184]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth Manager.lnk - c:\program files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2012-2-4 2824104]
Toshiba Places Icon Utility.lnk - c:\program files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe [2012-3-7 1492352]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
TRDCReminder.lnk - c:\program files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe [2009-9-1 481184]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 androidusb;ADB Interface Driver;c:\windows\system32\Drivers\androidusb.sys;c:\windows\SYSNATIVE\Drivers\androidusb.sys [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]
R3 TMachInfo;TMachInfo;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\DRIVERS\wacmoumonitor.sys;c:\windows\SYSNATIVE\DRIVERS\wacmoumonitor.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R3 WSDScan;WSD-Scanunterstützung durch UMB;c:\windows\system32\drivers\WSDScan.sys;c:\windows\SYSNATIVE\drivers\WSDScan.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 iusb3hcs;Intel(R) USB 3.0 Host Controller Switch Driver;c:\windows\system32\DRIVERS\iusb3hcs.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hcs.sys [x]
S0 NBVol;Nero Backup Volume Filter Driver;c:\windows\system32\DRIVERS\NBVol.sys;c:\windows\SYSNATIVE\DRIVERS\NBVol.sys [x]
S0 NBVolUp;Nero Backup Volume Upper Filter Driver;c:\windows\system32\DRIVERS\NBVolUp.sys;c:\windows\SYSNATIVE\DRIVERS\NBVolUp.sys [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S2 AdobeActiveFileMonitor7.0;Adobe Active File Monitor V7;c:\program files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe;c:\program files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 LMIGuardianSvc;LMIGuardianSvc;c:\program files (x86)\LogMeIn\x64\LMIGuardianSvc.exe;c:\program files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [x]
S2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files (x86)\LogMeIn\x64\RaInfo.sys;c:\program files (x86)\LogMeIn\x64\RaInfo.sys [x]
S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe;c:\program files (x86)\Nero\Update\NASvc.exe [x]
S2 TabletServicePen;TabletServicePen;c:\windows\system32\Pen_Tablet.exe;c:\windows\SYSNATIVE\Pen_Tablet.exe [x]
S2 TeamViewer9;TeamViewer 9;c:\program files (x86)\TeamViewer\Version9\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version9\TeamViewer_Service.exe [x]
S2 TemproMonitoringService;Notebook Performance Tuning Service (TEMPRO);c:\program files (x86)\Toshiba TEMPRO\TemproSvc.exe;c:\program files (x86)\Toshiba TEMPRO\TemproSvc.exe [x]
S2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;c:\program files\TOSHIBA\TECO\TecoService.exe;c:\program files\TOSHIBA\TECO\TecoService.exe [x]
S2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\DRIVERS\TVALZFL.sys;c:\windows\SYSNATIVE\DRIVERS\TVALZFL.sys [x]
S2 WTouchService;WTouch Service;c:\program files\WTouch\WTouchService.exe;c:\program files\WTouch\WTouchService.exe [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
S3 BtFilter;Bluetooth LowerFilter Class Filter Driver;c:\windows\system32\DRIVERS\btfilter.sys;c:\windows\SYSNATIVE\DRIVERS\btfilter.sys [x]
S3 FwLnk;FwLnk Driver;c:\windows\system32\DRIVERS\FwLnk.sys;c:\windows\SYSNATIVE\DRIVERS\FwLnk.sys [x]
S3 iusb3hub;Intel(R) USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\iusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hub.sys [x]
S3 iusb3xhc;Intel(R) USB 3.0 eXtensible Host Controller Driver;c:\windows\system32\DRIVERS\iusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3xhc.sys [x]
S3 L1C;NDIS Miniport Driver for Atheros AR81xx PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C62x64.sys [x]
S3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys;c:\windows\SYSNATIVE\DRIVERS\pgeffect.sys [x]
S3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUVStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUVStor.sys [x]
S3 SmbDrv;SmbDrv;c:\windows\system32\DRIVERS\Smb_driver.sys;c:\windows\SYSNATIVE\DRIVERS\Smb_driver.sys [x]
S3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [x]
S3 TPCHSrv;TPCH Service;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-01-17 09:29 1211672 ----a-w- c:\program files (x86)\Google\Chrome\Application\32.0.1700.76\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-01-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-03-07 00:21]
.
2014-01-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-03-07 00:21]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 164016 ----a-w- c:\users\Laura\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 164016 ----a-w- c:\users\Laura\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 164016 ----a-w- c:\users\Laura\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 164016 ----a-w- c:\users\Laura\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2012-02-01 12446824]
"SRS Premium Sound HD"="c:\program files\SRS Labs\SRS Control Panel\SRSPanel_64.exe" [2012-02-06 2165120]
"TosSENotify"="c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [2011-11-26 710560]
"TosVolRegulator"="c:\program files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe" [2009-11-11 24376]
"Toshiba TEMPRO"="c:\program files (x86)\Toshiba TEMPRO\TemproTray.exe" [2011-02-10 1546720]
"Toshiba Registration"="c:\program files\TOSHIBA\Registration\ToshibaReminder.exe" [2012-03-07 150992]
"LogMeIn GUI"="c:\program files (x86)\LogMeIn\x64\LogMeInSystray.exe" [2012-06-08 57928]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2011-03-14 2779024]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-09-20 444904]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"*WerKernelReporting"="c:\windows\SYSTEM32\WerFault.exe" [2009-07-14 415232]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.de/
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Free YouTube to MP3 Converter - c:\program files (x86)\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm
IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_43C348BC2E93EB2B.dll/cmsidewiki.html
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~3\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.10 192.168.1.130
TCP: Interfaces\{851F8DFE-A14D-48CE-BAAF-AF193F5F5B1B}: NameServer = 192.168.1.10 192.168.1.130
FF - ProfilePath - c:\users\Laura_Admin\AppData\Roaming\Mozilla\Firefox\Profiles\p6jy9sar.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - prefs.js: network.proxy.type - 0
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - (no file)
Wow6432Node-HKLM-Run-TSleepSrv - %ProgramFiles(x86)%\TOSHIBA\TOSHIBA Sleep Utility\TSleepSrv.exe
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
Wow6432Node-HKLM-Run-DivXMediaServer - c:\program files (x86)\DivX\DivX Media Server\DivXMediaServer.exe
c:\users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk - c:\users\Laura_Admin\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
HKLM-Run-TPwrMain - c:\program files (x86)\TOSHIBA\Power Saver\TPwrMain.EXE
HKLM-Run-TCrdMain - c:\program files (x86)\TOSHIBA\FlashCards\TCrdMain.exe
HKLM-Run-Teco - c:\program files (x86)\TOSHIBA\TECO\Teco.exe
HKLM-Run-TosWaitSrv - c:\program files (x86)\TOSHIBA\TPHM\TosWaitSrv.exe
AddRemove-First PDF - c:\program files (x86)\First PDF\uninstall.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-4232136640-187181736-1447544309-1001_Classes\CLSID]
@DACL=(02 0000)
.
[HKEY_USERS\S-1-5-21-4232136640-187181736-1447544309-1001_Classes\CLSID\{00000001-0E3A-4123-8B32-4B68A91E104A}]
@DACL=(02 0000)
@="Music Place"
.
[HKEY_USERS\S-1-5-21-4232136640-187181736-1447544309-1001_Classes\CLSID\{00000002-0E3A-4123-8B32-4B68A91E104A}]
@DACL=(02 0000)
@="Video Place"
.
[HKEY_USERS\S-1-5-21-4232136640-187181736-1447544309-1001_Classes\CLSID\{00000003-0E3A-4123-8B32-4B68A91E104A}]
@DACL=(02 0000)
@="Software Place"
.
[HKEY_USERS\S-1-5-21-4232136640-187181736-1447544309-1001_Classes\CLSID\{00000006-0E3A-4123-8B32-4B68A91E104A}]
@DACL=(02 0000)
@="Game Place"
.
[HKEY_USERS\S-1-5-21-4232136640-187181736-1447544309-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}]
@DACL=(02 0000)
@="Dropbox Autoplay COM Server"
.
[HKEY_USERS\S-1-5-21-4232136640-187181736-1447544309-1001_Classes\CLSID\{45C6AFA5-2C13-402f-BC5D-45CC8172EF6B}]
@DACL=(02 0000)
@="Bluetooth-Informationsaustausch"
"InfoTip"="Verwenden Sie das Bluetooth Object Transfer Protocol zum Datenaustausch."
.
[HKEY_USERS\S-1-5-21-4232136640-187181736-1447544309-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
@DACL=(02 0000)
@="DropboxExt"
.
[HKEY_USERS\S-1-5-21-4232136640-187181736-1447544309-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
@DACL=(02 0000)
@="DropboxExt"
.
[HKEY_USERS\S-1-5-21-4232136640-187181736-1447544309-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
@DACL=(02 0000)
@="DropboxExt"
.
[HKEY_USERS\S-1-5-21-4232136640-187181736-1447544309-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
@DACL=(02 0000)
@="DropboxExt"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_271_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_271_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_271.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-01-24 09:55:14
ComboFix-quarantined-files.txt 2014-01-24 08:55
.
Vor Suchlauf: 10 Verzeichnis(se), 275.031.830.528 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 275.749.314.560 Bytes frei
.
- - End Of File - - AB5A6C6EE1DE51646AFA8CDD015D005D
|
|
25.01.2014, 11:17
| #4 |
| /// the machine /// TB-Ausbilder | Windows: BKA-Virus im Browser Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
25.01.2014, 14:08
| #5 |
| | Windows: BKA-Virus im Browser Junkware Removal Tool hat nicht funktioniert, da kamen zwei Fehlermeldungen, obwohl ich es als Administrator ausgeführt habe. Die erste hat gesagt "Could not create folder "..." Zugriff verweigert" und die zweite hat gesagt "7-Zip: Internal error, code 104." Auch kann ich mich bei Skype nicht mehr anmelden und Dropbox lässt sich nicht mehr start. Eine Neuinsterllation von beiden hat nicht weitergeholfen. Code:
ATTFilter Malwarebytes Anti-Malware (Trial) 1.75.0.1300 www.malwarebytes.org Database version: v2014.01.24.03 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 11.0.9600.16476 Laura :: MAGGIE [limited] Protection: Disabled 24.01.2014 20:33:30 MBAM-log-2014-01-24 (22-30-49).txt Scan type: Full scan (C:\|) Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 503327 Time elapsed: 1 hour(s), 53 minute(s), 2 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 1 HKCU\Software\Iminent (PUP.Optional.Iminent.A) -> No action taken. Registry Values Detected: 2 HKCU\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{977AE9CC-AF83-45E8-9E03-E2798216E2D5} (PUP.Optional.Iminent.A) -> Data: -> No action taken. HKCU\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser|{977AE9CC-AF83-45E8-9E03-E2798216E2D5} (PUP.Optional.Iminent.A) -> Data: Ìéz—ƒ¯èEžây‚âÕ -> No action taken. Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) Code:
ATTFilter # AdwCleaner v3.017 - Bericht erstellt am 24/01/2014 um 22:37:03
# Aktualisiert 12/01/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Laura_Admin - MAGGIE
# Gestartet von : C:\Users\Laura\Desktop\Neuer Ordner\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.16428
-\\ Mozilla Firefox v26.0 (de)
[ Datei : C:\Users\Laura_Admin\AppData\Roaming\Mozilla\Firefox\Profiles\p6jy9sar.default\prefs.js ]
[ Datei : C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default\prefs.js ]
-\\ Google Chrome v32.0.1700.76
[ Datei : C:\Users\Laura_Admin\AppData\Local\Google\Chrome\User Data\Default\preferences ]
[ Datei : C:\Users\Laura\AppData\Local\Google\Chrome\User Data\Default\preferences ]
[ Datei : C:\Users\****\AppData\Local\Google\Chrome\User Data\Default\preferences ]
*************************
AdwCleaner[R1].txt - [1237 octets] - [24/01/2014 22:34:51]
AdwCleaner[S1].txt - [1160 octets] - [24/01/2014 22:37:03]
########## EOF - \AdwCleaner\AdwCleaner[S1].txt - [1220 octets] ##########
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-01-2014 02
Ran by Laura (ATTENTION: The logged in user is not administrator) on MAGGIE on 25-01-2014 01:21:53
Running from C:\Users\Laura\Desktop\Neuer Ordner
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\Teco.exe
(Wacom Technology, Corp.) C:\Program Files\WTouch\WTouchUser.exe
(Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Spotify Ltd) C:\Users\Laura\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosBtMng.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Toshiba) C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(CANON INC.) C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosLeSrvUseMng.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosLeBtMng.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosLeSrvProvider.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosA2dp.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosBtHid.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosBtHSP.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_43.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_43.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12446824 2012-02-01] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2867984 2011-12-23] (Synaptics Incorporated)
HKLM\...\Run: [SRS Premium Sound HD] - C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe [2165120 2012-02-06] (SRS Labs, Inc.)
HKLM\...\Run: [TPwrMain] - C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [590256 2011-09-23] (TOSHIBA Corporation)
HKLM\...\Run: [TCrdMain] - C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [989056 2011-12-14] (TOSHIBA Corporation)
HKLM\...\Run: [Teco] - C:\Program Files\TOSHIBA\TECO\Teco.exe [1548208 2011-11-24] (TOSHIBA Corporation)
HKLM\...\Run: [TosWaitSrv] - C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [712096 2011-12-14] (TOSHIBA Corporation)
HKLM\...\Run: [TosSENotify] - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [710560 2011-11-26] (TOSHIBA Corporation)
HKLM\...\Run: [TosVolRegulator] - C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation)
HKLM\...\Run: [Toshiba TEMPRO] - C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe [1546720 2011-02-10] (Toshiba Europe GmbH)
HKLM\...\Run: [Toshiba Registration] - C:\Program Files\TOSHIBA\Registration\ToshibaReminder.exe [150992 2012-03-07] (Toshiba Europe GmbH)
HKLM\...\Run: [LogMeIn GUI] - C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe [57928 2012-06-08] (LogMeIn, Inc.)
HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2779024 2011-03-14] (CANON INC.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [444904 2012-09-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [NBAgent] - C:\Program Files (x86)\Nero\Nero 11\Nero BackItUp\NBAgent.exe [1492264 2011-11-18] (Nero AG)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2012-01-20] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [ITSecMng] - C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe [80840 2011-04-02] (TOSHIBA CORPORATION)
HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-01-05] (Intel Corporation)
HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [CanonSolutionMenuEx] - C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1612920 2011-08-04] (CANON INC.)
HKLM-x32\...\Run: [IJNetworkScannerSelectorEX] - C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe [452016 2011-01-15] (CANON INC.)
HKLM-x32\...\Run: [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS5.5ServiceManager] - C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe [1523360 2011-01-12] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe [41336 2013-09-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe [840568 2013-09-03] (Adobe Systems Inc.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-17] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [DivXUpdate] - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1861968 2013-11-15] ()
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20728480 2014-01-14] (Skype Technologies S.A.)
HKCU\...\Run: [Spotify Web Helper] - C:\Users\Laura\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171968 2014-01-16] (Spotify Ltd)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Laura_Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TEUA&bmod=TEUA
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://t.de.msn.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x212A1F26A0E0CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM - {AEE17A01-F07D-4110-B520-CECBE6DD0C09} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TEUA;
SearchScopes: HKLM-x32 - {AEE17A01-F07D-4110-B520-CECBE6DD0C09} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TEUA;
SearchScopes: HKCU - {AEE17A01-F07D-4110-B520-CECBE6DD0C09} URL =
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: TOSHIBA Media Controller Plug-in - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\x64\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)
BHO-x32: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files (x86)\Adobe\Adobe Contribute CS5.1\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
BHO-x32: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: TOSHIBA Media Controller Plug-in - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)
BHO-x32: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Toolbar: HKLM-x32 - Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files (x86)\Adobe\Adobe Contribute CS5.1\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.24.1
Tcpip\..\Interfaces\{851F8DFE-A14D-48CE-BAAF-AF193F5F5B1B}: [NameServer]192.168.1.10 192.168.1.130
FireFox:
========
FF ProfilePath: C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default
FF Homepage: hxxp://www.google.de/
FF NetworkProxy: "autoconfig_url", "https://mediahint.com/default.pac"
FF NetworkProxy: "http", "178.219.201.131"
FF NetworkProxy: "http_port", 3128
FF NetworkProxy: "type", 2
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_12_0_0_43.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.5 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_43.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\windows\system32\Adobe\Director\np32dsw_1204144.dll No File
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @Nero.com/KM - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll ()
FF Plugin-x32: Adobe Acrobat - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: YouTube Unblocker - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default\Extensions\youtubeunblocker@unblocker.yt [2014-01-22]
FF Extension: Flashblock - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default\Extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a} [2014-01-22]
FF Extension: DownloadHelper - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-01-22]
FF Extension: Chrome View - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default\Extensions\chromeview@systemantics.net.xpi [2014-01-22]
FF Extension: Media Hint - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default\Extensions\mediahint@jetpack.xpi [2014-01-22]
FF Extension: ZIP File Wizard Free - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default\Extensions\{1be13464-8e12-4d18-8601-bbae1257b460}.xpi [2014-01-22]
FF Extension: Locale Switcher - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default\Extensions\{338e0b96-2285-4424-b4c8-e25560750fa3}.xpi [2014-01-22]
FF Extension: NoScript - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-01-23]
FF Extension: {828814c3-7178-41b7-a60b-15969f642ba3} - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default\Extensions\{828814c3-7178-41b7-a60b-15969f642ba3}.xpi [2014-01-22]
FF Extension: View Cookies - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default\Extensions\{8F6A6FD9-0619-459f-B9D0-81DE065D4E21}.xpi [2014-01-22]
FF Extension: Password Exporter - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default\Extensions\{B17C1C5A-04B1-11DB-9804-B622A1EF5492}.xpi [2014-01-22]
FF Extension: Adblock Plus - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-22]
FF HKLM-x32\...\Firefox\Extensions: [{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}] - C:\Program Files (x86)\Adobe\Adobe Contribute CS5.1\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}
FF Extension: Adobe Contribute Toolbar - C:\Program Files (x86)\Adobe\Adobe Contribute CS5.1\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9} [2013-01-05]
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2013-01-05]
Chrome:
=======
CHR HomePage: hxxp://www.google.de/
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.83\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll No File
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java Deployment Toolkit 6.0.300.12) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U30) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll No File
CHR Plugin: (Nero Kwik Media Helper) - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll No File
CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Plugin: (McAfee SecurityCenter) - c:\progra~2\mcafee\msc\npmcsn~1.dll No File
CHR Extension: (Adblock Plus) - C:\Users\Laura\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2013-01-02]
CHR Extension: (FlashBlock) - C:\Users\Laura\AppData\Local\Google\Chrome\User Data\Default\Extensions\gofhjkjmkpinhpoiabjplobcaignabnl [2013-01-02]
CHR Extension: (Google Wallet) - C:\Users\Laura\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-24]
CHR Extension: (YouTube Unblocker) - C:\Users\Laura\AppData\Local\Google\Chrome\User Data\Default\Extensions\npnkeeiehehhefofiekoflfedgehcdhl [2013-12-17]
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-17] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG)
R2 lmhosts; C:\Windows\system32\svchost.exe [27648 2011-03-01] (Microsoft Corporation)
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [376144 2014-01-22] (LogMeIn, Inc.)
R2 LMIMaint; C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe [226640 2014-01-22] (LogMeIn, Inc.)
R2 LogMeIn; C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe [407424 2012-06-08] (LogMeIn, Inc.)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 NlaSvc; C:\Windows\System32\svchost.exe [27648 2011-03-01] (Microsoft Corporation)
R2 nsi; C:\Windows\system32\svchost.exe [27648 2011-03-01] (Microsoft Corporation)
R2 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [112080 2011-02-10] (Toshiba Europe GmbH)
R2 WTouchService; C:\Program Files\WTouch\WTouchService.exe [127272 2009-07-15] (Wacom Technology, Corp.)
==================== Drivers (Whitelisted) ====================
S3 androidusb; C:\Windows\System32\Drivers\androidusb.sys [31744 2012-06-05] (Google Inc)
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2013-05-16] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2013-05-16] ()
R2 LMIInfo; C:\Program Files (x86)\LogMeIn\x64\RaInfo.sys [16056 2013-05-29] (LogMeIn, Inc.)
S4 LMIRfsClientNP; No ImagePath
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 SmbDrv; C:\Windows\System32\DRIVERS\Smb_driver.sys [21264 2011-12-23] (Synaptics Incorporated)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27648 2011-03-01] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-01-24 22:57 - 2008-04-11 07:03 - 00095248 _____ (Microsoft Corporation) C:\Users\Laura\Documents\install.res.1040.dll
2014-01-24 13:25 - 2014-01-24 13:25 - 00000000 ____D C:\Users\Laura_Admin\AppData\Roaming\WTouch
2014-01-24 13:25 - 2014-01-24 13:25 - 00000000 ____D C:\Users\Laura_Admin\AppData\Local\Skype
2014-01-24 11:49 - 2014-01-24 11:49 - 00001019 _____ C:\Users\Laura\Desktop\Dropbox.lnk
2014-01-24 11:48 - 2014-01-24 13:22 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-01-24 11:48 - 2014-01-24 13:19 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Dropbox
2014-01-24 11:48 - 2014-01-24 11:48 - 00000000 ____D C:\Users\Laura_Admin\AppData\Roaming\Dropbox
2014-01-24 11:42 - 2014-01-24 11:42 - 37660568 _____ (Dropbox, Inc.) C:\Users\Laura\Downloads\Dropbox 2.6.2.exe
2014-01-24 10:10 - 2014-01-24 10:19 - 00002699 _____ C:\Users\Public\Desktop\Skype.lnk
2014-01-24 10:10 - 2014-01-24 10:10 - 00000000 ___RD C:\Program Files (x86)\Skype
2014-01-24 10:10 - 2014-01-24 10:10 - 00000000 ____D C:\Users\Laura\AppData\Local\Skype
2014-01-24 10:08 - 2014-01-24 10:08 - 01659552 _____ (Skype Technologies S.A.) C:\Users\Laura\Downloads\SkypeSetup.exe
2014-01-24 09:57 - 2014-01-24 09:57 - 00000000 ____D C:\Users\Laura\AppData\Roaming\WTouch
2014-01-24 09:55 - 2014-01-24 09:55 - 00034304 _____ C:\ComboFix.txt
2014-01-24 09:44 - 2011-06-26 07:45 - 00256000 _____ C:\windows\PEV.exe
2014-01-24 09:44 - 2010-11-07 18:20 - 00208896 _____ C:\windows\MBR.exe
2014-01-24 09:44 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2014-01-24 09:44 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2014-01-24 09:44 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2014-01-24 09:44 - 2000-08-31 01:00 - 00098816 _____ C:\windows\sed.exe
2014-01-24 09:44 - 2000-08-31 01:00 - 00080412 _____ C:\windows\grep.exe
2014-01-24 09:44 - 2000-08-31 01:00 - 00068096 _____ C:\windows\zip.exe
2014-01-23 23:46 - 2014-01-23 23:46 - 00000000 ____D C:\FRST
2014-01-23 23:45 - 2014-01-25 01:21 - 00000000 ____D C:\Users\Laura\Desktop\Neuer Ordner
2014-01-23 23:42 - 2014-01-24 13:27 - 00000000 ____D C:\Users\Laura_Admin\AppData\Roaming\Skype
2014-01-23 19:01 - 2014-01-24 09:55 - 00000000 ____D C:\Qoobox
2014-01-23 19:01 - 2014-01-24 09:54 - 00000000 ____D C:\windows\erdnt
2014-01-23 17:53 - 2014-01-23 17:53 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Malwarebytes
2014-01-23 15:26 - 2014-01-23 15:26 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-23 15:26 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2014-01-23 15:20 - 2014-01-23 15:20 - 00000000 ____D C:\Users\Laura\AppData\Local\LogMeInIgnition
2014-01-22 16:48 - 2014-01-24 22:37 - 00000000 ____D C:\AdwCleaner
2014-01-22 13:34 - 2014-01-22 13:34 - 00000000 ____D C:\Users\Laura_Admin\AppData\Roaming\Malwarebytes
2014-01-22 13:34 - 2014-01-22 13:34 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-22 13:33 - 2014-01-23 15:25 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Laura\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-15 09:42 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbhub.sys
2014-01-15 09:42 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbport.sys
2014-01-15 09:42 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbccgp.sys
2014-01-15 09:42 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbehci.sys
2014-01-15 09:42 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbuhci.sys
2014-01-15 09:42 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbohci.sys
2014-01-15 09:42 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbd.sys
2014-01-15 09:42 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\windows\system32\Drivers\netio.sys
2014-01-15 09:42 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2014-01-08 23:32 - 2014-01-08 23:32 - 00001101 _____ C:\Users\Public\Desktop\TeamViewer 9.lnk
2014-01-07 18:28 - 2014-01-07 18:28 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2014-01-07 17:49 - 2014-01-07 17:49 - 00000928 _____ C:\Users\Public\Desktop\Steam.lnk
2014-01-07 17:48 - 2014-01-20 15:51 - 00000000 ____D C:\Program Files (x86)\Steam
2013-12-29 17:19 - 2013-12-29 17:19 - 00000000 ____D C:\Users\Laura\Documents\Amazon Music Importer
2013-12-29 17:19 - 2013-12-29 17:19 - 00000000 ____D C:\Users\Laura\AppData\Roaming\com.amazon.music.uploader
2013-12-29 17:18 - 2013-12-29 17:18 - 09629432 _____ C:\Users\Laura\Downloads\AmazonMusicImporterInstaller-2.1.0._V371017662_.exe
2013-12-29 17:18 - 2013-12-29 17:18 - 00000000 ____D C:\Program Files (x86)\Amazon
2013-12-29 17:00 - 2013-12-29 17:00 - 36152456 _____ (Amazon) C:\Users\Laura\Downloads\AmazonCloudPlayerInstaller_399.exe
==================== One Month Modified Files and Folders =======
2014-01-25 01:21 - 2014-01-23 23:45 - 00000000 ____D C:\Users\Laura\Desktop\Neuer Ordner
2014-01-25 01:17 - 2012-03-07 01:21 - 00001124 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-24 23:01 - 2009-07-14 05:45 - 00024608 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-24 23:01 - 2009-07-14 05:45 - 00024608 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-24 22:54 - 2011-02-11 09:21 - 00654400 _____ C:\windows\system32\perfh007.dat
2014-01-24 22:54 - 2011-02-11 09:21 - 00130240 _____ C:\windows\system32\perfc007.dat
2014-01-24 22:54 - 2009-07-14 06:13 - 01498742 _____ C:\windows\system32\PerfStringBackup.INI
2014-01-24 22:43 - 2012-06-14 17:30 - 01649931 _____ C:\windows\WindowsUpdate.log
2014-01-24 22:42 - 2012-08-22 13:29 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Skype
2014-01-24 22:40 - 2013-10-01 18:35 - 00000591 _____ C:\windows\system32\Drivers\etc\hosts.ics
2014-01-24 22:39 - 2012-03-07 01:21 - 00001120 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-24 22:38 - 2009-07-14 06:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2014-01-24 22:38 - 2009-07-14 05:51 - 00142369 _____ C:\windows\setupact.log
2014-01-24 22:37 - 2014-01-22 16:48 - 00000000 ____D C:\AdwCleaner
2014-01-24 13:30 - 2012-08-31 15:10 - 00000000 ____D C:\Users\Laura\AppData\Roaming\WTablet
2014-01-24 13:28 - 2013-01-05 15:51 - 00000000 ____D C:\Users\Laura_Admin\AppData\Local\Mozilla
2014-01-24 13:28 - 2012-08-29 14:09 - 00002030 _____ C:\Users\Public\Desktop\Adobe Reader X.lnk
2014-01-24 13:27 - 2014-01-23 23:42 - 00000000 ____D C:\Users\Laura_Admin\AppData\Roaming\Skype
2014-01-24 13:25 - 2014-01-24 13:25 - 00000000 ____D C:\Users\Laura_Admin\AppData\Roaming\WTouch
2014-01-24 13:25 - 2014-01-24 13:25 - 00000000 ____D C:\Users\Laura_Admin\AppData\Local\Skype
2014-01-24 13:22 - 2014-01-24 11:48 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-01-24 13:19 - 2014-01-24 11:48 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Dropbox
2014-01-24 13:17 - 2010-11-21 04:47 - 00117198 _____ C:\windows\PFRO.log
2014-01-24 11:49 - 2014-01-24 11:49 - 00001019 _____ C:\Users\Laura\Desktop\Dropbox.lnk
2014-01-24 11:48 - 2014-01-24 11:48 - 00000000 ____D C:\Users\Laura_Admin\AppData\Roaming\Dropbox
2014-01-24 11:42 - 2014-01-24 11:42 - 37660568 _____ (Dropbox, Inc.) C:\Users\Laura\Downloads\Dropbox 2.6.2.exe
2014-01-24 11:29 - 2013-12-06 14:29 - 00000000 ___RD C:\Users\Laura\Dropbox
2014-01-24 11:27 - 2013-09-17 22:43 - 00000000 ____D C:\Users\Laura\Desktop\uni
2014-01-24 10:19 - 2014-01-24 10:10 - 00002699 _____ C:\Users\Public\Desktop\Skype.lnk
2014-01-24 10:19 - 2012-03-07 01:22 - 00000000 ____D C:\ProgramData\Skype
2014-01-24 10:10 - 2014-01-24 10:10 - 00000000 ___RD C:\Program Files (x86)\Skype
2014-01-24 10:10 - 2014-01-24 10:10 - 00000000 ____D C:\Users\Laura\AppData\Local\Skype
2014-01-24 10:08 - 2014-01-24 10:08 - 01659552 _____ (Skype Technologies S.A.) C:\Users\Laura\Downloads\SkypeSetup.exe
2014-01-24 10:05 - 2012-08-22 12:31 - 00000000 ____D C:\Users\Laura_Admin
2014-01-24 09:57 - 2014-01-24 09:57 - 00000000 ____D C:\Users\Laura\AppData\Roaming\WTouch
2014-01-24 09:55 - 2014-01-24 09:55 - 00034304 _____ C:\ComboFix.txt
2014-01-24 09:55 - 2014-01-23 19:01 - 00000000 ____D C:\Qoobox
2014-01-24 09:54 - 2014-01-23 19:01 - 00000000 ____D C:\windows\erdnt
2014-01-24 09:54 - 2012-08-22 13:28 - 00000000 ___RD C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-01-24 09:53 - 2009-07-14 03:34 - 00000215 _____ C:\windows\system.ini
2014-01-24 09:43 - 2012-08-22 17:16 - 00000000 ____D C:\Users\Laura\AppData\Local\Adobe
2014-01-24 00:30 - 2013-07-04 18:44 - 957203433 _____ C:\windows\MEMORY.DMP
2014-01-24 00:30 - 2013-07-04 18:44 - 00000000 ____D C:\windows\Minidump
2014-01-24 00:00 - 2012-08-22 13:17 - 00000000 ____D C:\ProgramData\LogMeIn
2014-01-23 23:46 - 2014-01-23 23:46 - 00000000 ____D C:\FRST
2014-01-23 23:42 - 2012-08-22 12:36 - 00118064 _____ C:\Users\Laura_Admin\AppData\Local\GDIPFONTCACHEV1.DAT
2014-01-23 23:42 - 2012-08-22 12:36 - 00001432 _____ C:\Users\Laura_Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-01-23 23:42 - 2012-08-22 12:36 - 00000000 ___RD C:\Users\Laura_Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-01-23 23:42 - 2012-08-22 12:31 - 00000000 ___RD C:\Users\Laura_Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-01-23 17:53 - 2014-01-23 17:53 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Malwarebytes
2014-01-23 15:26 - 2014-01-23 15:26 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-23 15:25 - 2014-01-22 13:33 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Laura\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-23 15:20 - 2014-01-23 15:20 - 00000000 ____D C:\Users\Laura\AppData\Local\LogMeInIgnition
2014-01-22 16:46 - 2012-08-22 15:57 - 00000000 ____D C:\Users\Laura\Desktop\Alles Mögliche
2014-01-22 16:45 - 2012-10-08 14:53 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Spotify
2014-01-22 16:23 - 2012-09-13 15:09 - 00000000 ____D C:\Program Files (x86)\DivX
2014-01-22 16:23 - 2012-09-13 15:08 - 00000000 ____D C:\ProgramData\DivX
2014-01-22 16:21 - 2013-08-26 12:19 - 00993600 _____ (DivX, LLC) C:\Users\Laura\Downloads\DivXInstaller.exe
2014-01-22 13:34 - 2014-01-22 13:34 - 00000000 ____D C:\Users\Laura_Admin\AppData\Roaming\Malwarebytes
2014-01-22 13:34 - 2014-01-22 13:34 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-22 07:50 - 2012-08-22 13:17 - 00000000 ____D C:\Program Files (x86)\LogMeIn
2014-01-22 07:49 - 2012-08-22 13:17 - 00107368 _____ (LogMeIn, Inc.) C:\windows\system32\LMIRfsClientNP.dll
2014-01-22 07:49 - 2012-08-22 13:17 - 00092488 _____ (LogMeIn, Inc.) C:\windows\system32\LMIinit.dll
2014-01-22 07:49 - 2012-08-22 13:17 - 00035656 _____ (LogMeIn, Inc.) C:\windows\system32\LMIport.dll
2014-01-20 18:51 - 2012-10-08 14:53 - 00000000 ____D C:\Users\Laura\AppData\Local\Spotify
2014-01-20 15:51 - 2014-01-07 17:48 - 00000000 ____D C:\Program Files (x86)\Steam
2014-01-19 13:27 - 2012-03-07 01:44 - 00000000 ____D C:\ProgramData\McAfee
2014-01-19 13:27 - 2012-03-07 01:05 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2014-01-19 13:27 - 2012-03-07 01:05 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-01-19 13:26 - 2012-08-23 07:38 - 00000000 ____D C:\Users\Laura_Admin\AppData\Local\Adobe
2014-01-17 10:30 - 2012-03-07 01:22 - 00002186 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2014-01-16 16:42 - 2009-07-14 05:45 - 05009400 _____ C:\windows\system32\FNTCACHE.DAT
2014-01-16 09:37 - 2013-08-15 02:01 - 00000000 ____D C:\windows\system32\MRT
2014-01-16 09:37 - 2012-08-23 00:17 - 00000000 ____D C:\ProgramData\Microsoft Help
2014-01-16 09:34 - 2012-08-22 14:00 - 86054176 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-01-11 00:17 - 2009-07-14 04:20 - 00000000 ____D C:\windows\system32\NDF
2014-01-09 00:06 - 2012-08-22 13:28 - 00118064 _____ C:\Users\Laura\AppData\Local\GDIPFONTCACHEV1.DAT
2014-01-08 23:32 - 2014-01-08 23:32 - 00001101 _____ C:\Users\Public\Desktop\TeamViewer 9.lnk
2014-01-08 23:32 - 2013-01-05 00:18 - 00000000 ____D C:\Program Files (x86)\TeamViewer
2014-01-07 18:28 - 2014-01-07 18:28 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2014-01-07 17:49 - 2014-01-07 17:49 - 00000928 _____ C:\Users\Public\Desktop\Steam.lnk
2014-01-07 17:49 - 2012-08-22 13:28 - 00000000 ____D C:\Users\Laura
2014-01-03 18:14 - 2009-07-14 06:08 - 00032632 _____ C:\windows\Tasks\SCHEDLGU.TXT
2013-12-30 23:53 - 2009-07-14 04:20 - 00000000 ____D C:\windows\LiveKernelReports
2013-12-29 17:19 - 2013-12-29 17:19 - 00000000 ____D C:\Users\Laura\Documents\Amazon Music Importer
2013-12-29 17:19 - 2013-12-29 17:19 - 00000000 ____D C:\Users\Laura\AppData\Roaming\com.amazon.music.uploader
2013-12-29 17:18 - 2013-12-29 17:18 - 09629432 _____ C:\Users\Laura\Downloads\AmazonMusicImporterInstaller-2.1.0._V371017662_.exe
2013-12-29 17:18 - 2013-12-29 17:18 - 00000000 ____D C:\Program Files (x86)\Amazon
2013-12-29 17:00 - 2013-12-29 17:00 - 36152456 _____ (Amazon) C:\Users\Laura\Downloads\AmazonCloudPlayerInstaller_399.exe
Some content of TEMP:
====================
C:\Users\Laura\AppData\Local\Temp\avgnt.exe
C:\Users\Laura_Admin\AppData\Local\Temp\avgnt.exe
C:\Users\Laura_Admin\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== End Of Log ============================
|
|
26.01.2014, 07:11
| #6 |
| /// the machine /// TB-Ausbilder | Windows: BKA-Virus im Browser MBAM nochmal, du hast die Funde nicht löschen lassen. ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ --> Windows: BKA-Virus im Browser |
|
26.01.2014, 18:44
| #7 |
| | Windows: BKA-Virus im Browser Das war ausversehen die falsche MBAM Datei. Hier die richtige. Sype und Dropbox funktionieren immer noch nicht. Code:
ATTFilter Malwarebytes Anti-Malware (Trial) 1.75.0.1300 www.malwarebytes.org Database version: v2014.01.24.03 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 11.0.9600.16476 Laura :: MAGGIE [limited] Protection: Disabled 24.01.2014 20:33:30 mbam-log-2014-01-24 (20-33-30).txt Scan type: Full scan (C:\|) Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 503327 Time elapsed: 1 hour(s), 53 minute(s), 2 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 1 HKCU\Software\Iminent (PUP.Optional.Iminent.A) -> Quarantined and deleted successfully. Registry Values Detected: 2 HKCU\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{977AE9CC-AF83-45E8-9E03-E2798216E2D5} (PUP.Optional.Iminent.A) -> Data: -> Quarantined and deleted successfully. HKCU\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser|{977AE9CC-AF83-45E8-9E03-E2798216E2D5} (PUP.Optional.Iminent.A) -> Data: Ìéz—ƒ¯èEžây‚âÕ -> Quarantined and deleted successfully. Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=c6b44e6a4ce9124480ad39244f4d9284
# engine=16802
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-01-26 05:21:11
# local_time=2014-01-26 06:21:11 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 96 19909 161428176 12662 0
# compatibility_mode=5893 16776573 100 94 160983 142386721 0 0
# scanned=343138
# found=0
# cleaned=0
# scan_time=8872
Code:
ATTFilter Results of screen317's Security Check version 0.99.79 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 11 ``````````````Antivirus/Firewall Check:`````````````` Avira Desktop Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware Version 1.75.0.1300 Java 7 Update 45 Java version out of Date! Adobe Flash Player 12.0.0.43 Flash Player out of Date! Adobe Reader 10.1.9 Adobe Reader out of Date! Mozilla Firefox (26.0) Mozilla Thunderbird 15.0.1 Thunderbird out of Date! Google Chrome 31.0.1650.63 Google Chrome 32.0.1700.76 ````````Process Check: objlist.exe by Laurent```````` Avira Antivir avgnt.exe Avira Antivir avguard.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-01-2014 02
Ran by Laura (ATTENTION: The logged in user is not administrator) on MAGGIE on 26-01-2014 18:35:27
Running from C:\Users\Laura\Desktop\Neuer Ordner
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\Teco.exe
(Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Spotify Ltd) C:\Users\Laura\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosBtMng.exe
(Toshiba) C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe
(Wacom Technology, Corp.) C:\Program Files\WTouch\WTouchUser.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(CANON INC.) C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosLeSrvUseMng.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosLeBtMng.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosLeSrvProvider.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosA2dp.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosBtHid.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosBtHSP.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12446824 2012-02-01] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2867984 2011-12-23] (Synaptics Incorporated)
HKLM\...\Run: [SRS Premium Sound HD] - C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe [2165120 2012-02-06] (SRS Labs, Inc.)
HKLM\...\Run: [TPwrMain] - C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [590256 2011-09-23] (TOSHIBA Corporation)
HKLM\...\Run: [TCrdMain] - C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [989056 2011-12-14] (TOSHIBA Corporation)
HKLM\...\Run: [Teco] - C:\Program Files\TOSHIBA\TECO\Teco.exe [1548208 2011-11-24] (TOSHIBA Corporation)
HKLM\...\Run: [TosWaitSrv] - C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [712096 2011-12-14] (TOSHIBA Corporation)
HKLM\...\Run: [TosSENotify] - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [710560 2011-11-26] (TOSHIBA Corporation)
HKLM\...\Run: [TosVolRegulator] - C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation)
HKLM\...\Run: [Toshiba TEMPRO] - C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe [1546720 2011-02-10] (Toshiba Europe GmbH)
HKLM\...\Run: [Toshiba Registration] - C:\Program Files\TOSHIBA\Registration\ToshibaReminder.exe [150992 2012-03-07] (Toshiba Europe GmbH)
HKLM\...\Run: [LogMeIn GUI] - C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe [57928 2012-06-08] (LogMeIn, Inc.)
HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2779024 2011-03-14] (CANON INC.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [444904 2012-09-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [NBAgent] - C:\Program Files (x86)\Nero\Nero 11\Nero BackItUp\NBAgent.exe [1492264 2011-11-18] (Nero AG)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2012-01-20] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [ITSecMng] - C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe [80840 2011-04-02] (TOSHIBA CORPORATION)
HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-01-05] (Intel Corporation)
HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [CanonSolutionMenuEx] - C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1612920 2011-08-04] (CANON INC.)
HKLM-x32\...\Run: [IJNetworkScannerSelectorEX] - C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe [452016 2011-01-15] (CANON INC.)
HKLM-x32\...\Run: [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS5.5ServiceManager] - C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe [1523360 2011-01-12] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe [41336 2013-09-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe [840568 2013-09-03] (Adobe Systems Inc.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-17] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [DivXUpdate] - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1861968 2013-11-15] ()
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20728480 2014-01-14] (Skype Technologies S.A.)
HKCU\...\Run: [Spotify Web Helper] - C:\Users\Laura\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171968 2014-01-16] (Spotify Ltd)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Laura_Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TEUA&bmod=TEUA
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://t.de.msn.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x212A1F26A0E0CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM - {AEE17A01-F07D-4110-B520-CECBE6DD0C09} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TEUA;
SearchScopes: HKLM-x32 - {AEE17A01-F07D-4110-B520-CECBE6DD0C09} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TEUA;
SearchScopes: HKCU - {AEE17A01-F07D-4110-B520-CECBE6DD0C09} URL =
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: TOSHIBA Media Controller Plug-in - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\x64\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)
BHO-x32: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files (x86)\Adobe\Adobe Contribute CS5.1\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
BHO-x32: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: TOSHIBA Media Controller Plug-in - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)
BHO-x32: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Toolbar: HKLM-x32 - Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files (x86)\Adobe\Adobe Contribute CS5.1\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.24.1
Tcpip\..\Interfaces\{851F8DFE-A14D-48CE-BAAF-AF193F5F5B1B}: [NameServer]192.168.1.10 192.168.1.130
FireFox:
========
FF ProfilePath: C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default
FF Homepage: hxxp://www.google.de/
FF NetworkProxy: "autoconfig_url", "https://mediahint.com/default.pac"
FF NetworkProxy: "http", "178.219.201.131"
FF NetworkProxy: "http_port", 3128
FF NetworkProxy: "type", 2
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_12_0_0_43.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.5 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_43.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\windows\system32\Adobe\Director\np32dsw_1204144.dll No File
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @Nero.com/KM - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll ()
FF Plugin-x32: Adobe Acrobat - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: YouTube Unblocker - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default\Extensions\youtubeunblocker@unblocker.yt [2014-01-22]
FF Extension: Flashblock - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default\Extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a} [2014-01-22]
FF Extension: DownloadHelper - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-01-22]
FF Extension: Chrome View - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default\Extensions\chromeview@systemantics.net.xpi [2014-01-22]
FF Extension: Media Hint - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default\Extensions\mediahint@jetpack.xpi [2014-01-22]
FF Extension: ZIP File Wizard Free - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default\Extensions\{1be13464-8e12-4d18-8601-bbae1257b460}.xpi [2014-01-22]
FF Extension: Locale Switcher - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default\Extensions\{338e0b96-2285-4424-b4c8-e25560750fa3}.xpi [2014-01-22]
FF Extension: NoScript - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-01-23]
FF Extension: {828814c3-7178-41b7-a60b-15969f642ba3} - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default\Extensions\{828814c3-7178-41b7-a60b-15969f642ba3}.xpi [2014-01-22]
FF Extension: View Cookies - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default\Extensions\{8F6A6FD9-0619-459f-B9D0-81DE065D4E21}.xpi [2014-01-22]
FF Extension: Password Exporter - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default\Extensions\{B17C1C5A-04B1-11DB-9804-B622A1EF5492}.xpi [2014-01-22]
FF Extension: Adblock Plus - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-22]
FF HKLM-x32\...\Firefox\Extensions: [{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}] - C:\Program Files (x86)\Adobe\Adobe Contribute CS5.1\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}
FF Extension: Adobe Contribute Toolbar - C:\Program Files (x86)\Adobe\Adobe Contribute CS5.1\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9} [2013-01-05]
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2013-01-05]
Chrome:
=======
CHR HomePage: hxxp://www.google.de/
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.83\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll No File
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java Deployment Toolkit 6.0.300.12) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U30) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll No File
CHR Plugin: (Nero Kwik Media Helper) - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll No File
CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Plugin: (McAfee SecurityCenter) - c:\progra~2\mcafee\msc\npmcsn~1.dll No File
CHR Extension: (Adblock Plus) - C:\Users\Laura\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2013-01-02]
CHR Extension: (FlashBlock) - C:\Users\Laura\AppData\Local\Google\Chrome\User Data\Default\Extensions\gofhjkjmkpinhpoiabjplobcaignabnl [2013-01-02]
CHR Extension: (Google Wallet) - C:\Users\Laura\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-24]
CHR Extension: (YouTube Unblocker) - C:\Users\Laura\AppData\Local\Google\Chrome\User Data\Default\Extensions\npnkeeiehehhefofiekoflfedgehcdhl [2013-12-17]
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-17] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG)
R2 lmhosts; C:\Windows\system32\svchost.exe [27648 2011-03-01] (Microsoft Corporation)
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [376144 2014-01-22] (LogMeIn, Inc.)
R2 LMIMaint; C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe [226640 2014-01-22] (LogMeIn, Inc.)
R2 LogMeIn; C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe [407424 2012-06-08] (LogMeIn, Inc.)
S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 NlaSvc; C:\Windows\System32\svchost.exe [27648 2011-03-01] (Microsoft Corporation)
R2 nsi; C:\Windows\system32\svchost.exe [27648 2011-03-01] (Microsoft Corporation)
R2 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [112080 2011-02-10] (Toshiba Europe GmbH)
R2 WTouchService; C:\Program Files\WTouch\WTouchService.exe [127272 2009-07-15] (Wacom Technology, Corp.)
==================== Drivers (Whitelisted) ====================
S3 androidusb; C:\Windows\System32\Drivers\androidusb.sys [31744 2012-06-05] (Google Inc)
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2013-05-16] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2013-05-16] ()
R2 LMIInfo; C:\Program Files (x86)\LogMeIn\x64\RaInfo.sys [16056 2013-05-29] (LogMeIn, Inc.)
S4 LMIRfsClientNP; No ImagePath
S3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 SmbDrv; C:\Windows\System32\DRIVERS\Smb_driver.sys [21264 2011-12-23] (Synaptics Incorporated)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27648 2011-03-01] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-01-24 22:57 - 2008-04-11 07:03 - 00095248 _____ (Microsoft Corporation) C:\Users\Laura\Documents\install.res.1040.dll
2014-01-24 13:25 - 2014-01-24 13:25 - 00000000 ____D C:\Users\Laura_Admin\AppData\Roaming\WTouch
2014-01-24 13:25 - 2014-01-24 13:25 - 00000000 ____D C:\Users\Laura_Admin\AppData\Local\Skype
2014-01-24 11:49 - 2014-01-24 11:49 - 00001019 _____ C:\Users\Laura\Desktop\Dropbox.lnk
2014-01-24 11:48 - 2014-01-24 13:22 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-01-24 11:48 - 2014-01-24 13:19 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Dropbox
2014-01-24 11:48 - 2014-01-24 11:48 - 00000000 ____D C:\Users\Laura_Admin\AppData\Roaming\Dropbox
2014-01-24 11:42 - 2014-01-24 11:42 - 37660568 _____ (Dropbox, Inc.) C:\Users\Laura\Downloads\Dropbox 2.6.2.exe
2014-01-24 10:10 - 2014-01-24 10:19 - 00002699 _____ C:\Users\Public\Desktop\Skype.lnk
2014-01-24 10:10 - 2014-01-24 10:10 - 00000000 ___RD C:\Program Files (x86)\Skype
2014-01-24 10:10 - 2014-01-24 10:10 - 00000000 ____D C:\Users\Laura\AppData\Local\Skype
2014-01-24 10:08 - 2014-01-24 10:08 - 01659552 _____ (Skype Technologies S.A.) C:\Users\Laura\Downloads\SkypeSetup.exe
2014-01-24 09:57 - 2014-01-24 09:57 - 00000000 ____D C:\Users\Laura\AppData\Roaming\WTouch
2014-01-24 09:55 - 2014-01-24 09:55 - 00034304 _____ C:\ComboFix.txt
2014-01-24 09:44 - 2011-06-26 07:45 - 00256000 _____ C:\windows\PEV.exe
2014-01-24 09:44 - 2010-11-07 18:20 - 00208896 _____ C:\windows\MBR.exe
2014-01-24 09:44 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2014-01-24 09:44 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2014-01-24 09:44 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2014-01-24 09:44 - 2000-08-31 01:00 - 00098816 _____ C:\windows\sed.exe
2014-01-24 09:44 - 2000-08-31 01:00 - 00080412 _____ C:\windows\grep.exe
2014-01-24 09:44 - 2000-08-31 01:00 - 00068096 _____ C:\windows\zip.exe
2014-01-23 23:46 - 2014-01-26 18:35 - 00000000 ____D C:\FRST
2014-01-23 23:45 - 2014-01-26 18:35 - 00000000 ____D C:\Users\Laura\Desktop\Neuer Ordner
2014-01-23 23:42 - 2014-01-24 13:27 - 00000000 ____D C:\Users\Laura_Admin\AppData\Roaming\Skype
2014-01-23 19:01 - 2014-01-24 09:55 - 00000000 ____D C:\Qoobox
2014-01-23 19:01 - 2014-01-24 09:54 - 00000000 ____D C:\windows\erdnt
2014-01-23 17:53 - 2014-01-23 17:53 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Malwarebytes
2014-01-23 15:26 - 2014-01-23 15:26 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-23 15:26 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2014-01-23 15:20 - 2014-01-23 15:20 - 00000000 ____D C:\Users\Laura\AppData\Local\LogMeInIgnition
2014-01-22 16:48 - 2014-01-24 22:37 - 00000000 ____D C:\AdwCleaner
2014-01-22 13:34 - 2014-01-22 13:34 - 00000000 ____D C:\Users\Laura_Admin\AppData\Roaming\Malwarebytes
2014-01-22 13:34 - 2014-01-22 13:34 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-22 13:33 - 2014-01-23 15:25 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Laura\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-15 09:42 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbhub.sys
2014-01-15 09:42 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbport.sys
2014-01-15 09:42 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbccgp.sys
2014-01-15 09:42 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbehci.sys
2014-01-15 09:42 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbuhci.sys
2014-01-15 09:42 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbohci.sys
2014-01-15 09:42 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbd.sys
2014-01-15 09:42 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\windows\system32\Drivers\netio.sys
2014-01-15 09:42 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2014-01-08 23:32 - 2014-01-08 23:32 - 00001101 _____ C:\Users\Public\Desktop\TeamViewer 9.lnk
2014-01-07 18:28 - 2014-01-07 18:28 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2014-01-07 17:49 - 2014-01-07 17:49 - 00000928 _____ C:\Users\Public\Desktop\Steam.lnk
2014-01-07 17:48 - 2014-01-26 00:45 - 00000000 ____D C:\Program Files (x86)\Steam
2013-12-29 17:19 - 2013-12-29 17:19 - 00000000 ____D C:\Users\Laura\Documents\Amazon Music Importer
2013-12-29 17:19 - 2013-12-29 17:19 - 00000000 ____D C:\Users\Laura\AppData\Roaming\com.amazon.music.uploader
2013-12-29 17:18 - 2013-12-29 17:18 - 09629432 _____ C:\Users\Laura\Downloads\AmazonMusicImporterInstaller-2.1.0._V371017662_.exe
2013-12-29 17:18 - 2013-12-29 17:18 - 00000000 ____D C:\Program Files (x86)\Amazon
2013-12-29 17:00 - 2013-12-29 17:00 - 36152456 _____ (Amazon) C:\Users\Laura\Downloads\AmazonCloudPlayerInstaller_399.exe
==================== One Month Modified Files and Folders =======
2014-01-26 18:35 - 2014-01-23 23:46 - 00000000 ____D C:\FRST
2014-01-26 18:35 - 2014-01-23 23:45 - 00000000 ____D C:\Users\Laura\Desktop\Neuer Ordner
2014-01-26 18:27 - 2012-08-22 13:29 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Skype
2014-01-26 18:24 - 2012-06-14 17:30 - 01730571 _____ C:\windows\WindowsUpdate.log
2014-01-26 18:17 - 2012-03-07 01:21 - 00001124 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-26 13:55 - 2012-08-22 17:16 - 00000000 ____D C:\Users\Laura\AppData\Local\Adobe
2014-01-26 13:52 - 2009-07-14 05:45 - 00024608 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-26 13:52 - 2009-07-14 05:45 - 00024608 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-26 13:50 - 2011-02-11 09:21 - 00654400 _____ C:\windows\system32\perfh007.dat
2014-01-26 13:50 - 2011-02-11 09:21 - 00130240 _____ C:\windows\system32\perfc007.dat
2014-01-26 13:50 - 2009-07-14 06:13 - 01498742 _____ C:\windows\system32\PerfStringBackup.INI
2014-01-26 13:45 - 2013-10-01 18:35 - 00000591 _____ C:\windows\system32\Drivers\etc\hosts.ics
2014-01-26 13:44 - 2012-03-07 01:21 - 00001120 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-26 13:43 - 2009-07-14 06:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2014-01-26 13:43 - 2009-07-14 05:51 - 00143135 _____ C:\windows\setupact.log
2014-01-26 00:47 - 2012-08-22 13:17 - 00000000 ____D C:\ProgramData\LogMeIn
2014-01-26 00:45 - 2014-01-07 17:48 - 00000000 ____D C:\Program Files (x86)\Steam
2014-01-25 21:36 - 2012-10-08 14:53 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Spotify
2014-01-24 22:37 - 2014-01-22 16:48 - 00000000 ____D C:\AdwCleaner
2014-01-24 13:30 - 2012-08-31 15:10 - 00000000 ____D C:\Users\Laura\AppData\Roaming\WTablet
2014-01-24 13:28 - 2013-01-05 15:51 - 00000000 ____D C:\Users\Laura_Admin\AppData\Local\Mozilla
2014-01-24 13:28 - 2012-08-29 14:09 - 00002030 _____ C:\Users\Public\Desktop\Adobe Reader X.lnk
2014-01-24 13:27 - 2014-01-23 23:42 - 00000000 ____D C:\Users\Laura_Admin\AppData\Roaming\Skype
2014-01-24 13:25 - 2014-01-24 13:25 - 00000000 ____D C:\Users\Laura_Admin\AppData\Roaming\WTouch
2014-01-24 13:25 - 2014-01-24 13:25 - 00000000 ____D C:\Users\Laura_Admin\AppData\Local\Skype
2014-01-24 13:22 - 2014-01-24 11:48 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-01-24 13:19 - 2014-01-24 11:48 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Dropbox
2014-01-24 13:17 - 2010-11-21 04:47 - 00117198 _____ C:\windows\PFRO.log
2014-01-24 11:49 - 2014-01-24 11:49 - 00001019 _____ C:\Users\Laura\Desktop\Dropbox.lnk
2014-01-24 11:48 - 2014-01-24 11:48 - 00000000 ____D C:\Users\Laura_Admin\AppData\Roaming\Dropbox
2014-01-24 11:42 - 2014-01-24 11:42 - 37660568 _____ (Dropbox, Inc.) C:\Users\Laura\Downloads\Dropbox 2.6.2.exe
2014-01-24 11:29 - 2013-12-06 14:29 - 00000000 ___RD C:\Users\Laura\Dropbox
2014-01-24 11:27 - 2013-09-17 22:43 - 00000000 ____D C:\Users\Laura\Desktop\uni
2014-01-24 10:19 - 2014-01-24 10:10 - 00002699 _____ C:\Users\Public\Desktop\Skype.lnk
2014-01-24 10:19 - 2012-03-07 01:22 - 00000000 ____D C:\ProgramData\Skype
2014-01-24 10:10 - 2014-01-24 10:10 - 00000000 ___RD C:\Program Files (x86)\Skype
2014-01-24 10:10 - 2014-01-24 10:10 - 00000000 ____D C:\Users\Laura\AppData\Local\Skype
2014-01-24 10:08 - 2014-01-24 10:08 - 01659552 _____ (Skype Technologies S.A.) C:\Users\Laura\Downloads\SkypeSetup.exe
2014-01-24 10:05 - 2012-08-22 12:31 - 00000000 ____D C:\Users\Laura_Admin
2014-01-24 09:57 - 2014-01-24 09:57 - 00000000 ____D C:\Users\Laura\AppData\Roaming\WTouch
2014-01-24 09:55 - 2014-01-24 09:55 - 00034304 _____ C:\ComboFix.txt
2014-01-24 09:55 - 2014-01-23 19:01 - 00000000 ____D C:\Qoobox
2014-01-24 09:54 - 2014-01-23 19:01 - 00000000 ____D C:\windows\erdnt
2014-01-24 09:54 - 2012-08-22 13:28 - 00000000 ___RD C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-01-24 09:53 - 2009-07-14 03:34 - 00000215 _____ C:\windows\system.ini
2014-01-24 00:30 - 2013-07-04 18:44 - 957203433 _____ C:\windows\MEMORY.DMP
2014-01-24 00:30 - 2013-07-04 18:44 - 00000000 ____D C:\windows\Minidump
2014-01-23 23:42 - 2012-08-22 12:36 - 00118064 _____ C:\Users\Laura_Admin\AppData\Local\GDIPFONTCACHEV1.DAT
2014-01-23 23:42 - 2012-08-22 12:36 - 00001432 _____ C:\Users\Laura_Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-01-23 23:42 - 2012-08-22 12:36 - 00000000 ___RD C:\Users\Laura_Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-01-23 23:42 - 2012-08-22 12:31 - 00000000 ___RD C:\Users\Laura_Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-01-23 17:53 - 2014-01-23 17:53 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Malwarebytes
2014-01-23 15:26 - 2014-01-23 15:26 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-23 15:25 - 2014-01-22 13:33 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Laura\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-23 15:20 - 2014-01-23 15:20 - 00000000 ____D C:\Users\Laura\AppData\Local\LogMeInIgnition
2014-01-22 16:46 - 2012-08-22 15:57 - 00000000 ____D C:\Users\Laura\Desktop\Alles Mögliche
2014-01-22 16:23 - 2012-09-13 15:09 - 00000000 ____D C:\Program Files (x86)\DivX
2014-01-22 16:23 - 2012-09-13 15:08 - 00000000 ____D C:\ProgramData\DivX
2014-01-22 16:21 - 2013-08-26 12:19 - 00993600 _____ (DivX, LLC) C:\Users\Laura\Downloads\DivXInstaller.exe
2014-01-22 13:34 - 2014-01-22 13:34 - 00000000 ____D C:\Users\Laura_Admin\AppData\Roaming\Malwarebytes
2014-01-22 13:34 - 2014-01-22 13:34 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-22 07:50 - 2012-08-22 13:17 - 00000000 ____D C:\Program Files (x86)\LogMeIn
2014-01-22 07:49 - 2012-08-22 13:17 - 00107368 _____ (LogMeIn, Inc.) C:\windows\system32\LMIRfsClientNP.dll
2014-01-22 07:49 - 2012-08-22 13:17 - 00092488 _____ (LogMeIn, Inc.) C:\windows\system32\LMIinit.dll
2014-01-22 07:49 - 2012-08-22 13:17 - 00035656 _____ (LogMeIn, Inc.) C:\windows\system32\LMIport.dll
2014-01-20 18:51 - 2012-10-08 14:53 - 00000000 ____D C:\Users\Laura\AppData\Local\Spotify
2014-01-19 13:27 - 2012-03-07 01:44 - 00000000 ____D C:\ProgramData\McAfee
2014-01-19 13:27 - 2012-03-07 01:05 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2014-01-19 13:27 - 2012-03-07 01:05 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-01-19 13:26 - 2012-08-23 07:38 - 00000000 ____D C:\Users\Laura_Admin\AppData\Local\Adobe
2014-01-17 10:30 - 2012-03-07 01:22 - 00002186 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2014-01-16 16:42 - 2009-07-14 05:45 - 05009400 _____ C:\windows\system32\FNTCACHE.DAT
2014-01-16 09:37 - 2013-08-15 02:01 - 00000000 ____D C:\windows\system32\MRT
2014-01-16 09:37 - 2012-08-23 00:17 - 00000000 ____D C:\ProgramData\Microsoft Help
2014-01-16 09:34 - 2012-08-22 14:00 - 86054176 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-01-11 00:17 - 2009-07-14 04:20 - 00000000 ____D C:\windows\system32\NDF
2014-01-09 00:06 - 2012-08-22 13:28 - 00118064 _____ C:\Users\Laura\AppData\Local\GDIPFONTCACHEV1.DAT
2014-01-08 23:32 - 2014-01-08 23:32 - 00001101 _____ C:\Users\Public\Desktop\TeamViewer 9.lnk
2014-01-08 23:32 - 2013-01-05 00:18 - 00000000 ____D C:\Program Files (x86)\TeamViewer
2014-01-07 18:28 - 2014-01-07 18:28 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2014-01-07 17:49 - 2014-01-07 17:49 - 00000928 _____ C:\Users\Public\Desktop\Steam.lnk
2014-01-07 17:49 - 2012-08-22 13:28 - 00000000 ____D C:\Users\Laura
2014-01-03 18:14 - 2009-07-14 06:08 - 00032632 _____ C:\windows\Tasks\SCHEDLGU.TXT
2013-12-30 23:53 - 2009-07-14 04:20 - 00000000 ____D C:\windows\LiveKernelReports
2013-12-29 17:19 - 2013-12-29 17:19 - 00000000 ____D C:\Users\Laura\Documents\Amazon Music Importer
2013-12-29 17:19 - 2013-12-29 17:19 - 00000000 ____D C:\Users\Laura\AppData\Roaming\com.amazon.music.uploader
2013-12-29 17:18 - 2013-12-29 17:18 - 09629432 _____ C:\Users\Laura\Downloads\AmazonMusicImporterInstaller-2.1.0._V371017662_.exe
2013-12-29 17:18 - 2013-12-29 17:18 - 00000000 ____D C:\Program Files (x86)\Amazon
2013-12-29 17:00 - 2013-12-29 17:00 - 36152456 _____ (Amazon) C:\Users\Laura\Downloads\AmazonCloudPlayerInstaller_399.exe
Some content of TEMP:
====================
C:\Users\Laura\AppData\Local\Temp\avgnt.exe
C:\Users\Laura_Admin\AppData\Local\Temp\avgnt.exe
C:\Users\Laura_Admin\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== End Of Log ============================
--- --- --- |
|
27.01.2014, 12:29
| #8 |
| /// the machine /// TB-Ausbilder | Windows: BKA-Virus im Browser Java, Flash, Adobe und Thunderbird updaten. Skype und Dropbox mal neu installieren.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
27.01.2014, 15:37
| #9 |
| | Windows: BKA-Virus im Browser Eine Neuinstallation hat nicht geholfen. Dropbox lässt sich garnicht nicht starten und bei Skype kann ich mich nicht anmelden. Da kommt die Fehlermeldung "Anmeldung nicht möglich wegen eines Disk I/O-Fehlers. Beenden Sie Skype und starten Sie Skype erneut. Falls das Problem weiterhin besteht, besuchen Sie die Support-Seite für weitere Informationen." Das was auf der Support-Seite (https://support.skype.com/de/faq/FA10143/warum-tritt-beim-anmelden-bei-skype-fur-windows-desktop-ein-datentrager-ein-ausgabefehler-auf) steht hat das Problem auch nicht behoben. |
|
28.01.2014, 11:23
| #10 |
| /// the machine /// TB-Ausbilder | Windows: BKA-Virus im Browser Kommt bei Dropbox eine Fehlermeldung? Screenshot bitte von der Meldung von Skype? Seit wann genau ist das so?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
28.01.2014, 14:05
| #11 |
| | Windows: BKA-Virus im Browser Bei Dropbox kommt garnichts. Wenn ich mich als Admin anmelde, kann ich mich auch bei Skype anmelden. Bei Dropbox passiert aber auch als Admin nichts. Das ist, meine ich so, seit ich defogger, FRST und GMER das erste Mal laufen ließ, also seit Freitag. Davor hat alles noch funktioniert. |
|
29.01.2014, 10:06
| #12 |
| /// the machine /// TB-Ausbilder | Windows: BKA-Virus im Browser Downloade dir bitte Windows Repair (All In One) von hier.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
29.01.2014, 13:29
| #13 |
| | Windows: BKA-Virus im Browser bei den neueren Versionen kann man unter "start repairs" nicht mehr advanced mode auswählen. Hier ein Screenshot. |
|
29.01.2014, 18:53
| #14 |
| /// the machine /// TB-Ausbilder | Windows: BKA-Virus im Browser Einfach auf Start, dann kommt das mit den Kästchen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
29.01.2014, 20:03
| #15 |
| | Windows: BKA-Virus im Browser also skype und dropbox funktionieren immer noch nicht und der PC brauchte fast 10min hochzufahren. Auch hab ich festgestellt, dass die Windows Problembehandlungen nicht mehr funktionieren. Geändert von switch123 (29.01.2014 um 20:45 Uhr) |
|
| Themen zu Windows: BKA-Virus im Browser |
| adblock, antivir, antivirus, avira, branding, browser, canon, computer, converter, desktop, device driver, dvdvideosoft ltd., email, error, excel, fehler, firefox, flash player, home, homepage, mozilla, mp3, ntdll.dll, realtek, registry, scan, software, spotify web helper, svchost.exe, system, taskmanager, wildtangent games, windows |
WARNUNG an die MITLESER: 
Linear-Darstellung
