|
Log-Analyse und Auswertung: Windows 8 GVU TrojanerWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
12.02.2014, 21:13 | #16 |
| Windows 8 GVU TrojanerCode:
ATTFilter ComboFix 14-02-12.01 - user 12.02.2014 20:50:13.1.2 - x64 Microsoft Windows 8 6.2.9200.0.1252.49.1031.18.8010.6173 [GMT 1:00] ausgeführt von:: c:\users\maiko_000\Desktop\ComboFix.exe AV: Emsisoft Anti-Malware *Disabled/Updated* {8504DEEF-CC04-1F76-2137-F1A5F4A659DA} AV: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: Emsisoft Anti-Malware *Disabled/Updated* {3E653F0B-EA3E-10F8-1B87-CAD78F211367} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Neuer Wiederherstellungspunkt wurde erstellt . . (((((((((((((((((((((((((((((((((((( Weitere Löschungen )))))))))))))))))))))))))))))))))))))))))))))))) . . c:\programdata\Acer c:\programdata\Acer\CCDMSrv\logs\CCDMonitorService\CCDMonitorService.20140209_122932_967000.log c:\programdata\Acer\CCDMSrv\logs\CCDMonitorService\CCDMonitorService.20140210_184256_087000.log c:\programdata\Acer\CCDMSrv\logs\CCDMonitorService\CCDMonitorService.20140211_053909_978000.log c:\programdata\Acer\CCDMSrv\logs\CCDMonitorService\CCDMonitorService.20140212_202346_758000.log c:\programdata\Acer\CCDMSrv\users.ini c:\programdata\Acer\CCDMSrv\Users\S-1-5-21-3049176386-3505927428-341134551-1001 c:\programdata\Acer\updater2\agentts.xml c:\programdata\Acer\updater2\Download\34997525\D\FixpackInfo.xml c:\programdata\Acer\updater2\Download\34997525\D\FpCheck.bat c:\programdata\Acer\updater2\Download\34997525\D\FpCheckLog.txt c:\programdata\Acer\updater2\Download\34997525\D\fpex.xml c:\programdata\Acer\updater2\Download\35435091\D\FixpackInfo.xml c:\programdata\Acer\updater2\Download\35435091\D\FpCheck.bat c:\programdata\Acer\updater2\Download\35435091\D\FpCheckLog.txt c:\programdata\Acer\updater2\Download\35435091\D\fpex.xml c:\programdata\Acer\updater2\Download\35435091\D\IntelVGAChecking.exe c:\programdata\Acer\updater2\Download\35435091\D\IntelVGAChecking.exe.config c:\programdata\Acer\updater2\Download\38342234\D\ALUChecking.exe c:\programdata\Acer\updater2\Download\38342234\D\ALUChecking.exe.config c:\programdata\Acer\updater2\Download\38342234\D\FixpackInfo.xml c:\programdata\Acer\updater2\Download\38342234\D\FpCheck.bat c:\programdata\Acer\updater2\Download\38342234\D\FpCheckLog.txt c:\programdata\Acer\updater2\Download\38342234\D\fpex.xml c:\programdata\Acer\updater2\Download\38342234\D\HTTP2GA.exe c:\programdata\Acer\updater2\Metadata\ap.xml c:\programdata\Acer\updater2\Metadata\fp.xml c:\programdata\Acer\updater2\pubke.xml c:\programdata\Acer\updater2\report.xml c:\programdata\Acer\updater2\task.bat c:\programdata\Acer\updater2\ts.xml c:\programdata\Acer\updater2\updater2.xml c:\users\user\AppData\Local\omesuperv.exe . c:\windows\SysWow64\Drivers\atapi.sys . . . ist infiziert!! . . ((((((((((((((((((((((( Dateien erstellt von 2014-01-12 bis 2014-02-12 )))))))))))))))))))))))))))))) . . 2014-02-12 20:01 . 2014-02-12 20:01 -------- d-----w- c:\users\user\AppData\Local\temp 2014-02-07 02:02 . 2014-02-09 11:43 -------- d-----w- C:\FRST 2014-02-06 16:49 . 2014-02-06 16:49 -------- d-----w- c:\programdata\boost_interprocess 2014-02-05 20:06 . 2014-02-06 16:11 -------- d-----w- c:\users\maiko_000\AppData\Local\CrashDumps 2014-02-05 20:05 . 2014-02-05 20:05 -------- d-----w- c:\programdata\DATA BECKER Downloads 2014-02-05 20:04 . 2014-02-05 20:04 -------- d-----w- c:\users\user\AppData\Roaming\ProtectDisc 2014-02-05 20:04 . 2014-02-05 20:04 -------- d-----w- c:\program files (x86)\ProtectDisc Driver Installer 2014-02-05 20:04 . 2014-02-05 20:04 -------- d-----w- c:\program files (x86)\Common Files\DATA BECKER Shared 2014-02-05 20:02 . 2014-02-05 20:02 -------- d-----w- c:\program files (x86)\DATA BECKER 2014-02-05 18:20 . 2014-02-12 19:47 -------- d-----w- c:\program files (x86)\Emsisoft Anti-Malware 2014-02-04 18:56 . 2014-02-04 18:56 240816 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10232.bin 2014-01-31 21:18 . 2014-01-31 21:20 -------- d-----w- C:\AdwCleaner 2014-01-30 20:25 . 2014-01-30 20:25 -------- d-----w- c:\users\user\AppData\Local\ext_offermosquito 2014-01-30 20:25 . 2014-01-30 20:25 -------- d-----w- c:\users\user\AppData\Local\Mozilla 2014-01-30 20:25 . 2014-01-30 20:25 -------- d-----w- c:\users\user\AppData\Roaming\Fifth 2014-01-30 20:25 . 2014-01-30 20:25 -------- d-----w- c:\users\user\AppData\Local\Google 2014-01-30 20:25 . 2014-01-30 20:25 -------- d-----w- c:\program files (x86)\Google 2014-01-30 20:24 . 2014-01-31 21:19 -------- d-----w- c:\users\user\AppData\Roaming\Common 2014-01-30 20:24 . 2014-01-30 20:24 -------- d-----w- C:\Reisekosten 2014-01-26 14:06 . 2014-01-26 14:06 -------- d-----w- c:\program files\Microsoft Silverlight 2014-01-26 14:06 . 2014-01-26 14:06 -------- d-----w- c:\program files (x86)\Microsoft Silverlight 2014-01-26 11:39 . 2014-01-26 11:39 -------- d-----w- c:\users\user\AppData\Roaming\8floor 2014-01-26 08:47 . 2014-01-26 08:47 367200 ----a-w- c:\windows\system32\drivers\afcdp.sys 2014-01-26 08:47 . 2014-01-26 08:47 1464096 ----a-w- c:\windows\system32\drivers\tdrpman.sys 2014-01-26 08:47 . 2014-01-26 08:47 198432 ----a-w- c:\windows\system32\drivers\tib_mounter.sys 2014-01-26 08:47 . 2014-01-26 08:47 1120032 ----a-w- c:\windows\system32\drivers\tib.sys 2014-01-26 08:46 . 2014-01-26 08:46 269600 ----a-w- c:\windows\system32\drivers\snapman.sys 2014-01-26 08:46 . 2014-01-26 08:46 116000 ----a-w- c:\windows\system32\drivers\fltsrv.sys 2014-01-26 08:46 . 2014-01-26 08:47 -------- d-----w- c:\program files (x86)\Common Files\Acronis 2014-01-26 08:46 . 2014-01-26 08:46 -------- d-----w- c:\program files (x86)\Acronis 2014-01-18 22:45 . 2014-01-18 22:45 -------- d-----w- c:\users\maiko_000\AppData\Local\fontconfig 2014-01-18 17:55 . 2014-01-18 22:45 -------- d-----w- c:\users\maiko_000\.gimp-2.8 2014-01-18 17:55 . 2014-01-18 17:55 -------- d-----w- c:\users\maiko_000\AppData\Local\gegl-0.2 2014-01-15 20:32 . 2014-01-15 20:34 -------- d-----w- c:\program files\GIMP 2 2014-01-15 20:32 . 2014-01-15 20:32 -------- d-----w- c:\users\user\AppData\Local\Programs 2014-01-15 18:05 . 2013-12-07 06:37 688640 ----a-w- c:\windows\system32\WSShared.dll 2014-01-15 18:05 . 2013-12-07 06:37 163840 ----a-w- c:\windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll 2014-01-15 18:05 . 2013-12-07 05:15 562688 ----a-w- c:\windows\SysWow64\WSShared.dll 2014-01-15 18:05 . 2013-12-07 05:15 124928 ----a-w- c:\windows\SysWow64\Windows.ApplicationModel.Store.TestingFramework.dll 2014-01-14 18:16 . 2013-10-31 05:56 915968 ----a-w- c:\windows\system32\MPSSVC.dll 2014-01-14 18:16 . 2013-10-31 05:56 758784 ----a-w- c:\windows\system32\FirewallAPI.dll 2014-01-14 18:16 . 2013-10-31 04:01 550400 ----a-w- c:\windows\SysWow64\FirewallAPI.dll 2014-01-14 18:16 . 2013-10-31 03:42 74752 ----a-w- c:\windows\system32\drivers\mpsdrv.sys 2014-01-14 18:16 . 2013-10-28 05:50 588288 ----a-w- c:\windows\system32\SHCore.dll 2014-01-14 18:16 . 2013-10-28 04:05 452608 ----a-w- c:\windows\SysWow64\SHCore.dll 2014-01-14 18:16 . 2013-10-13 20:49 100696 ----a-w- c:\windows\system32\drivers\disk.sys 2014-01-14 18:16 . 2013-08-27 05:21 227840 ----a-w- c:\windows\system32\WebClnt.dll 2014-01-14 18:16 . 2013-08-27 05:19 104448 ----a-w- c:\windows\system32\davclnt.dll 2014-01-14 18:16 . 2013-08-26 22:29 199168 ----a-w- c:\windows\SysWow64\WebClnt.dll 2014-01-14 18:16 . 2013-08-26 22:28 86016 ----a-w- c:\windows\SysWow64\davclnt.dll 2014-01-13 20:29 . 2014-01-18 21:52 -------- d-----w- c:\users\maiko_000\AppData\Local\Buhl 2014-01-13 20:29 . 2014-01-13 20:29 -------- d-----w- c:\users\user\AppData\Local\Buhl 2014-01-13 20:27 . 2014-01-13 20:27 -------- d-----w- c:\program files (x86)\WISO 2014-01-13 20:26 . 2014-01-13 20:29 -------- d-----w- c:\programdata\Buhl Data Service GmbH . . . (((((((((((((((((((((((((((((((((((( Find3M Bericht )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2014-01-30 21:10 . 2014-01-11 21:00 78296 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2014-01-30 21:10 . 2014-01-11 21:00 694240 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2014-01-15 20:28 . 2014-01-09 16:02 86054176 ----a-w- c:\windows\system32\MRT.exe 2014-01-08 01:00 . 2014-01-08 01:00 50784 ----a-w- c:\programdata\Microsoft\windowsfiltering\Sqm\Manifest\Sqm3.bin 2014-01-08 01:00 . 2014-01-08 01:00 17536 ----a-w- c:\programdata\Microsoft\windowssampling\Sqm\Manifest\Sqm3.bin 2014-01-07 19:23 . 2012-07-26 08:13 22240 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll 2013-12-05 15:44 . 2013-04-18 04:36 184800 ----a-w- c:\windows\system32\mfevtps.exe.1d24.deleteme 2013-12-03 18:28 . 2014-01-11 20:44 10315576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{463F6F78-D401-4B06-A42A-2765884C6543}\mpengine.dll 2013-11-23 06:43 . 2014-01-11 21:10 420864 ----a-w- c:\windows\system32\WMPhoto.dll 2013-11-23 05:05 . 2014-01-11 21:10 368640 ----a-w- c:\windows\SysWow64\WMPhoto.dll 2013-11-19 10:21 . 2014-01-09 08:58 267936 ------w- c:\windows\system32\MpSigStub.exe . . (((((((((((((((((((((((((((( Autostartpunkte der Registrierung )))))))))))))))))))))))))))))))))))))))) . . *Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. REGEDIT4 . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{82B16A3D-F03E-4565-A532-666B219C9A53}] 2014-01-23 08:08 153520 ----a-w- c:\users\user\AppData\Local\ext_offermosquito\OfferMosquitoIEPlaceholder.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "Norton Online Backup"="c:\program files (x86)\Symantec\Norton Online Backup\NOBuClient.exe" [2012-08-15 2994880] "TrueImageMonitor.exe"="c:\program files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe" [2013-10-24 7843992] "AcronisTibMounterMonitor"="c:\program files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe" [2013-10-10 1104616] "emsisoft anti-malware"="c:\program files (x86)\emsisoft anti-malware\a2guard.exe" [2013-12-04 4329408] . c:\programdata\Microsoft\Windows\Start Menu\Programs\StartUp\ Polar WebSync.lnk - c:\program files (x86)\Polar\WebSync\WebSync.exe -normal [2013-2-26 6227512] WISO Mein Steuer-Sparbuch heute.lnk - c:\program files (x86)\WISO\Steuersoftware 2014\mshaktuell.exe [2014-1-13 1427760] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "EnableUIADesktopToggle"= 0 (0x0) "EnableCursorSuppression"= 1 (0x1) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLinkedConnections"= 1 (0x1) . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc] @="" . R0 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys;c:\windows\SYSNATIVE\drivers\cfwids.sys [x] R3 AthBTPort;Qualcomm Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_flt.sys [x] R3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys;c:\windows\SYSNATIVE\drivers\btath_a2dp.sys [x] R3 btath_avdt;Qualcomm Atheros Bluetooth AVDT Service;c:\windows\system32\drivers\btath_avdt.sys;c:\windows\SYSNATIVE\drivers\btath_avdt.sys [x] R3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\System32\drivers\btath_hcrp.sys;c:\windows\SYSNATIVE\drivers\btath_hcrp.sys [x] R3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_lwflt.sys [x] R3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\System32\drivers\btath_rcp.sys;c:\windows\SYSNATIVE\drivers\btath_rcp.sys [x] R3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys;c:\windows\SYSNATIVE\DRIVERS\btfilter.sys [x] R3 BthLEEnum;Treiber für energiearme Bluetooth-Geräte;c:\windows\system32\DRIVERS\BthLEEnum.sys;c:\windows\SYSNATIVE\DRIVERS\BthLEEnum.sys [x] R3 DeviceFastLaneService;Device Fast-lane Service;c:\program files\Acer\Acer Device Fast-lane\DeviceFastLaneSvc.exe;c:\program files\Acer\Acer Device Fast-lane\DeviceFastLaneSvc.exe [x] R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x] R3 ePowerSvc;ePower Service;c:\program files\Acer\Acer Power Management\ePowerSvc.exe;c:\program files\Acer\Acer Power Management\ePowerSvc.exe [x] R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [x] S0 fltsrv;Acronis Storage Filter Management;c:\windows\system32\DRIVERS\fltsrv.sys;c:\windows\SYSNATIVE\DRIVERS\fltsrv.sys [x] S1 A2DDA;A2 Direct Disk Access Support Driver;c:\program files (x86)\Emsisoft Anti-Malware\a2ddax64.sys;c:\program files (x86)\Emsisoft Anti-Malware\a2ddax64.sys [x] S1 ccSet_NARA;NARA Settings Manager;c:\windows\system32\drivers\NARAx64\0401000.00E\ccSetx64.sys;c:\windows\SYSNATIVE\drivers\NARAx64\0401000.00E\ccSetx64.sys [x] S2 a2AntiMalware;Emsisoft Anti-Malware 8.0 - Service;c:\program files (x86)\Emsisoft Anti-Malware\a2service.exe;c:\program files (x86)\Emsisoft Anti-Malware\a2service.exe [x] S2 acedrv11;acedrv11;c:\windows\system32\drivers\acedrv11.sys;c:\windows\SYSNATIVE\drivers\acedrv11.sys [x] S2 afcdpsrv;Acronis Nonstop Backup Service;c:\program files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe;c:\program files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe [x] S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Qualcomm Atheros\Bluetooth Suite\adminservice.exe;c:\program files (x86)\Qualcomm Atheros\Bluetooth Suite\adminservice.exe [x] S2 CCDMonitorService;CCDMonitorService;c:\program files (x86)\Acer\Acer Cloud\CCDMonitorService.exe;c:\program files (x86)\Acer\Acer Cloud\CCDMonitorService.exe [x] S2 DBService;DATA BECKER Update Service;c:\program files (x86)\Common Files\DATA BECKER Shared\DBService.exe;c:\program files (x86)\Common Files\DATA BECKER Shared\DBService.exe [x] S2 DsiWMIService;Dritek WMI Service;c:\program files (x86)\Launch Manager\dsiwmis.exe;c:\program files (x86)\Launch Manager\dsiwmis.exe [x] S2 ETDService;Elan Service;c:\program files\Elantech\ETDService.exe;c:\program files\Elantech\ETDService.exe [x] S3 a2acc;a2acc;c:\program files (x86)\EMSISOFT ANTI-MALWARE\a2accx64.sys;c:\program files (x86)\EMSISOFT ANTI-MALWARE\a2accx64.sys [x] S3 afcdp;afcdp;c:\windows\system32\DRIVERS\afcdp.sys;c:\windows\SYSNATIVE\DRIVERS\afcdp.sys [x] S3 BTATH_BUS;Qualcomm Atheros Bluetooth Bus;c:\windows\System32\drivers\btath_bus.sys;c:\windows\SYSNATIVE\drivers\btath_bus.sys [x] S3 cleanhlp;cleanhlp;c:\program files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys;c:\program files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [x] S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys;c:\windows\SYSNATIVE\DRIVERS\ETD.sys [x] . . Inhalt des "geplante Tasks" Ordners . 2014-02-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-01-30 20:25] . 2014-02-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-01-30 20:25] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AcronisSyncError] @="{934BC6C0-FEC2-4df5-A100-961DE2C8A0ED}" [HKEY_CLASSES_ROOT\CLSID\{934BC6C0-FEC2-4df5-A100-961DE2C8A0ED}] 2013-10-01 09:32 2818216 ----a-w- c:\program files (x86)\Acronis\TrueImageHome\tishell64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AcronisSyncInProgress] @="{00F848DC-B1D4-4892-9C25-CAADC86A215D}" [HKEY_CLASSES_ROOT\CLSID\{00F848DC-B1D4-4892-9C25-CAADC86A215D}] 2013-10-01 09:32 2818216 ----a-w- c:\program files (x86)\Acronis\TrueImageHome\tishell64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AcronisSyncOk] @="{71573297-552E-46fc-BE3D-3DFAF88D47B7}" [HKEY_CLASSES_ROOT\CLSID\{71573297-552E-46fc-BE3D-3DFAF88D47B7}] 2013-10-01 09:32 2818216 ----a-w- c:\program files (x86)\Acronis\TrueImageHome\tishell64.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-10-23 171040] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-10-23 399392] "Persistence"="c:\windows\system32\igfxpers.exe" [2012-10-23 441888] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2013-01-29 13267016] "RtHDVBg_Dolby"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2013-01-18 1276488] "Acronis Scheduler2 Service"="c:\program files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe" [2013-07-18 519408] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "MSPCLOCK"="streamci" [X] "MSPQM"="streamci" [X] "MSKSSRV"="streamci" [X] "MSTEE.CxTransform"="streamci" [X] "MSTEE.Splitter"="streamci" [X] "WDM_DRMKAUD"="streamci" [X] "BrowserChoice"="c:\windows\BrowserChoice\browserchoice.exe" [2012-08-15 86696] . ------- Zusätzlicher Suchlauf ------- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://acer13.msn.com mLocal Page = c:\windows\SysWOW64\blank.htm TCP: DhcpNameServer = 192.168.178.1 FF - ProfilePath - c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\84f9w28s.default\ FF - prefs.js: browser.startup.homepage - FF - prefs.js: browser.search.selectedEngine - . - - - - Entfernte verwaiste Registrierungseinträge - - - - . Toolbar-Locked - (no file) Wow6432Node-HKLM-Run-mcui_exe - c:\program files\McAfee.com\Agent\mcagent.exe Wow6432Node-HKLM-Run-LManager - (no file) c:\users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutoStarter.lnk - c:\users\maiko_000\Documents\UseNeXT\wizard\Prison Tycoon - Backlash\Prison_Tycoon_GERMAN-BACKLASH.exe c:\users\maiko_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutoStarter.lnk - c:\users\user\Documents\UseNeXT\wizard\Prison Tycoon - Backlash\Prison_Tycoon_GERMAN-BACKLASH.exe SafeBoot-CleanHlp SafeBoot-CleanHlp.sys Toolbar-Locked - (no file) HKLM-Run-ETDCtrl - c:\program files (x86)\Elantech\ETDCtrl.exe . . . --------------------- Gesperrte Registrierungsschluessel --------------------- . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}] @Denied: (A) (Everyone) "Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B9A09F18-45AB-4F09-A117-A4ADDA8FA8C8}] @Denied: (A) (Everyone) "Solution"="{36eb6792-3a29-43b3-8cd0-f67d266fb426}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane] @Denied: (A) (Everyone) . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane\0] "Key"="ActionsPane" "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\8.0\\ActionsPane.xsd" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3] @Denied: (A) (Everyone) . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0] "Key"="ActionsPane3" "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e96d-e325-11ce-bfc1-08002be10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) @SACL=(02 0000) . Zeit der Fertigstellung: 2014-02-12 21:03:53 ComboFix-quarantined-files.txt 2014-02-12 20:03 . Vor Suchlauf: 10 Verzeichnis(se), 540.424.998.912 Bytes frei Nach Suchlauf: 16 Verzeichnis(se), 540.280.332.288 Bytes frei . - - End Of File - - 76086AD2A04D875024C64496EF6820CD Hat nach dem Installieren nur über McAfee und Anti Malware gemeckert. Habe McAfee dann deinstalliert(war eh abgelaufen) und Anti Malware deaktiviert. |
13.02.2014, 21:42 | #17 |
/// the machine /// TB-Ausbilder | Windows 8 GVU Trojaner Downloade Dir bitte Malwarebytes Anti-Malware
__________________
Downloade Dir bitte AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ |
14.02.2014, 20:44 | #18 |
| Windows 8 GVU TrojanerCode:
ATTFilter Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2014.02.14.07 Windows 8 x64 NTFS Internet Explorer 10.0.9200.16750 user :: ACER [Administrator] Schutz: Aktiviert 14.02.2014 19:32:08 mbam-log-2014-02-14 (19-32-08).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 238764 Laufzeit: 3 Minute(n), 32 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 6 HKCR\CLSID\{82B16A3D-F03E-4565-A532-666B219C9A53} (PUP.Optional.OfferMosquito) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{82B16A3D-F03E-4565-A532-666B219C9A53} (PUP.Optional.OfferMosquito) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\CLSID\{3bc93e76-92f8-5fda-b676-5afee3735bf1} (PUP.Optional.OfferMosquito.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3BC93E76-92F8-5FDA-B676-5AFEE3735BF1} (PUP.Optional.OfferMosquito.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\TypeLib\{B83C16AE-3C3D-5362-85D6-D19F9FB51262} (PUP.Optional.OfferMosquito.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCR\Interface\{2C0830EC-8559-5E15-9DC7-5BB830020064} (PUP.Optional.OfferMosquito.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 3 C:\Users\user\AppData\Local\ext_offermosquito\OfferMosquitoIEPlaceholder.dll (PUP.Optional.OfferMosquito) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\maiko_000\Downloads\SoftonicDownloader_fuer_sd-reisekosten.exe (PUP.Optional.Softonic.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\user\AppData\Local\ext_offermosquito\npOfferMosquitoIEHelper.dll (PUP.Optional.OfferMosquito.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) Code:
ATTFilter # AdwCleaner v3.018 - Bericht erstellt am 14/02/2014 um 20:15:46 # Updated 28/01/2014 von Xplode # Betriebssystem : Windows 8 (64 bits) # Benutzername : user - ACER # Gestartet von : C:\Users\maiko_000\Desktop\adwcleaner.exe # Option : Suchen ***** [ Dienste ] ***** ***** [ Dateien / Ordner ] ***** Ordner Gefunden C:\ProgramData\boost_interprocess ***** [ Verknüpfungen ] ***** ***** [ Registrierungsdatenbank ] ***** ***** [ Browser ] ***** -\\ Internet Explorer v10.0.9200.16798 -\\ Mozilla Firefox v26.0 (de) [ Datei : C:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\84f9w28s.default\prefs.js ] ************************* AdwCleaner[R0].txt - [2477 octets] - [31/01/2014 22:18:50] AdwCleaner[R2].txt - [742 octets] - [14/02/2014 20:15:46] AdwCleaner[S0].txt - [2499 octets] - [31/01/2014 22:19:58] ########## EOF - \AdwCleaner\AdwCleaner[R2].txt - [861 octets] ########## ][/CODE] Code:
ATTFilter # AdwCleaner v3.018 - Bericht erstellt am 14/02/2014 um 20:17:35 # Updated 28/01/2014 von Xplode # Betriebssystem : Windows 8 (64 bits) # Benutzername : user - ACER # Gestartet von : C:\Users\maiko_000\Desktop\adwcleaner.exe # Option : Löschen ***** [ Dienste ] ***** ***** [ Dateien / Ordner ] ***** Ordner Gelöscht : C:\ProgramData\boost_interprocess ***** [ Verknüpfungen ] ***** ***** [ Registrierungsdatenbank ] ***** ***** [ Browser ] ***** -\\ Internet Explorer v10.0.9200.16798 -\\ Mozilla Firefox v26.0 (de) [ Datei : C:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\84f9w28s.default\prefs.js ] ************************* AdwCleaner[R0].txt - [2477 octets] - [31/01/2014 22:18:50] AdwCleaner[R2].txt - [938 octets] - [14/02/2014 20:15:46] AdwCleaner[S0].txt - [2499 octets] - [31/01/2014 22:19:58] AdwCleaner[S2].txt - [864 octets] - [14/02/2014 20:17:35] ########## EOF - \AdwCleaner\AdwCleaner[S2].txt - [923 octets] ########## Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 6.1.1 (02.04.2014:1) OS: Windows 8 x64 Ran by maiko_000 on 14.02.2014 at 20:29:07,32 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\iminent Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\softonic ~~~ Files ~~~ Folders Failed to delete: [Folder] "C:\ProgramData\boost_interprocess" ~~~ FireFox Successfully deleted the following from C:\Users\maiko_000\AppData\Roaming\mozilla\firefox\profiles\dzggwuzo.default\prefs.js user_pref("iminent.LayoutId", "28"); user_pref("iminent.ShowThankyouPixel", "0"); user_pref("iminent.adapters", "{\"softonic\":{\"CountryCode\":\"DE\",\"NoAds\":false,\"Status\":2,\"expireTime\":\"13911138562771814400\"},\"google\":{\"CountryCode\":\"DE\",\ user_pref("iminent.registerToolbarEvent102", "1391201069444"); user_pref("iminent.registerToolbarEvent109", "1391116184182"); user_pref("iminent.registerToolbarEvent111", "1391116184188"); user_pref("iminent.registerToolbarEvent112", "1391116203579"); user_pref("iminent.registerToolbarEvent122", "1391116184194"); user_pref("iminent.version", "8.4.3.1"); user_pref("iminent.versioning", "{\"CurrentVersion\":\"8.4.3.1\",\"InstallEventCTime\":1391113854221,\"InstallEvent\":\"True\"}"); ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 14.02.2014 at 20:39:48,77 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-02-2014 01 Ran by maiko_000 (ATTENTION: The logged in user is not administrator) on ACER on 14-02-2014 20:42:54 Running from C:\Users\maiko_000\Desktop Windows 8 (X64) OS Language: German Standard Internet Explorer Version 10 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe (Intel Corporation) C:\Windows\system32\igfxext.exe (Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Dolby Laboratories Inc.) C:\Dolby PCEE4\pcee4.exe (Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe () C:\Program Files (x86)\Polar\WebSync\WebSync.exe (Acronis) C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe (Acronis International GmbH) C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe (Emsisoft GmbH) C:\Program Files (x86)\Emsisoft Anti-Malware\a2guard.exe (CyberLink) C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe () C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe () C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) C:\Windows\SysWOW64\DllHost.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2874256 2012-12-07] (ELAN Microelectronics Corp.) HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13267016 2013-01-29] (Realtek Semiconductor) HKLM\...\Run: [RtHDVBg_Dolby] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1276488 2013-01-18] (Realtek Semiconductor) HKLM\...\Run: [Acronis Scheduler2 Service] - C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [519408 2013-07-18] (Acronis) HKLM-x32\...\Run: [Norton Online Backup] - C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [2994880 2012-08-15] (Symantec Corporation) HKLM-x32\...\Run: [TrueImageMonitor.exe] - C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe [7843992 2013-10-24] (Acronis) HKLM-x32\...\Run: [AcronisTibMounterMonitor] - C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe [1104616 2013-10-10] (Acronis International GmbH) HKLM-x32\...\Run: [emsisoft anti-malware] - c:\program files (x86)\emsisoft anti-malware\a2guard.exe [4329408 2013-12-04] (Emsisoft GmbH) HKLM\...\Runonce: [MSPCLOCK] - rundll32.exe streamci,StreamingDeviceSetup {97ebaacc-95bd-11d0-a3ea-00a0c9223196},{53172480-4791-11D0-A5D6-28DB04C10000},{53172480-4791-11D0-A5D6-28DB04C10000} HKLM\...\Runonce: [MSPQM] - rundll32.exe streamci,StreamingDeviceSetup {DDF4358E-BB2C-11D0-A42F-00A0C9223196},{97EBAACB-95BD-11D0-A3EA-00A0C9223196},{97EBAACB-95BD-11D0-A3EA-00A0C9223196} HKLM\...\Runonce: [MSKSSRV] - rundll32.exe streamci,StreamingDeviceSetup {96E080C7-143C-11D1-B40F-00A0C9223196},{3C0D501A-140B-11D1-B40F-00A0C9223196},{3C0D501A-140B-11D1-B40F-00A0C9223196} HKLM\...\Runonce: [MSTEE.CxTransform] - rundll32.exe streamci,StreamingDeviceSetup {cfd669f1-9bc2-11d0-8299-0000f822fe8a},{CF1DDA2C-9743-11D0-A3EE-00A0C9223196},{CF1DDA2C-9743-11D0-A3EE-00A0C9223196},C:\Windows\inf\ksfilter.inf,MSTEE.Interface.Install HKLM\...\Runonce: [MSTEE.Splitter] - rundll32.exe streamci,StreamingDeviceSetup {cfd669f1-9bc2-11d0-8299-0000f822fe8a},{0A4252A0-7E70-11D0-A5D6-28DB04C10000},{0A4252A0-7E70-11D0-A5D6-28DB04C10000},C:\Windows\inf\ksfilter.inf,MSTEE.Interface.Install HKLM\...\Runonce: [WDM_DRMKAUD] - rundll32.exe streamci,StreamingDeviceSetup {EEC12DB6-AD9C-4168-8658-B03DAEF417FE},{ABD61E00-9350-47e2-A632-4438B90C6641},{FFBB6E3F-CCFE-4D84-90D9-421418B03A8E},C:\Windows\inf\WDMAUDIO.inf,WDM_DRMKAUD.Interface.Install HKLM\...\RunOnce: [BrowserChoice] - C:\Windows\BrowserChoice\browserchoice.exe [86696 2012-08-15] (Microsoft Corporation) HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware ] - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation) HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware (cleanup)] - rundll32.exe "C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll",ProcessCleanupScript [1127496 2013-04-04] (Malwarebytes Corporation) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKU\S-1-5-21-3049176386-3505927428-341134551-1002\...\Run: [DelayShred] - C:\Users\maiko_000\Documents\UseNeXT\wizard\Taxi.Tycoon.v2.4.GERMAN-HARPOON - (1_7) - _Taxi.Ty\Taxi.Tycoon.v2.4.GERMAN-HARPOON.exe [48625620 2014-01-06] () HKU\S-1-5-21-3049176386-3505927428-341134551-1002\...\Winlogon: [Userinit] userinit.exe, [25088 2012-07-26] (Microsoft Corporation) HKU\S-1-5-21-3049176386-3505927428-341134551-1002\...\Winlogon: [Shell] explorer.exe [2391280 2013-06-01] (Microsoft Corporation) <==== ATTENTION ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://acer13.msn.com HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKLM - DefaultScope {6D2BF56D-8AAD-411D-8470-6B4A0C99C77C} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS SearchScopes: HKLM - {6D2BF56D-8AAD-411D-8470-6B4A0C99C77C} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS SearchScopes: HKLM - {AA9A4890-4262-4441-8977-E2FFCBFB706C} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?hspart=acer&hsimp=yhs-acer_001&p={searchTerms} SearchScopes: HKLM-x32 - {6D2BF56D-8AAD-411D-8470-6B4A0C99C77C} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS SearchScopes: HKLM-x32 - {AA9A4890-4262-4441-8977-E2FFCBFB706C} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?hspart=acer&hsimp=yhs-acer_001&p={searchTerms} SearchScopes: HKCU - DefaultScope {6D2BF56D-8AAD-411D-8470-6B4A0C99C77C} URL = SearchScopes: HKCU - {6D2BF56D-8AAD-411D-8470-6B4A0C99C77C} URL = BHO: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\IEPlugIn.dll (Qualcomm Atheros Commnucations) BHO-x32: ChromeFrame BHO - {ECB3C477-1A0A-44BD-BB57-78F9EFE34FA7} - C:\Program Files (x86)\Google\Chrome Frame\Application\32.0.1700.107\npchrome_frame.dll (Google Inc.) Handler: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - No File Handler-x32: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - C:\Program Files (x86)\Google\Chrome Frame\Application\32.0.1700.107\npchrome_frame.dll (Google Inc.) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\maiko_000\AppData\Roaming\Mozilla\Firefox\Profiles\dzggwuzo.default FF Homepage: hxxp://www.freenet.de/|about:home FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll () FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll () FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @videolan.org/vlc,version=2.1.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll () FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml ==================== Services (Whitelisted) ================= R2 a2AntiMalware; C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe [4161512 2013-12-04] (Emsisoft GmbH) R2 AtherosSvc; C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\adminservice.exe [227456 2013-01-28] (Qualcomm Atheros Commnucations) R2 CCDMonitorService; C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe [2615368 2013-02-19] (Acer Incorporated) R2 DBService; C:\Program Files (x86)\Common Files\DATA BECKER Shared\DBService.exe [2650112 2010-05-28] (DATA BECKER GmbH & Co KG) S3 DeviceFastLaneService; C:\Program Files\Acer\Acer Device Fast-lane\DeviceFastLaneSvc.exe [469648 2012-11-16] (Acer Incorporated) S3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [662088 2013-03-15] (Acer Incorporated) R2 ETDService; C:\Program Files\Elantech\ETDService.exe [100752 2012-12-07] (ELAN Microelectronics Corp.) R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-17] (Intel Corporation) R2 lmhosts; C:\Windows\system32\svchost.exe [29696 2012-09-20] (Microsoft Corporation) R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation) R2 NlaSvc; C:\Windows\System32\svchost.exe [29696 2012-09-20] (Microsoft Corporation) R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [3943104 2012-08-15] (Symantec Corporation) R2 nsi; C:\Windows\system32\svchost.exe [29696 2012-09-20] (Microsoft Corporation) R2 Polar Daemon; C:\Program Files (x86)\Polar\Daemon\polard.exe [413184 2012-08-17] () R2 RfButtonDriverService; C:\Windows\RfBtnSvc64.exe [93296 2013-07-25] (Dritek System INC.) S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation) S2 0170711392062049mcinstcleanup; C:\Windows\TEMP\017071~1.EXE -cleanup -nolog [X] ==================== Drivers (Whitelisted) ==================== R3 a2acc; C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\a2accx64.sys [70960 2013-08-24] (Emsisoft GmbH) R1 A2DDA; C:\Program Files (x86)\Emsisoft Anti-Malware\a2ddax64.sys [26176 2013-03-28] (Emsisoft GmbH) R1 a2injectiondriver; C:\Program Files (x86)\Emsisoft Anti-Malware\a2dix64.sys [45208 2013-09-30] (Emsisoft GmbH) R1 a2util; C:\Program Files (x86)\Emsisoft Anti-Malware\a2util64.sys [17384 2013-03-28] (Emsisoft GmbH) S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2013-01-28] (Qualcomm Atheros) S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation) R1 ccSet_NARA; C:\Windows\system32\drivers\NARAx64\0401000.00E\ccSetx64.sys [168608 2012-05-26] (Symantec Corporation) R3 cleanhlp; C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [57024 2013-12-04] (Emsisoft GmbH) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) R3 Ps2Kb2Hid; C:\Windows\System32\drivers\aPs2Kb2Hid.sys [26736 2013-07-25] (Dritek System Inc.) R0 tib; C:\Windows\System32\DRIVERS\tib.sys [1120032 2014-01-26] (Acronis International GmbH) R0 tib_mounter; C:\Windows\System32\DRIVERS\tib_mounter.sys [198432 2014-01-26] (Acronis International GmbH) U5 AppMgmt; C:\Windows\system32\svchost.exe [29696 2012-09-20] (Microsoft Corporation) S3 catchme; \??\C:\ComboFix\catchme.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-02-14 20:42 - 2014-02-14 20:42 - 02152960 _____ (Farbar) C:\Users\maiko_000\Desktop\FRST64.exe 2014-02-14 20:42 - 2014-02-14 20:42 - 00013542 _____ () C:\Users\maiko_000\Desktop\FRST.txt 2014-02-14 20:39 - 2014-02-14 20:39 - 00001736 _____ () C:\Users\maiko_000\Desktop\JRT.txt 2014-02-14 20:29 - 2014-02-14 20:29 - 00000000 ____D () C:\Windows\ERUNT 2014-02-14 20:28 - 2014-02-14 20:28 - 01037530 _____ (Thisisu) C:\Users\maiko_000\Downloads\JRT.exe 2014-02-14 20:19 - 2014-02-14 20:19 - 00000000 ____D () C:\ProgramData\boost_interprocess 2014-02-14 20:06 - 2014-02-14 20:06 - 01166132 _____ () C:\Users\maiko_000\Desktop\adwcleaner.exe 2014-02-14 19:30 - 2013-12-09 01:45 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-02-14 19:30 - 2013-12-09 00:59 - 00600064 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-02-14 19:30 - 2013-12-05 00:43 - 01845248 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll 2014-02-14 19:30 - 2013-12-05 00:43 - 00583680 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll 2014-02-14 19:30 - 2013-12-05 00:37 - 01419264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll 2014-02-14 19:30 - 2013-12-05 00:37 - 00451072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll 2014-02-14 19:30 - 2013-11-27 01:19 - 00385614 _____ () C:\Windows\system32\ApnDatabase.xml 2014-02-14 19:30 - 2013-11-26 00:17 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys 2014-02-14 19:30 - 2013-11-01 06:53 - 02232664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys 2014-02-14 19:29 - 2014-02-14 19:29 - 00001113 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-02-14 19:29 - 2014-02-14 19:29 - 00000000 ____D () C:\Users\user\AppData\Roaming\Malwarebytes 2014-02-14 19:29 - 2014-02-14 19:29 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-02-14 19:29 - 2014-02-14 19:29 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware 2014-02-14 19:29 - 2014-02-01 10:20 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-02-14 19:29 - 2014-02-01 10:19 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-02-14 19:29 - 2014-02-01 10:19 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-02-14 19:29 - 2014-02-01 10:19 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll 2014-02-14 19:29 - 2014-02-01 10:19 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\UXInit.dll 2014-02-14 19:29 - 2014-02-01 10:18 - 19274240 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-02-14 19:29 - 2014-02-01 10:18 - 15403520 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-02-14 19:29 - 2014-02-01 10:18 - 03960320 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-02-14 19:29 - 2014-02-01 10:18 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-02-14 19:29 - 2014-02-01 10:18 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2014-02-14 19:29 - 2014-02-01 10:18 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-02-14 19:29 - 2014-02-01 10:18 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-02-14 19:29 - 2014-02-01 10:18 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2014-02-14 19:29 - 2014-02-01 10:18 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-02-14 19:29 - 2014-02-01 10:18 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-02-14 19:29 - 2014-02-01 10:18 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-02-14 19:29 - 2014-02-01 08:58 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-02-14 19:29 - 2014-02-01 08:58 - 01140736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-02-14 19:29 - 2014-02-01 08:58 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UXInit.dll 2014-02-14 19:29 - 2014-02-01 08:57 - 14359040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-02-14 19:29 - 2014-02-01 08:57 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-02-14 19:29 - 2014-02-01 08:57 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-02-14 19:29 - 2014-02-01 08:57 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-02-14 19:29 - 2014-02-01 08:57 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2014-02-14 19:29 - 2014-02-01 08:57 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-02-14 19:29 - 2014-02-01 08:57 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-02-14 19:29 - 2014-02-01 08:57 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll 2014-02-14 19:29 - 2014-02-01 08:57 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-02-14 19:29 - 2014-02-01 08:57 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-02-14 19:29 - 2014-02-01 08:57 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-02-14 19:29 - 2014-02-01 08:40 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-02-14 19:29 - 2014-02-01 08:34 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-02-14 19:29 - 2014-02-01 06:08 - 00534528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uxtheme.dll 2014-02-14 19:29 - 2014-01-13 00:30 - 02238976 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll 2014-02-14 19:29 - 2014-01-13 00:30 - 02032640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll 2014-02-14 19:29 - 2013-11-20 01:15 - 03842560 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll 2014-02-14 19:29 - 2013-11-20 00:57 - 03288576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll 2014-02-14 19:29 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-02-14 19:27 - 2014-02-14 19:27 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\maiko_000\Downloads\mbam-setup-1.75.0.1300.exe 2014-02-14 19:21 - 2014-02-14 19:21 - 00000000 ____D () C:\ProgramData\acer 2014-02-12 21:22 - 2014-02-12 21:22 - 00013801 _____ () C:\Users\maiko_000\Desktop\Stromkündigung 12.02.14.odt 2014-02-12 21:03 - 2014-02-12 21:03 - 00020099 _____ () C:\ComboFix.txt 2014-02-12 20:47 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe 2014-02-12 20:47 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe 2014-02-12 20:47 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2014-02-12 20:47 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2014-02-12 20:47 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2014-02-12 20:47 - 2000-08-31 01:00 - 00212480 _____ (SteelWerX) C:\Windows\SWXCACLS.exe 2014-02-12 20:47 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe 2014-02-12 20:47 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe 2014-02-12 20:47 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe 2014-02-12 20:34 - 2014-02-12 21:04 - 00000000 ____D () C:\Qoobox 2014-02-12 20:33 - 2014-02-12 21:01 - 00000000 ____D () C:\Windows\erdnt 2014-02-12 20:33 - 2014-02-12 20:33 - 00001140 _____ () C:\Users\maiko_000\Desktop\ComboFix - Verknüpfung.lnk 2014-02-12 20:33 - 2014-02-12 20:32 - 05180679 ____R (Swearware) C:\Users\maiko_000\Desktop\ComboFix.exe 2014-02-09 12:43 - 2014-02-09 12:43 - 00021913 _____ () C:\Users\maiko_000\Downloads\Addition.txt 2014-02-09 12:41 - 2014-02-09 12:43 - 00063927 _____ () C:\Users\maiko_000\Downloads\FRST.txt 2014-02-09 12:40 - 2014-02-09 12:40 - 02170368 _____ (Farbar) C:\Users\maiko_000\Downloads\FRST64.exe 2014-02-07 03:02 - 2014-02-14 20:42 - 00000000 ____D () C:\FRST 2014-02-05 21:06 - 2014-02-06 17:11 - 00000000 ____D () C:\Users\maiko_000\AppData\Local\CrashDumps 2014-02-05 21:04 - 2014-02-05 21:04 - 00002231 _____ () C:\Users\Public\Desktop\BewerbungsGenie 7.lnk 2014-02-05 21:04 - 2014-02-05 21:04 - 00000000 ____D () C:\Users\user\AppData\Roaming\ProtectDisc 2014-02-05 21:02 - 2014-02-05 21:02 - 00000000 ____D () C:\Program Files (x86)\DATA BECKER 2014-02-05 20:00 - 2014-02-05 20:00 - 00000000 ____D () C:\Users\maiko_000\Documents\Anti-Malware 2014-02-05 19:21 - 2014-02-05 19:21 - 00001095 _____ () C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk 2014-02-05 19:20 - 2014-02-14 20:20 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware 2014-02-05 19:20 - 2014-02-05 19:20 - 00000000 ____D () C:\Users\user\Documents\Anti-Malware 2014-02-05 18:27 - 2014-02-05 18:18 - 00000000 _____ () C:\Users\maiko_000\Desktop\mbam-setup-1.75.0.1300.exe 2014-02-05 16:55 - 2014-02-05 16:55 - 00000000 ____D () C:\Windows\pss 2014-02-05 16:52 - 2014-02-05 16:53 - 129598176 _____ () C:\Users\maiko_000\Downloads\avira_free344_antivirus_de.exe 2014-02-02 20:45 - 2014-02-02 20:45 - 00380653 _____ () C:\Users\maiko_000\Downloads\exercise-2014-2-2.gpx 2014-01-31 22:24 - 2014-01-31 22:24 - 00448512 _____ (OldTimer Tools) C:\Users\maiko_000\Downloads\TFC.exe 2014-01-31 22:18 - 2014-02-14 20:17 - 00000000 ____D () C:\AdwCleaner 2014-01-31 22:16 - 2014-01-31 22:16 - 01166132 _____ () C:\Users\maiko_000\Downloads\adwcleaner.exe 2014-01-31 15:30 - 2014-01-31 15:30 - 00821760 _____ (Browser Opt-out) C:\Users\maiko_000\Downloads\uninstall(1).exe 2014-01-31 15:29 - 2014-01-31 15:29 - 00821760 _____ (Browser Opt-out) C:\Users\maiko_000\Downloads\uninstall.exe 2014-01-30 21:36 - 2014-01-30 22:02 - 00113664 _____ () C:\Users\maiko_000\Desktop\Spesen Januar 2014.xls 2014-01-30 21:31 - 2014-01-30 21:31 - 00565248 _____ () C:\Users\maiko_000\Downloads\reisekosten-inland-2014.xls 2014-01-30 21:25 - 2014-02-14 20:35 - 00001128 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-01-30 21:25 - 2014-02-14 20:20 - 00001124 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-01-30 21:25 - 2014-02-14 20:04 - 00000000 ____D () C:\Users\user\AppData\Local\ext_offermosquito 2014-01-30 21:25 - 2014-01-30 21:25 - 00000000 ____D () C:\Users\user\AppData\Roaming\Mozilla 2014-01-30 21:25 - 2014-01-30 21:25 - 00000000 ____D () C:\Users\user\AppData\Roaming\Fifth 2014-01-30 21:25 - 2014-01-30 21:25 - 00000000 ____D () C:\Users\user\AppData\Local\Mozilla 2014-01-30 21:25 - 2014-01-30 21:25 - 00000000 ____D () C:\Users\user\AppData\Local\Google 2014-01-30 21:25 - 2014-01-30 21:25 - 00000000 ____D () C:\Program Files (x86)\Google 2014-01-30 21:24 - 2014-01-31 22:19 - 00000000 ____D () C:\Users\user\AppData\Roaming\Common 2014-01-30 21:24 - 2014-01-30 21:24 - 00000759 _____ () C:\Users\user\Desktop\Reisekosten 2014 TEST.lnk 2014-01-30 21:24 - 2014-01-30 21:24 - 00000759 _____ () C:\Users\maiko_000\Desktop\Reisekosten 2014 TEST.lnk 2014-01-30 21:24 - 2014-01-30 21:24 - 00000000 ____D () C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Reisekosten 2014 TEST 2014-01-30 21:24 - 2014-01-30 21:24 - 00000000 ____D () C:\Reisekosten 2014-01-30 21:23 - 2014-01-30 21:23 - 02096296 _____ () C:\Users\user\Desktop\spesen.exe 2014-01-30 21:22 - 2014-01-30 21:22 - 00000000 ____D () C:\Users\user\AppData\Roaming\Macromedia 2014-01-26 15:06 - 2014-01-26 15:06 - 13079688 _____ (Microsoft Corporation) C:\Users\maiko_000\Downloads\Silverlight_x64.exe 2014-01-26 15:06 - 2014-01-26 15:06 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2014-01-26 15:06 - 2014-01-26 15:06 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight 2014-01-26 12:39 - 2014-01-26 12:39 - 00000000 ____D () C:\Users\user\AppData\Roaming\8floor 2014-01-26 12:28 - 2014-01-26 12:30 - 00000000 ____D () C:\Program Files (x86)\WinRAR 2014-01-26 09:49 - 2014-01-26 09:49 - 00000000 ____D () C:\Users\user\AppData\Roaming\Acronis 2014-01-26 09:47 - 2014-01-26 09:47 - 01464096 _____ (Acronis International GmbH) C:\Windows\system32\Drivers\tdrpman.sys 2014-01-26 09:47 - 2014-01-26 09:47 - 01120032 _____ (Acronis International GmbH) C:\Windows\system32\Drivers\tib.sys 2014-01-26 09:47 - 2014-01-26 09:47 - 00367200 _____ (Acronis) C:\Windows\system32\Drivers\afcdp.sys 2014-01-26 09:47 - 2014-01-26 09:47 - 00198432 _____ (Acronis International GmbH) C:\Windows\system32\Drivers\tib_mounter.sys 2014-01-26 09:47 - 2014-01-26 09:47 - 00000000 ____D () C:\ProgramData\Acronis 2014-01-26 09:46 - 2014-01-26 09:46 - 00269600 _____ (Acronis International GmbH) C:\Windows\system32\Drivers\snapman.sys 2014-01-26 09:46 - 2014-01-26 09:46 - 00116000 _____ (Acronis International GmbH) C:\Windows\system32\Drivers\fltsrv.sys 2014-01-26 09:46 - 2014-01-26 09:46 - 00001205 _____ () C:\Users\Public\Desktop\Acronis True Image 2014.lnk 2014-01-26 09:46 - 2014-01-26 09:46 - 00000000 ____D () C:\Program Files (x86)\Acronis 2014-01-25 22:48 - 2014-01-25 22:48 - 00522143 _____ () C:\Users\maiko_000\Downloads\exercise-2013-12-15.gpx 2014-01-25 22:42 - 2014-01-25 22:42 - 00475008 _____ () C:\Users\maiko_000\Downloads\exercise-2014-1-19.gpx 2014-01-25 22:39 - 2014-01-25 22:39 - 00467685 _____ () C:\Users\maiko_000\Downloads\Sorpe-2014-1-17.gpx 2014-01-25 22:34 - 2014-01-25 22:34 - 00437466 _____ () C:\Users\maiko_000\Downloads\exercise-2014-1-14.gpx 2014-01-25 22:30 - 2014-01-25 22:30 - 00499004 _____ () C:\Users\maiko_000\Downloads\exercise-2014-1-3.gpx 2014-01-25 22:19 - 2014-01-25 22:19 - 00338623 _____ () C:\Users\maiko_000\Downloads\exercise-2014-1-22.gpx 2014-01-25 22:15 - 2014-01-25 22:15 - 00622051 _____ () C:\Users\maiko_000\Downloads\exercise-2014-1-25(1).gpx 2014-01-25 22:14 - 2014-01-25 22:15 - 00622051 _____ () C:\Users\maiko_000\Downloads\exercise-2014-1-25.gpx 2014-01-25 21:32 - 2014-01-25 21:33 - 43340104 _____ (Polar Electro Oy ) C:\Users\maiko_000\Downloads\websync_2.8.1(4).exe 2014-01-24 19:29 - 2014-01-24 19:31 - 00000000 ____D () C:\Users\maiko_000\Desktop\ebay-bücher 2014-01-21 20:30 - 2014-01-21 20:30 - 00062888 _____ () C:\Users\maiko_000\Desktop\Unbenannt 1.odt 2014-01-20 21:01 - 2014-01-20 21:04 - 00000000 ____D () C:\Users\maiko_000\Documents\Fax 2014-01-19 21:51 - 2014-01-19 21:51 - 00000771 _____ () C:\Users\maiko_000\Downloads\confirmation.de.ics 2014-01-19 00:21 - 2014-01-19 00:21 - 00191563 _____ () C:\Users\maiko_000\Desktop\Oschmann, Maik - Einkommensteuererklärung 2013.s14 2014-01-19 00:21 - 2014-01-19 00:21 - 00000000 ____D () C:\Users\maiko_000\Documents\Steuer-Sparbuch 2014-01-18 18:55 - 2014-01-18 23:45 - 00000000 ____D () C:\Users\maiko_000\.gimp-2.8 2014-01-18 18:55 - 2014-01-18 18:55 - 00000000 ____D () C:\Users\maiko_000\AppData\Local\gegl-0.2 2014-01-17 20:35 - 2014-01-17 20:35 - 43340104 _____ (Polar Electro Oy ) C:\Users\maiko_000\Downloads\websync_2.8.1(3).exe 2014-01-15 21:32 - 2014-01-15 21:34 - 00000000 ____D () C:\Program Files\GIMP 2 2014-01-15 21:30 - 2014-01-15 21:31 - 90396104 _____ (The GIMP Team ) C:\Users\maiko_000\Downloads\gimp-2.8.10-setup.exe 2014-01-15 19:05 - 2013-12-07 07:37 - 00688640 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll 2014-01-15 19:05 - 2013-12-07 07:37 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll 2014-01-15 19:05 - 2013-12-07 06:15 - 00562688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll 2014-01-15 19:05 - 2013-12-07 06:15 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll ==================== One Month Modified Files and Folders ======= 2014-02-14 20:43 - 2014-02-14 20:42 - 00013542 _____ () C:\Users\maiko_000\Desktop\FRST.txt 2014-02-14 20:42 - 2014-02-14 20:42 - 02152960 _____ (Farbar) C:\Users\maiko_000\Desktop\FRST64.exe 2014-02-14 20:42 - 2014-02-07 03:02 - 00000000 ____D () C:\FRST 2014-02-14 20:40 - 2013-07-25 10:36 - 01971520 _____ () C:\Windows\WindowsUpdate.log 2014-02-14 20:39 - 2014-02-14 20:39 - 00001736 _____ () C:\Users\maiko_000\Desktop\JRT.txt 2014-02-14 20:35 - 2014-01-30 21:25 - 00001128 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-02-14 20:29 - 2014-02-14 20:29 - 00000000 ____D () C:\Windows\ERUNT 2014-02-14 20:28 - 2014-02-14 20:28 - 01037530 _____ (Thisisu) C:\Users\maiko_000\Downloads\JRT.exe 2014-02-14 20:20 - 2014-02-05 19:20 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware 2014-02-14 20:20 - 2014-01-30 21:25 - 00001124 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-02-14 20:19 - 2014-02-14 20:19 - 00000000 ____D () C:\ProgramData\boost_interprocess 2014-02-14 20:19 - 2012-07-26 08:22 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-02-14 20:17 - 2014-01-31 22:18 - 00000000 ____D () C:\AdwCleaner 2014-02-14 20:15 - 2013-07-25 20:14 - 00753134 _____ () C:\Windows\system32\perfh007.dat 2014-02-14 20:15 - 2013-07-25 20:14 - 00155826 _____ () C:\Windows\system32\perfc007.dat 2014-02-14 20:15 - 2012-07-26 08:28 - 01745416 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-02-14 20:09 - 2013-04-18 05:36 - 00000000 ____D () C:\Program Files\Common Files\mcafee 2014-02-14 20:09 - 2013-04-18 03:46 - 00339402 _____ () C:\Windows\PFRO.log 2014-02-14 20:06 - 2014-02-14 20:06 - 01166132 _____ () C:\Users\maiko_000\Desktop\adwcleaner.exe 2014-02-14 20:04 - 2014-01-30 21:25 - 00000000 ____D () C:\Users\user\AppData\Local\ext_offermosquito 2014-02-14 20:00 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\system32\sru 2014-02-14 19:29 - 2014-02-14 19:29 - 00001113 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-02-14 19:29 - 2014-02-14 19:29 - 00000000 ____D () C:\Users\user\AppData\Roaming\Malwarebytes 2014-02-14 19:29 - 2014-02-14 19:29 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-02-14 19:29 - 2014-02-14 19:29 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware 2014-02-14 19:27 - 2014-02-14 19:27 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\maiko_000\Downloads\mbam-setup-1.75.0.1300.exe 2014-02-14 19:21 - 2014-02-14 19:21 - 00000000 ____D () C:\ProgramData\acer 2014-02-12 21:22 - 2014-02-12 21:22 - 00013801 _____ () C:\Users\maiko_000\Desktop\Stromkündigung 12.02.14.odt 2014-02-12 21:04 - 2014-02-12 20:34 - 00000000 ____D () C:\Qoobox 2014-02-12 21:04 - 2013-11-30 17:15 - 00000000 ___RD () C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2014-02-12 21:04 - 2013-11-30 17:15 - 00000000 ___RD () C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2014-02-12 21:03 - 2014-02-12 21:03 - 00020099 _____ () C:\ComboFix.txt 2014-02-12 21:03 - 2012-07-26 06:37 - 00000000 __RHD () C:\Users\Default 2014-02-12 21:02 - 2014-01-08 02:44 - 00000000 ___RD () C:\Users\maiko_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2014-02-12 21:01 - 2014-02-12 20:33 - 00000000 ____D () C:\Windows\erdnt 2014-02-12 21:01 - 2012-07-26 06:26 - 00000215 _____ () C:\Windows\system.ini 2014-02-12 20:39 - 2013-04-18 05:36 - 00000000 ____D () C:\ProgramData\McAfee 2014-02-12 20:39 - 2013-04-18 05:36 - 00000000 ____D () C:\Program Files\mcafee 2014-02-12 20:39 - 2012-07-26 09:12 - 00000000 ___HD () C:\Windows\ELAMBKUP 2014-02-12 20:33 - 2014-02-12 20:33 - 00001140 _____ () C:\Users\maiko_000\Desktop\ComboFix - Verknüpfung.lnk 2014-02-12 20:33 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\AUInstallAgent 2014-02-12 20:32 - 2014-02-12 20:33 - 05180679 ____R (Swearware) C:\Users\maiko_000\Desktop\ComboFix.exe 2014-02-10 20:54 - 2013-04-18 05:36 - 00000000 ____D () C:\Program Files (x86)\McAfee 2014-02-09 12:43 - 2014-02-09 12:43 - 00021913 _____ () C:\Users\maiko_000\Downloads\Addition.txt 2014-02-09 12:43 - 2014-02-09 12:41 - 00063927 _____ () C:\Users\maiko_000\Downloads\FRST.txt 2014-02-09 12:40 - 2014-02-09 12:40 - 02170368 _____ (Farbar) C:\Users\maiko_000\Downloads\FRST64.exe 2014-02-06 20:02 - 2014-01-11 23:03 - 00000000 ____D () C:\Users\maiko_000\AppData\Roaming\UseNeXT 2014-02-06 20:01 - 2014-01-11 23:03 - 00000000 ____D () C:\Users\maiko_000\Documents\UseNeXT 2014-02-06 18:47 - 2014-01-08 02:44 - 00000000 ____D () C:\Users\maiko_000\AppData\Local\VirtualStore 2014-02-06 17:11 - 2014-02-05 21:06 - 00000000 ____D () C:\Users\maiko_000\AppData\Local\CrashDumps 2014-02-05 21:04 - 2014-02-05 21:04 - 00002231 _____ () C:\Users\Public\Desktop\BewerbungsGenie 7.lnk 2014-02-05 21:04 - 2014-02-05 21:04 - 00000000 ____D () C:\Users\user\AppData\Roaming\ProtectDisc 2014-02-05 21:02 - 2014-02-05 21:02 - 00000000 ____D () C:\Program Files (x86)\DATA BECKER 2014-02-05 20:00 - 2014-02-05 20:00 - 00000000 ____D () C:\Users\maiko_000\Documents\Anti-Malware 2014-02-05 19:21 - 2014-02-05 19:21 - 00001095 _____ () C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk 2014-02-05 19:20 - 2014-02-05 19:20 - 00000000 ____D () C:\Users\user\Documents\Anti-Malware 2014-02-05 18:18 - 2014-02-05 18:27 - 00000000 _____ () C:\Users\maiko_000\Desktop\mbam-setup-1.75.0.1300.exe 2014-02-05 16:55 - 2014-02-05 16:55 - 00000000 ____D () C:\Windows\pss 2014-02-05 16:53 - 2014-02-05 16:52 - 129598176 _____ () C:\Users\maiko_000\Downloads\avira_free344_antivirus_de.exe 2014-02-02 20:45 - 2014-02-02 20:45 - 00380653 _____ () C:\Users\maiko_000\Downloads\exercise-2014-2-2.gpx 2014-02-01 10:20 - 2014-02-14 19:29 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-02-01 10:19 - 2014-02-14 19:29 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-02-01 10:19 - 2014-02-14 19:29 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-02-01 10:19 - 2014-02-14 19:29 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll 2014-02-01 10:19 - 2014-02-14 19:29 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\UXInit.dll 2014-02-01 10:18 - 2014-02-14 19:29 - 19274240 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-02-01 10:18 - 2014-02-14 19:29 - 15403520 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-02-01 10:18 - 2014-02-14 19:29 - 03960320 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-02-01 10:18 - 2014-02-14 19:29 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-02-01 10:18 - 2014-02-14 19:29 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2014-02-01 10:18 - 2014-02-14 19:29 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-02-01 10:18 - 2014-02-14 19:29 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-02-01 10:18 - 2014-02-14 19:29 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2014-02-01 10:18 - 2014-02-14 19:29 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-02-01 10:18 - 2014-02-14 19:29 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-02-01 10:18 - 2014-02-14 19:29 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-02-01 08:58 - 2014-02-14 19:29 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-02-01 08:58 - 2014-02-14 19:29 - 01140736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-02-01 08:58 - 2014-02-14 19:29 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UXInit.dll 2014-02-01 08:57 - 2014-02-14 19:29 - 14359040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-02-01 08:57 - 2014-02-14 19:29 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-02-01 08:57 - 2014-02-14 19:29 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-02-01 08:57 - 2014-02-14 19:29 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-02-01 08:57 - 2014-02-14 19:29 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2014-02-01 08:57 - 2014-02-14 19:29 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-02-01 08:57 - 2014-02-14 19:29 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-02-01 08:57 - 2014-02-14 19:29 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll 2014-02-01 08:57 - 2014-02-14 19:29 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-02-01 08:57 - 2014-02-14 19:29 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-02-01 08:57 - 2014-02-14 19:29 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-02-01 08:40 - 2014-02-14 19:29 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-02-01 08:34 - 2014-02-14 19:29 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-02-01 06:08 - 2014-02-14 19:29 - 00534528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uxtheme.dll 2014-01-31 22:24 - 2014-01-31 22:24 - 00448512 _____ (OldTimer Tools) C:\Users\maiko_000\Downloads\TFC.exe 2014-01-31 22:19 - 2014-01-30 21:24 - 00000000 ____D () C:\Users\user\AppData\Roaming\Common 2014-01-31 22:16 - 2014-01-31 22:16 - 01166132 _____ () C:\Users\maiko_000\Downloads\adwcleaner.exe 2014-01-31 15:30 - 2014-01-31 15:30 - 00821760 _____ (Browser Opt-out) C:\Users\maiko_000\Downloads\uninstall(1).exe 2014-01-31 15:29 - 2014-01-31 15:29 - 00821760 _____ (Browser Opt-out) C:\Users\maiko_000\Downloads\uninstall.exe 2014-01-30 22:10 - 2014-01-11 22:00 - 00694240 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-01-30 22:10 - 2014-01-11 22:00 - 00078296 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-01-30 22:02 - 2014-01-30 21:36 - 00113664 _____ () C:\Users\maiko_000\Desktop\Spesen Januar 2014.xls 2014-01-30 21:31 - 2014-01-30 21:31 - 00565248 _____ () C:\Users\maiko_000\Downloads\reisekosten-inland-2014.xls 2014-01-30 21:25 - 2014-01-30 21:25 - 00000000 ____D () C:\Users\user\AppData\Roaming\Mozilla 2014-01-30 21:25 - 2014-01-30 21:25 - 00000000 ____D () C:\Users\user\AppData\Roaming\Fifth 2014-01-30 21:25 - 2014-01-30 21:25 - 00000000 ____D () C:\Users\user\AppData\Local\Mozilla 2014-01-30 21:25 - 2014-01-30 21:25 - 00000000 ____D () C:\Users\user\AppData\Local\Google 2014-01-30 21:25 - 2014-01-30 21:25 - 00000000 ____D () C:\Program Files (x86)\Google 2014-01-30 21:24 - 2014-01-30 21:24 - 00000759 _____ () C:\Users\user\Desktop\Reisekosten 2014 TEST.lnk 2014-01-30 21:24 - 2014-01-30 21:24 - 00000759 _____ () C:\Users\maiko_000\Desktop\Reisekosten 2014 TEST.lnk 2014-01-30 21:24 - 2014-01-30 21:24 - 00000000 ____D () C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Reisekosten 2014 TEST 2014-01-30 21:24 - 2014-01-30 21:24 - 00000000 ____D () C:\Reisekosten 2014-01-30 21:23 - 2014-01-30 21:23 - 02096296 _____ () C:\Users\user\Desktop\spesen.exe 2014-01-30 21:22 - 2014-01-30 21:22 - 00000000 ____D () C:\Users\user\AppData\Roaming\Macromedia 2014-01-26 20:21 - 2014-01-08 04:48 - 00000000 ____D () C:\Users\maiko_000\Desktop\Iomega Platte 2014-01-26 15:06 - 2014-01-26 15:06 - 13079688 _____ (Microsoft Corporation) C:\Users\maiko_000\Downloads\Silverlight_x64.exe 2014-01-26 15:06 - 2014-01-26 15:06 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2014-01-26 15:06 - 2014-01-26 15:06 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight 2014-01-26 12:39 - 2014-01-26 12:39 - 00000000 ____D () C:\Users\user\AppData\Roaming\8floor 2014-01-26 12:30 - 2014-01-26 12:28 - 00000000 ____D () C:\Program Files (x86)\WinRAR 2014-01-26 09:49 - 2014-01-26 09:49 - 00000000 ____D () C:\Users\user\AppData\Roaming\Acronis 2014-01-26 09:47 - 2014-01-26 09:47 - 01464096 _____ (Acronis International GmbH) C:\Windows\system32\Drivers\tdrpman.sys 2014-01-26 09:47 - 2014-01-26 09:47 - 01120032 _____ (Acronis International GmbH) C:\Windows\system32\Drivers\tib.sys 2014-01-26 09:47 - 2014-01-26 09:47 - 00367200 _____ (Acronis) C:\Windows\system32\Drivers\afcdp.sys 2014-01-26 09:47 - 2014-01-26 09:47 - 00198432 _____ (Acronis International GmbH) C:\Windows\system32\Drivers\tib_mounter.sys 2014-01-26 09:47 - 2014-01-26 09:47 - 00000000 ____D () C:\ProgramData\Acronis 2014-01-26 09:46 - 2014-01-26 09:46 - 00269600 _____ (Acronis International GmbH) C:\Windows\system32\Drivers\snapman.sys 2014-01-26 09:46 - 2014-01-26 09:46 - 00116000 _____ (Acronis International GmbH) C:\Windows\system32\Drivers\fltsrv.sys 2014-01-26 09:46 - 2014-01-26 09:46 - 00001205 _____ () C:\Users\Public\Desktop\Acronis True Image 2014.lnk 2014-01-26 09:46 - 2014-01-26 09:46 - 00000000 ____D () C:\Program Files (x86)\Acronis 2014-01-25 22:48 - 2014-01-25 22:48 - 00522143 _____ () C:\Users\maiko_000\Downloads\exercise-2013-12-15.gpx 2014-01-25 22:42 - 2014-01-25 22:42 - 00475008 _____ () C:\Users\maiko_000\Downloads\exercise-2014-1-19.gpx 2014-01-25 22:39 - 2014-01-25 22:39 - 00467685 _____ () C:\Users\maiko_000\Downloads\Sorpe-2014-1-17.gpx 2014-01-25 22:34 - 2014-01-25 22:34 - 00437466 _____ () C:\Users\maiko_000\Downloads\exercise-2014-1-14.gpx 2014-01-25 22:30 - 2014-01-25 22:30 - 00499004 _____ () C:\Users\maiko_000\Downloads\exercise-2014-1-3.gpx 2014-01-25 22:19 - 2014-01-25 22:19 - 00338623 _____ () C:\Users\maiko_000\Downloads\exercise-2014-1-22.gpx 2014-01-25 22:15 - 2014-01-25 22:15 - 00622051 _____ () C:\Users\maiko_000\Downloads\exercise-2014-1-25(1).gpx 2014-01-25 22:15 - 2014-01-25 22:14 - 00622051 _____ () C:\Users\maiko_000\Downloads\exercise-2014-1-25.gpx 2014-01-25 21:34 - 2014-01-12 19:17 - 00002055 _____ () C:\Users\Public\Desktop\Polar WebSync.lnk 2014-01-25 21:33 - 2014-01-25 21:32 - 43340104 _____ (Polar Electro Oy ) C:\Users\maiko_000\Downloads\websync_2.8.1(4).exe 2014-01-24 19:31 - 2014-01-24 19:29 - 00000000 ____D () C:\Users\maiko_000\Desktop\ebay-bücher 2014-01-22 06:06 - 2014-01-11 23:58 - 00000000 ____D () C:\Users\maiko_000\AppData\Roaming\vlc 2014-01-21 20:46 - 2012-07-26 08:21 - 00033018 _____ () C:\Windows\setupact.log 2014-01-21 20:30 - 2014-01-21 20:30 - 00062888 _____ () C:\Users\maiko_000\Desktop\Unbenannt 1.odt 2014-01-20 21:07 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\system32\FxsTmp 2014-01-20 21:04 - 2014-01-20 21:01 - 00000000 ____D () C:\Users\maiko_000\Documents\Fax 2014-01-20 20:25 - 2013-07-25 11:03 - 00000000 ____D () C:\ProgramData\Norton 2014-01-20 20:24 - 2014-01-10 09:27 - 00000000 ____D () C:\Users\maiko_000\AppData\Local\clear.fi 2014-01-19 21:51 - 2014-01-19 21:51 - 00000771 _____ () C:\Users\maiko_000\Downloads\confirmation.de.ics 2014-01-19 00:21 - 2014-01-19 00:21 - 00191563 _____ () C:\Users\maiko_000\Desktop\Oschmann, Maik - Einkommensteuererklärung 2013.s14 2014-01-19 00:21 - 2014-01-19 00:21 - 00000000 ____D () C:\Users\maiko_000\Documents\Steuer-Sparbuch 2014-01-18 23:45 - 2014-01-18 18:55 - 00000000 ____D () C:\Users\maiko_000\.gimp-2.8 2014-01-18 22:52 - 2014-01-13 21:29 - 00000000 ____D () C:\Users\maiko_000\AppData\Local\Buhl 2014-01-18 18:55 - 2014-01-18 18:55 - 00000000 ____D () C:\Users\maiko_000\AppData\Local\gegl-0.2 2014-01-18 18:55 - 2014-01-08 02:44 - 00000000 ____D () C:\Users\maiko_000 2014-01-18 17:05 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\WinStore 2014-01-17 20:35 - 2014-01-17 20:35 - 43340104 _____ (Polar Electro Oy ) C:\Users\maiko_000\Downloads\websync_2.8.1(3).exe 2014-01-17 19:30 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\rescache 2014-01-15 21:34 - 2014-01-15 21:32 - 00000000 ____D () C:\Program Files\GIMP 2 2014-01-15 21:31 - 2014-01-15 21:30 - 90396104 _____ (The GIMP Team ) C:\Users\maiko_000\Downloads\gimp-2.8.10-setup.exe 2014-01-15 21:29 - 2014-01-09 17:02 - 00000000 ____D () C:\Windows\system32\MRT 2014-01-15 21:28 - 2014-01-09 17:02 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe Some content of TEMP: ==================== C:\Users\user\AppData\Local\Temp\Quarantine.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ==================== End Of Log ============================ --- --- --- --- --- --- Hoffe habe alles :-) |
15.02.2014, 18:09 | #19 |
/// the machine /// TB-Ausbilder | Windows 8 GVU TrojanerESET Online Scanner
Downloade Dir bitte SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
16.02.2014, 14:53 | #20 |
| Windows 8 GVU TrojanerCode:
ATTFilter ESETSmartInstaller@High as downloader log: all ok # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6920 # api_version=3.0.2 # EOSSerial=c330311b32ec224d82abb2db4606231d # engine=17090 # end=stopped # remove_checked=false # archives_checked=true # unwanted_checked=false # unsafe_checked=false # antistealth_checked=true # utc_time=2014-02-16 10:53:03 # local_time=2014-02-16 11:53:03 (+0100, Mitteleuropäische Zeit) # country="Germany" # lang=1033 # osver=6.2.9200 NT # compatibility_mode=5122 16777214 0 39 142990 54835009 0 0 # compatibility_mode=5893 16776574 100 94 3018993 19831458 0 0 # scanned=209469 # found=0 # cleaned=0 # scan_time=6862 ESETSmartInstaller@High as downloader log: all ok # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6920 # api_version=3.0.2 # EOSSerial=c330311b32ec224d82abb2db4606231d # engine=17090 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=false # unsafe_checked=false # antistealth_checked=true # utc_time=2014-02-16 01:23:11 # local_time=2014-02-16 02:23:11 (+0100, Mitteleuropäische Zeit) # country="Germany" # lang=1033 # osver=6.2.9200 NT # compatibility_mode=5122 16777214 0 39 151998 54844017 0 0 # compatibility_mode=5893 16776574 100 94 3028001 19840466 0 0 # scanned=310494 # found=1 # cleaned=0 # scan_time=8900 sh=61A39B9F44BD7ED76C153A980B389F81296868D8 ft=1 fh=c71c001166dd9cc8 vn="a variant of Win32/TrojanDownloader.Autoit.NNL trojan" ac=I fn="C:\Users\maiko_000\Documents\UseNeXT\wizard\Taxi.Tycoon.v2.4.GERMAN-HARPOON - (1_7) - _Taxi.Ty\Taxi.Tycoon.v2.4.GERMAN-HARPOON.exe" Code:
ATTFilter Results of screen317's Security Check version 0.99.79 x64 (UAC is enabled) Internet Explorer 10 Out of date! ``````````````Antivirus/Firewall Check:`````````````` Emsisoft Anti-Malware Windows Defender Antivirus out of date! (On Access scanning disabled!) `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware Version 1.75.0.1300 Adobe Flash Player 11.9.900.170 Mozilla Firefox (26.0) ````````Process Check: objlist.exe by Laurent```````` Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbamgui.exe Emsisoft Anti-Malware a2service.exe Malwarebytes' Anti-Malware mbamscheduler.exe Emsisoft Anti-Malware a2guard.exe Symantec Norton Online Backup NOBuAgent.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: % ````````````````````End of Log`````````````````````` FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-02-2014 01 Ran by maiko_000 (ATTENTION: The logged in user is not administrator) on ACER on 16-02-2014 14:50:46 Running from C:\Users\maiko_000\Desktop Windows 8 (X64) OS Language: German Standard Internet Explorer Version 10 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe (Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe (Intel Corporation) C:\Windows\system32\igfxext.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe (Dolby Laboratories Inc.) C:\Dolby PCEE4\pcee4.exe () C:\Program Files (x86)\Polar\WebSync\WebSync.exe (Acronis) C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe (Acronis International GmbH) C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe (Emsisoft GmbH) C:\Program Files (x86)\Emsisoft Anti-Malware\a2guard.exe (CyberLink) C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe () C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe () C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2874256 2012-12-07] (ELAN Microelectronics Corp.) HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13267016 2013-01-29] (Realtek Semiconductor) HKLM\...\Run: [RtHDVBg_Dolby] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1276488 2013-01-18] (Realtek Semiconductor) HKLM\...\Run: [Acronis Scheduler2 Service] - C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [519408 2013-07-18] (Acronis) HKLM-x32\...\Run: [Norton Online Backup] - C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [2994880 2012-08-15] (Symantec Corporation) HKLM-x32\...\Run: [TrueImageMonitor.exe] - C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe [7843992 2013-10-24] (Acronis) HKLM-x32\...\Run: [AcronisTibMounterMonitor] - C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe [1104616 2013-10-10] (Acronis International GmbH) HKLM-x32\...\Run: [emsisoft anti-malware] - c:\program files (x86)\emsisoft anti-malware\a2guard.exe [4329408 2013-12-04] (Emsisoft GmbH) HKLM\...\Runonce: [MSPCLOCK] - rundll32.exe streamci,StreamingDeviceSetup {97ebaacc-95bd-11d0-a3ea-00a0c9223196},{53172480-4791-11D0-A5D6-28DB04C10000},{53172480-4791-11D0-A5D6-28DB04C10000} HKLM\...\Runonce: [MSPQM] - rundll32.exe streamci,StreamingDeviceSetup {DDF4358E-BB2C-11D0-A42F-00A0C9223196},{97EBAACB-95BD-11D0-A3EA-00A0C9223196},{97EBAACB-95BD-11D0-A3EA-00A0C9223196} HKLM\...\Runonce: [MSKSSRV] - rundll32.exe streamci,StreamingDeviceSetup {96E080C7-143C-11D1-B40F-00A0C9223196},{3C0D501A-140B-11D1-B40F-00A0C9223196},{3C0D501A-140B-11D1-B40F-00A0C9223196} HKLM\...\Runonce: [MSTEE.CxTransform] - rundll32.exe streamci,StreamingDeviceSetup {cfd669f1-9bc2-11d0-8299-0000f822fe8a},{CF1DDA2C-9743-11D0-A3EE-00A0C9223196},{CF1DDA2C-9743-11D0-A3EE-00A0C9223196},C:\Windows\inf\ksfilter.inf,MSTEE.Interface.Install HKLM\...\Runonce: [MSTEE.Splitter] - rundll32.exe streamci,StreamingDeviceSetup {cfd669f1-9bc2-11d0-8299-0000f822fe8a},{0A4252A0-7E70-11D0-A5D6-28DB04C10000},{0A4252A0-7E70-11D0-A5D6-28DB04C10000},C:\Windows\inf\ksfilter.inf,MSTEE.Interface.Install HKLM\...\Runonce: [WDM_DRMKAUD] - rundll32.exe streamci,StreamingDeviceSetup {EEC12DB6-AD9C-4168-8658-B03DAEF417FE},{ABD61E00-9350-47e2-A632-4438B90C6641},{FFBB6E3F-CCFE-4D84-90D9-421418B03A8E},C:\Windows\inf\WDMAUDIO.inf,WDM_DRMKAUD.Interface.Install HKLM\...\RunOnce: [BrowserChoice] - C:\Windows\BrowserChoice\browserchoice.exe [86696 2012-08-15] (Microsoft Corporation) HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware ] - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation) HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware (cleanup)] - rundll32.exe "C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll",ProcessCleanupScript [1127496 2013-04-04] (Malwarebytes Corporation) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKU\S-1-5-21-3049176386-3505927428-341134551-1002\...\Run: [DelayShred] - C:\Users\maiko_000\Documents\UseNeXT\wizard\Taxi.Tycoon.v2.4.GERMAN-HARPOON - (1_7) - _Taxi.Ty\Taxi.Tycoon.v2.4.GERMAN-HARPOON.exe [48625620 2014-01-06] () HKU\S-1-5-21-3049176386-3505927428-341134551-1002\...\Winlogon: [Userinit] userinit.exe, [25088 2012-07-26] (Microsoft Corporation) HKU\S-1-5-21-3049176386-3505927428-341134551-1002\...\Winlogon: [Shell] explorer.exe [2391280 2013-06-01] (Microsoft Corporation) <==== ATTENTION ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://acer13.msn.com HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKLM - DefaultScope {6D2BF56D-8AAD-411D-8470-6B4A0C99C77C} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS SearchScopes: HKLM - {6D2BF56D-8AAD-411D-8470-6B4A0C99C77C} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS SearchScopes: HKLM - {AA9A4890-4262-4441-8977-E2FFCBFB706C} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?hspart=acer&hsimp=yhs-acer_001&p={searchTerms} SearchScopes: HKLM-x32 - {6D2BF56D-8AAD-411D-8470-6B4A0C99C77C} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MAARJS SearchScopes: HKLM-x32 - {AA9A4890-4262-4441-8977-E2FFCBFB706C} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?hspart=acer&hsimp=yhs-acer_001&p={searchTerms} SearchScopes: HKCU - DefaultScope {6D2BF56D-8AAD-411D-8470-6B4A0C99C77C} URL = SearchScopes: HKCU - {6D2BF56D-8AAD-411D-8470-6B4A0C99C77C} URL = BHO: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\IEPlugIn.dll (Qualcomm Atheros Commnucations) BHO-x32: ChromeFrame BHO - {ECB3C477-1A0A-44BD-BB57-78F9EFE34FA7} - C:\Program Files (x86)\Google\Chrome Frame\Application\32.0.1700.107\npchrome_frame.dll (Google Inc.) Handler: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - No File Handler-x32: gcf - {9875BFAF-B04D-445E-8A69-BE36838CDE3E} - C:\Program Files (x86)\Google\Chrome Frame\Application\32.0.1700.107\npchrome_frame.dll (Google Inc.) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\maiko_000\AppData\Roaming\Mozilla\Firefox\Profiles\dzggwuzo.default FF Homepage: hxxp://www.freenet.de/|about:home FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll () FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll () FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @videolan.org/vlc,version=2.1.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll () FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml ==================== Services (Whitelisted) ================= R2 a2AntiMalware; C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe [4161512 2013-12-04] (Emsisoft GmbH) R2 AtherosSvc; C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\adminservice.exe [227456 2013-01-28] (Qualcomm Atheros Commnucations) R2 CCDMonitorService; C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe [2615368 2013-02-19] (Acer Incorporated) R2 DBService; C:\Program Files (x86)\Common Files\DATA BECKER Shared\DBService.exe [2650112 2010-05-28] (DATA BECKER GmbH & Co KG) S3 DeviceFastLaneService; C:\Program Files\Acer\Acer Device Fast-lane\DeviceFastLaneSvc.exe [469648 2012-11-16] (Acer Incorporated) S3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [662088 2013-03-15] (Acer Incorporated) R2 ETDService; C:\Program Files\Elantech\ETDService.exe [100752 2012-12-07] (ELAN Microelectronics Corp.) R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-17] (Intel Corporation) R2 lmhosts; C:\Windows\system32\svchost.exe [29696 2012-09-20] (Microsoft Corporation) R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation) R2 NlaSvc; C:\Windows\System32\svchost.exe [29696 2012-09-20] (Microsoft Corporation) R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [3943104 2012-08-15] (Symantec Corporation) R2 nsi; C:\Windows\system32\svchost.exe [29696 2012-09-20] (Microsoft Corporation) R2 Polar Daemon; C:\Program Files (x86)\Polar\Daemon\polard.exe [413184 2012-08-17] () R2 RfButtonDriverService; C:\Windows\RfBtnSvc64.exe [93296 2013-07-25] (Dritek System INC.) S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation) S2 0170711392062049mcinstcleanup; C:\Windows\TEMP\017071~1.EXE -cleanup -nolog [X] ==================== Drivers (Whitelisted) ==================== R3 a2acc; C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\a2accx64.sys [70960 2013-08-24] (Emsisoft GmbH) R1 A2DDA; C:\Program Files (x86)\Emsisoft Anti-Malware\a2ddax64.sys [26176 2013-03-28] (Emsisoft GmbH) R1 a2injectiondriver; C:\Program Files (x86)\Emsisoft Anti-Malware\a2dix64.sys [45208 2013-09-30] (Emsisoft GmbH) R1 a2util; C:\Program Files (x86)\Emsisoft Anti-Malware\a2util64.sys [17384 2013-03-28] (Emsisoft GmbH) S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2013-01-28] (Qualcomm Atheros) S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation) R1 ccSet_NARA; C:\Windows\system32\drivers\NARAx64\0401000.00E\ccSetx64.sys [168608 2012-05-26] (Symantec Corporation) R3 cleanhlp; C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [57024 2013-12-04] (Emsisoft GmbH) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) R3 Ps2Kb2Hid; C:\Windows\System32\drivers\aPs2Kb2Hid.sys [26736 2013-07-25] (Dritek System Inc.) R0 tib; C:\Windows\System32\DRIVERS\tib.sys [1120032 2014-01-26] (Acronis International GmbH) R0 tib_mounter; C:\Windows\System32\DRIVERS\tib_mounter.sys [198432 2014-01-26] (Acronis International GmbH) U5 AppMgmt; C:\Windows\system32\svchost.exe [29696 2012-09-20] (Microsoft Corporation) S3 catchme; \??\C:\ComboFix\catchme.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-02-16 14:48 - 2014-02-16 14:48 - 00987425 _____ () C:\Users\maiko_000\Desktop\SecurityCheck.exe 2014-02-16 14:48 - 2014-02-16 14:48 - 00016504 _____ () C:\Users\maiko_000\Desktop\download-securitycheck.htm 2014-02-16 09:55 - 2014-02-16 09:55 - 02347384 _____ (ESET) C:\Users\maiko_000\Desktop\esetsmartinstaller_enu.exe 2014-02-14 20:42 - 2014-02-16 14:50 - 00013485 _____ () C:\Users\maiko_000\Desktop\FRST.txt 2014-02-14 20:42 - 2014-02-14 20:42 - 02152960 _____ (Farbar) C:\Users\maiko_000\Desktop\FRST64.exe 2014-02-14 20:39 - 2014-02-14 20:39 - 00001736 _____ () C:\Users\maiko_000\Desktop\JRT.txt 2014-02-14 20:29 - 2014-02-14 20:29 - 00000000 ____D () C:\Windows\ERUNT 2014-02-14 20:28 - 2014-02-14 20:28 - 01037530 _____ (Thisisu) C:\Users\maiko_000\Downloads\JRT.exe 2014-02-14 20:19 - 2014-02-14 20:19 - 00000000 ____D () C:\ProgramData\boost_interprocess 2014-02-14 20:06 - 2014-02-14 20:06 - 01166132 _____ () C:\Users\maiko_000\Desktop\adwcleaner.exe 2014-02-14 19:30 - 2013-12-09 01:45 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-02-14 19:30 - 2013-12-09 00:59 - 00600064 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-02-14 19:30 - 2013-12-05 00:43 - 01845248 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll 2014-02-14 19:30 - 2013-12-05 00:43 - 00583680 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll 2014-02-14 19:30 - 2013-12-05 00:37 - 01419264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll 2014-02-14 19:30 - 2013-12-05 00:37 - 00451072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll 2014-02-14 19:30 - 2013-11-27 01:19 - 00385614 _____ () C:\Windows\system32\ApnDatabase.xml 2014-02-14 19:30 - 2013-11-26 00:17 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys 2014-02-14 19:30 - 2013-11-01 06:53 - 02232664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys 2014-02-14 19:29 - 2014-02-14 19:29 - 00001113 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-02-14 19:29 - 2014-02-14 19:29 - 00000000 ____D () C:\Users\user\AppData\Roaming\Malwarebytes 2014-02-14 19:29 - 2014-02-14 19:29 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-02-14 19:29 - 2014-02-14 19:29 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware 2014-02-14 19:29 - 2014-02-01 10:20 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-02-14 19:29 - 2014-02-01 10:19 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-02-14 19:29 - 2014-02-01 10:19 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-02-14 19:29 - 2014-02-01 10:19 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll 2014-02-14 19:29 - 2014-02-01 10:19 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\UXInit.dll 2014-02-14 19:29 - 2014-02-01 10:18 - 19274240 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-02-14 19:29 - 2014-02-01 10:18 - 15403520 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-02-14 19:29 - 2014-02-01 10:18 - 03960320 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-02-14 19:29 - 2014-02-01 10:18 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-02-14 19:29 - 2014-02-01 10:18 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2014-02-14 19:29 - 2014-02-01 10:18 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-02-14 19:29 - 2014-02-01 10:18 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-02-14 19:29 - 2014-02-01 10:18 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2014-02-14 19:29 - 2014-02-01 10:18 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-02-14 19:29 - 2014-02-01 10:18 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-02-14 19:29 - 2014-02-01 10:18 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-02-14 19:29 - 2014-02-01 08:58 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-02-14 19:29 - 2014-02-01 08:58 - 01140736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-02-14 19:29 - 2014-02-01 08:58 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UXInit.dll 2014-02-14 19:29 - 2014-02-01 08:57 - 14359040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-02-14 19:29 - 2014-02-01 08:57 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-02-14 19:29 - 2014-02-01 08:57 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-02-14 19:29 - 2014-02-01 08:57 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-02-14 19:29 - 2014-02-01 08:57 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2014-02-14 19:29 - 2014-02-01 08:57 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-02-14 19:29 - 2014-02-01 08:57 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-02-14 19:29 - 2014-02-01 08:57 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll 2014-02-14 19:29 - 2014-02-01 08:57 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-02-14 19:29 - 2014-02-01 08:57 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-02-14 19:29 - 2014-02-01 08:57 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-02-14 19:29 - 2014-02-01 08:40 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-02-14 19:29 - 2014-02-01 08:34 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-02-14 19:29 - 2014-02-01 06:08 - 00534528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uxtheme.dll 2014-02-14 19:29 - 2014-01-13 00:30 - 02238976 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll 2014-02-14 19:29 - 2014-01-13 00:30 - 02032640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll 2014-02-14 19:29 - 2013-11-20 01:15 - 03842560 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll 2014-02-14 19:29 - 2013-11-20 00:57 - 03288576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll 2014-02-14 19:29 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-02-14 19:27 - 2014-02-14 19:27 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\maiko_000\Downloads\mbam-setup-1.75.0.1300.exe 2014-02-14 19:21 - 2014-02-14 19:21 - 00000000 ____D () C:\ProgramData\acer 2014-02-12 21:22 - 2014-02-12 21:22 - 00013801 _____ () C:\Users\maiko_000\Desktop\Stromkündigung 12.02.14.odt 2014-02-12 21:03 - 2014-02-12 21:03 - 00020099 _____ () C:\ComboFix.txt 2014-02-12 20:47 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe 2014-02-12 20:47 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe 2014-02-12 20:47 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2014-02-12 20:47 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2014-02-12 20:47 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2014-02-12 20:47 - 2000-08-31 01:00 - 00212480 _____ (SteelWerX) C:\Windows\SWXCACLS.exe 2014-02-12 20:47 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe 2014-02-12 20:47 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe 2014-02-12 20:47 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe 2014-02-12 20:34 - 2014-02-12 21:04 - 00000000 ____D () C:\Qoobox 2014-02-12 20:33 - 2014-02-12 21:01 - 00000000 ____D () C:\Windows\erdnt 2014-02-12 20:33 - 2014-02-12 20:33 - 00001140 _____ () C:\Users\maiko_000\Desktop\ComboFix - Verknüpfung.lnk 2014-02-12 20:33 - 2014-02-12 20:32 - 05180679 ____R (Swearware) C:\Users\maiko_000\Desktop\ComboFix.exe 2014-02-09 12:43 - 2014-02-09 12:43 - 00021913 _____ () C:\Users\maiko_000\Downloads\Addition.txt 2014-02-09 12:41 - 2014-02-09 12:43 - 00063927 _____ () C:\Users\maiko_000\Downloads\FRST.txt 2014-02-09 12:40 - 2014-02-09 12:40 - 02170368 _____ (Farbar) C:\Users\maiko_000\Downloads\FRST64.exe 2014-02-07 03:02 - 2014-02-16 14:50 - 00000000 ____D () C:\FRST 2014-02-05 21:06 - 2014-02-06 17:11 - 00000000 ____D () C:\Users\maiko_000\AppData\Local\CrashDumps 2014-02-05 21:04 - 2014-02-05 21:04 - 00002231 _____ () C:\Users\Public\Desktop\BewerbungsGenie 7.lnk 2014-02-05 21:04 - 2014-02-05 21:04 - 00000000 ____D () C:\Users\user\AppData\Roaming\ProtectDisc 2014-02-05 21:02 - 2014-02-05 21:02 - 00000000 ____D () C:\Program Files (x86)\DATA BECKER 2014-02-05 20:00 - 2014-02-05 20:00 - 00000000 ____D () C:\Users\maiko_000\Documents\Anti-Malware 2014-02-05 19:21 - 2014-02-05 19:21 - 00001095 _____ () C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk 2014-02-05 19:20 - 2014-02-16 09:10 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware 2014-02-05 19:20 - 2014-02-05 19:20 - 00000000 ____D () C:\Users\user\Documents\Anti-Malware 2014-02-05 18:27 - 2014-02-05 18:18 - 00000000 _____ () C:\Users\maiko_000\Desktop\mbam-setup-1.75.0.1300.exe 2014-02-05 16:55 - 2014-02-05 16:55 - 00000000 ____D () C:\Windows\pss 2014-02-05 16:52 - 2014-02-05 16:53 - 129598176 _____ () C:\Users\maiko_000\Downloads\avira_free344_antivirus_de.exe 2014-02-02 20:45 - 2014-02-02 20:45 - 00380653 _____ () C:\Users\maiko_000\Downloads\exercise-2014-2-2.gpx 2014-01-31 22:24 - 2014-01-31 22:24 - 00448512 _____ (OldTimer Tools) C:\Users\maiko_000\Downloads\TFC.exe 2014-01-31 22:18 - 2014-02-14 20:17 - 00000000 ____D () C:\AdwCleaner 2014-01-31 22:16 - 2014-01-31 22:16 - 01166132 _____ () C:\Users\maiko_000\Downloads\adwcleaner.exe 2014-01-31 15:30 - 2014-01-31 15:30 - 00821760 _____ (Browser Opt-out) C:\Users\maiko_000\Downloads\uninstall(1).exe 2014-01-31 15:29 - 2014-01-31 15:29 - 00821760 _____ (Browser Opt-out) C:\Users\maiko_000\Downloads\uninstall.exe 2014-01-30 21:36 - 2014-01-30 22:02 - 00113664 _____ () C:\Users\maiko_000\Desktop\Spesen Januar 2014.xls 2014-01-30 21:31 - 2014-01-30 21:31 - 00565248 _____ () C:\Users\maiko_000\Downloads\reisekosten-inland-2014.xls 2014-01-30 21:25 - 2014-02-16 14:35 - 00001128 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-01-30 21:25 - 2014-02-16 09:10 - 00001124 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-01-30 21:25 - 2014-02-14 20:04 - 00000000 ____D () C:\Users\user\AppData\Local\ext_offermosquito 2014-01-30 21:25 - 2014-01-30 21:25 - 00000000 ____D () C:\Users\user\AppData\Roaming\Mozilla 2014-01-30 21:25 - 2014-01-30 21:25 - 00000000 ____D () C:\Users\user\AppData\Roaming\Fifth 2014-01-30 21:25 - 2014-01-30 21:25 - 00000000 ____D () C:\Users\user\AppData\Local\Mozilla 2014-01-30 21:25 - 2014-01-30 21:25 - 00000000 ____D () C:\Users\user\AppData\Local\Google 2014-01-30 21:25 - 2014-01-30 21:25 - 00000000 ____D () C:\Program Files (x86)\Google 2014-01-30 21:24 - 2014-01-31 22:19 - 00000000 ____D () C:\Users\user\AppData\Roaming\Common 2014-01-30 21:24 - 2014-01-30 21:24 - 00000759 _____ () C:\Users\user\Desktop\Reisekosten 2014 TEST.lnk 2014-01-30 21:24 - 2014-01-30 21:24 - 00000759 _____ () C:\Users\maiko_000\Desktop\Reisekosten 2014 TEST.lnk 2014-01-30 21:24 - 2014-01-30 21:24 - 00000000 ____D () C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Reisekosten 2014 TEST 2014-01-30 21:24 - 2014-01-30 21:24 - 00000000 ____D () C:\Reisekosten 2014-01-30 21:23 - 2014-01-30 21:23 - 02096296 _____ () C:\Users\user\Desktop\spesen.exe 2014-01-30 21:22 - 2014-01-30 21:22 - 00000000 ____D () C:\Users\user\AppData\Roaming\Macromedia 2014-01-26 15:06 - 2014-01-26 15:06 - 13079688 _____ (Microsoft Corporation) C:\Users\maiko_000\Downloads\Silverlight_x64.exe 2014-01-26 15:06 - 2014-01-26 15:06 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2014-01-26 15:06 - 2014-01-26 15:06 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight 2014-01-26 12:39 - 2014-01-26 12:39 - 00000000 ____D () C:\Users\user\AppData\Roaming\8floor 2014-01-26 12:28 - 2014-01-26 12:30 - 00000000 ____D () C:\Program Files (x86)\WinRAR 2014-01-26 09:49 - 2014-01-26 09:49 - 00000000 ____D () C:\Users\user\AppData\Roaming\Acronis 2014-01-26 09:47 - 2014-01-26 09:47 - 01464096 _____ (Acronis International GmbH) C:\Windows\system32\Drivers\tdrpman.sys 2014-01-26 09:47 - 2014-01-26 09:47 - 01120032 _____ (Acronis International GmbH) C:\Windows\system32\Drivers\tib.sys 2014-01-26 09:47 - 2014-01-26 09:47 - 00367200 _____ (Acronis) C:\Windows\system32\Drivers\afcdp.sys 2014-01-26 09:47 - 2014-01-26 09:47 - 00198432 _____ (Acronis International GmbH) C:\Windows\system32\Drivers\tib_mounter.sys 2014-01-26 09:47 - 2014-01-26 09:47 - 00000000 ____D () C:\ProgramData\Acronis 2014-01-26 09:46 - 2014-01-26 09:46 - 00269600 _____ (Acronis International GmbH) C:\Windows\system32\Drivers\snapman.sys 2014-01-26 09:46 - 2014-01-26 09:46 - 00116000 _____ (Acronis International GmbH) C:\Windows\system32\Drivers\fltsrv.sys 2014-01-26 09:46 - 2014-01-26 09:46 - 00001205 _____ () C:\Users\Public\Desktop\Acronis True Image 2014.lnk 2014-01-26 09:46 - 2014-01-26 09:46 - 00000000 ____D () C:\Program Files (x86)\Acronis 2014-01-25 22:48 - 2014-01-25 22:48 - 00522143 _____ () C:\Users\maiko_000\Downloads\exercise-2013-12-15.gpx 2014-01-25 22:42 - 2014-01-25 22:42 - 00475008 _____ () C:\Users\maiko_000\Downloads\exercise-2014-1-19.gpx 2014-01-25 22:39 - 2014-01-25 22:39 - 00467685 _____ () C:\Users\maiko_000\Downloads\Sorpe-2014-1-17.gpx 2014-01-25 22:34 - 2014-01-25 22:34 - 00437466 _____ () C:\Users\maiko_000\Downloads\exercise-2014-1-14.gpx 2014-01-25 22:30 - 2014-01-25 22:30 - 00499004 _____ () C:\Users\maiko_000\Downloads\exercise-2014-1-3.gpx 2014-01-25 22:19 - 2014-01-25 22:19 - 00338623 _____ () C:\Users\maiko_000\Downloads\exercise-2014-1-22.gpx 2014-01-25 22:15 - 2014-01-25 22:15 - 00622051 _____ () C:\Users\maiko_000\Downloads\exercise-2014-1-25(1).gpx 2014-01-25 22:14 - 2014-01-25 22:15 - 00622051 _____ () C:\Users\maiko_000\Downloads\exercise-2014-1-25.gpx 2014-01-25 21:32 - 2014-01-25 21:33 - 43340104 _____ (Polar Electro Oy ) C:\Users\maiko_000\Downloads\websync_2.8.1(4).exe 2014-01-24 19:29 - 2014-01-24 19:31 - 00000000 ____D () C:\Users\maiko_000\Desktop\ebay-bücher 2014-01-21 20:30 - 2014-01-21 20:30 - 00062888 _____ () C:\Users\maiko_000\Desktop\Unbenannt 1.odt 2014-01-20 21:01 - 2014-01-20 21:04 - 00000000 ____D () C:\Users\maiko_000\Documents\Fax 2014-01-19 21:51 - 2014-01-19 21:51 - 00000771 _____ () C:\Users\maiko_000\Downloads\confirmation.de.ics 2014-01-19 00:21 - 2014-01-19 00:21 - 00191563 _____ () C:\Users\maiko_000\Desktop\Oschmann, Maik - Einkommensteuererklärung 2013.s14 2014-01-19 00:21 - 2014-01-19 00:21 - 00000000 ____D () C:\Users\maiko_000\Documents\Steuer-Sparbuch 2014-01-18 18:55 - 2014-01-18 23:45 - 00000000 ____D () C:\Users\maiko_000\.gimp-2.8 2014-01-18 18:55 - 2014-01-18 18:55 - 00000000 ____D () C:\Users\maiko_000\AppData\Local\gegl-0.2 2014-01-17 20:35 - 2014-01-17 20:35 - 43340104 _____ (Polar Electro Oy ) C:\Users\maiko_000\Downloads\websync_2.8.1(3).exe ==================== One Month Modified Files and Folders ======= 2014-02-16 14:50 - 2014-02-14 20:42 - 00013485 _____ () C:\Users\maiko_000\Desktop\FRST.txt 2014-02-16 14:50 - 2014-02-07 03:02 - 00000000 ____D () C:\FRST 2014-02-16 14:48 - 2014-02-16 14:48 - 00987425 _____ () C:\Users\maiko_000\Desktop\SecurityCheck.exe 2014-02-16 14:48 - 2014-02-16 14:48 - 00016504 _____ () C:\Users\maiko_000\Desktop\download-securitycheck.htm 2014-02-16 14:35 - 2014-01-30 21:25 - 00001128 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-02-16 14:34 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\rescache 2014-02-16 14:00 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\system32\sru 2014-02-16 11:11 - 2013-07-25 10:36 - 02068754 _____ () C:\Windows\WindowsUpdate.log 2014-02-16 09:57 - 2013-07-25 20:14 - 00753134 _____ () C:\Windows\system32\perfh007.dat 2014-02-16 09:57 - 2013-07-25 20:14 - 00155826 _____ () C:\Windows\system32\perfc007.dat 2014-02-16 09:57 - 2012-07-26 08:28 - 01745416 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-02-16 09:55 - 2014-02-16 09:55 - 02347384 _____ (ESET) C:\Users\maiko_000\Desktop\esetsmartinstaller_enu.exe 2014-02-16 09:38 - 2014-01-09 17:02 - 00000000 ____D () C:\Windows\system32\MRT 2014-02-16 09:37 - 2014-01-09 17:02 - 88567024 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-02-16 09:10 - 2014-02-05 19:20 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware 2014-02-16 09:10 - 2014-01-30 21:25 - 00001124 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-02-15 20:27 - 2012-07-26 08:22 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-02-15 14:22 - 2014-01-11 23:03 - 00000000 ____D () C:\Users\maiko_000\AppData\Roaming\UseNeXT 2014-02-15 14:21 - 2014-01-11 23:03 - 00000000 ____D () C:\Users\maiko_000\Documents\UseNeXT 2014-02-15 14:07 - 2012-07-26 08:21 - 00033815 _____ () C:\Windows\setupact.log 2014-02-14 20:42 - 2014-02-14 20:42 - 02152960 _____ (Farbar) C:\Users\maiko_000\Desktop\FRST64.exe 2014-02-14 20:39 - 2014-02-14 20:39 - 00001736 _____ () C:\Users\maiko_000\Desktop\JRT.txt 2014-02-14 20:29 - 2014-02-14 20:29 - 00000000 ____D () C:\Windows\ERUNT 2014-02-14 20:28 - 2014-02-14 20:28 - 01037530 _____ (Thisisu) C:\Users\maiko_000\Downloads\JRT.exe 2014-02-14 20:19 - 2014-02-14 20:19 - 00000000 ____D () C:\ProgramData\boost_interprocess 2014-02-14 20:17 - 2014-01-31 22:18 - 00000000 ____D () C:\AdwCleaner 2014-02-14 20:09 - 2013-04-18 05:36 - 00000000 ____D () C:\Program Files\Common Files\mcafee 2014-02-14 20:09 - 2013-04-18 03:46 - 00339402 _____ () C:\Windows\PFRO.log 2014-02-14 20:06 - 2014-02-14 20:06 - 01166132 _____ () C:\Users\maiko_000\Desktop\adwcleaner.exe 2014-02-14 20:04 - 2014-01-30 21:25 - 00000000 ____D () C:\Users\user\AppData\Local\ext_offermosquito 2014-02-14 19:32 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\AUInstallAgent 2014-02-14 19:29 - 2014-02-14 19:29 - 00001113 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-02-14 19:29 - 2014-02-14 19:29 - 00000000 ____D () C:\Users\user\AppData\Roaming\Malwarebytes 2014-02-14 19:29 - 2014-02-14 19:29 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-02-14 19:29 - 2014-02-14 19:29 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware 2014-02-14 19:27 - 2014-02-14 19:27 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\maiko_000\Downloads\mbam-setup-1.75.0.1300.exe 2014-02-14 19:21 - 2014-02-14 19:21 - 00000000 ____D () C:\ProgramData\acer 2014-02-12 21:22 - 2014-02-12 21:22 - 00013801 _____ () C:\Users\maiko_000\Desktop\Stromkündigung 12.02.14.odt 2014-02-12 21:04 - 2014-02-12 20:34 - 00000000 ____D () C:\Qoobox 2014-02-12 21:04 - 2013-11-30 17:15 - 00000000 ___RD () C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2014-02-12 21:04 - 2013-11-30 17:15 - 00000000 ___RD () C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2014-02-12 21:03 - 2014-02-12 21:03 - 00020099 _____ () C:\ComboFix.txt 2014-02-12 21:03 - 2012-07-26 06:37 - 00000000 __RHD () C:\Users\Default 2014-02-12 21:02 - 2014-01-08 02:44 - 00000000 ___RD () C:\Users\maiko_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2014-02-12 21:01 - 2014-02-12 20:33 - 00000000 ____D () C:\Windows\erdnt 2014-02-12 21:01 - 2012-07-26 06:26 - 00000215 _____ () C:\Windows\system.ini 2014-02-12 20:39 - 2013-04-18 05:36 - 00000000 ____D () C:\ProgramData\McAfee 2014-02-12 20:39 - 2013-04-18 05:36 - 00000000 ____D () C:\Program Files\mcafee 2014-02-12 20:39 - 2012-07-26 09:12 - 00000000 ___HD () C:\Windows\ELAMBKUP 2014-02-12 20:33 - 2014-02-12 20:33 - 00001140 _____ () C:\Users\maiko_000\Desktop\ComboFix - Verknüpfung.lnk 2014-02-12 20:32 - 2014-02-12 20:33 - 05180679 ____R (Swearware) C:\Users\maiko_000\Desktop\ComboFix.exe 2014-02-10 20:54 - 2013-04-18 05:36 - 00000000 ____D () C:\Program Files (x86)\McAfee 2014-02-09 12:43 - 2014-02-09 12:43 - 00021913 _____ () C:\Users\maiko_000\Downloads\Addition.txt 2014-02-09 12:43 - 2014-02-09 12:41 - 00063927 _____ () C:\Users\maiko_000\Downloads\FRST.txt 2014-02-09 12:40 - 2014-02-09 12:40 - 02170368 _____ (Farbar) C:\Users\maiko_000\Downloads\FRST64.exe 2014-02-06 18:47 - 2014-01-08 02:44 - 00000000 ____D () C:\Users\maiko_000\AppData\Local\VirtualStore 2014-02-06 17:11 - 2014-02-05 21:06 - 00000000 ____D () C:\Users\maiko_000\AppData\Local\CrashDumps 2014-02-05 21:04 - 2014-02-05 21:04 - 00002231 _____ () C:\Users\Public\Desktop\BewerbungsGenie 7.lnk 2014-02-05 21:04 - 2014-02-05 21:04 - 00000000 ____D () C:\Users\user\AppData\Roaming\ProtectDisc 2014-02-05 21:02 - 2014-02-05 21:02 - 00000000 ____D () C:\Program Files (x86)\DATA BECKER 2014-02-05 20:00 - 2014-02-05 20:00 - 00000000 ____D () C:\Users\maiko_000\Documents\Anti-Malware 2014-02-05 19:21 - 2014-02-05 19:21 - 00001095 _____ () C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk 2014-02-05 19:20 - 2014-02-05 19:20 - 00000000 ____D () C:\Users\user\Documents\Anti-Malware 2014-02-05 18:18 - 2014-02-05 18:27 - 00000000 _____ () C:\Users\maiko_000\Desktop\mbam-setup-1.75.0.1300.exe 2014-02-05 16:55 - 2014-02-05 16:55 - 00000000 ____D () C:\Windows\pss 2014-02-05 16:53 - 2014-02-05 16:52 - 129598176 _____ () C:\Users\maiko_000\Downloads\avira_free344_antivirus_de.exe 2014-02-02 20:45 - 2014-02-02 20:45 - 00380653 _____ () C:\Users\maiko_000\Downloads\exercise-2014-2-2.gpx 2014-02-01 10:20 - 2014-02-14 19:29 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-02-01 10:19 - 2014-02-14 19:29 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-02-01 10:19 - 2014-02-14 19:29 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-02-01 10:19 - 2014-02-14 19:29 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll 2014-02-01 10:19 - 2014-02-14 19:29 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\UXInit.dll 2014-02-01 10:18 - 2014-02-14 19:29 - 19274240 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-02-01 10:18 - 2014-02-14 19:29 - 15403520 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-02-01 10:18 - 2014-02-14 19:29 - 03960320 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-02-01 10:18 - 2014-02-14 19:29 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-02-01 10:18 - 2014-02-14 19:29 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2014-02-01 10:18 - 2014-02-14 19:29 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-02-01 10:18 - 2014-02-14 19:29 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-02-01 10:18 - 2014-02-14 19:29 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2014-02-01 10:18 - 2014-02-14 19:29 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-02-01 10:18 - 2014-02-14 19:29 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-02-01 10:18 - 2014-02-14 19:29 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-02-01 08:58 - 2014-02-14 19:29 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-02-01 08:58 - 2014-02-14 19:29 - 01140736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-02-01 08:58 - 2014-02-14 19:29 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UXInit.dll 2014-02-01 08:57 - 2014-02-14 19:29 - 14359040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-02-01 08:57 - 2014-02-14 19:29 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-02-01 08:57 - 2014-02-14 19:29 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-02-01 08:57 - 2014-02-14 19:29 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-02-01 08:57 - 2014-02-14 19:29 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2014-02-01 08:57 - 2014-02-14 19:29 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-02-01 08:57 - 2014-02-14 19:29 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-02-01 08:57 - 2014-02-14 19:29 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll 2014-02-01 08:57 - 2014-02-14 19:29 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-02-01 08:57 - 2014-02-14 19:29 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-02-01 08:57 - 2014-02-14 19:29 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-02-01 08:40 - 2014-02-14 19:29 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-02-01 08:34 - 2014-02-14 19:29 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-02-01 06:08 - 2014-02-14 19:29 - 00534528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uxtheme.dll 2014-01-31 22:24 - 2014-01-31 22:24 - 00448512 _____ (OldTimer Tools) C:\Users\maiko_000\Downloads\TFC.exe 2014-01-31 22:19 - 2014-01-30 21:24 - 00000000 ____D () C:\Users\user\AppData\Roaming\Common 2014-01-31 22:16 - 2014-01-31 22:16 - 01166132 _____ () C:\Users\maiko_000\Downloads\adwcleaner.exe 2014-01-31 15:30 - 2014-01-31 15:30 - 00821760 _____ (Browser Opt-out) C:\Users\maiko_000\Downloads\uninstall(1).exe 2014-01-31 15:29 - 2014-01-31 15:29 - 00821760 _____ (Browser Opt-out) C:\Users\maiko_000\Downloads\uninstall.exe 2014-01-30 22:10 - 2014-01-11 22:00 - 00694240 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-01-30 22:10 - 2014-01-11 22:00 - 00078296 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-01-30 22:02 - 2014-01-30 21:36 - 00113664 _____ () C:\Users\maiko_000\Desktop\Spesen Januar 2014.xls 2014-01-30 21:31 - 2014-01-30 21:31 - 00565248 _____ () C:\Users\maiko_000\Downloads\reisekosten-inland-2014.xls 2014-01-30 21:25 - 2014-01-30 21:25 - 00000000 ____D () C:\Users\user\AppData\Roaming\Mozilla 2014-01-30 21:25 - 2014-01-30 21:25 - 00000000 ____D () C:\Users\user\AppData\Roaming\Fifth 2014-01-30 21:25 - 2014-01-30 21:25 - 00000000 ____D () C:\Users\user\AppData\Local\Mozilla 2014-01-30 21:25 - 2014-01-30 21:25 - 00000000 ____D () C:\Users\user\AppData\Local\Google 2014-01-30 21:25 - 2014-01-30 21:25 - 00000000 ____D () C:\Program Files (x86)\Google 2014-01-30 21:24 - 2014-01-30 21:24 - 00000759 _____ () C:\Users\user\Desktop\Reisekosten 2014 TEST.lnk 2014-01-30 21:24 - 2014-01-30 21:24 - 00000759 _____ () C:\Users\maiko_000\Desktop\Reisekosten 2014 TEST.lnk 2014-01-30 21:24 - 2014-01-30 21:24 - 00000000 ____D () C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Reisekosten 2014 TEST 2014-01-30 21:24 - 2014-01-30 21:24 - 00000000 ____D () C:\Reisekosten 2014-01-30 21:23 - 2014-01-30 21:23 - 02096296 _____ () C:\Users\user\Desktop\spesen.exe 2014-01-30 21:22 - 2014-01-30 21:22 - 00000000 ____D () C:\Users\user\AppData\Roaming\Macromedia 2014-01-26 20:21 - 2014-01-08 04:48 - 00000000 ____D () C:\Users\maiko_000\Desktop\Iomega Platte 2014-01-26 15:06 - 2014-01-26 15:06 - 13079688 _____ (Microsoft Corporation) C:\Users\maiko_000\Downloads\Silverlight_x64.exe 2014-01-26 15:06 - 2014-01-26 15:06 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2014-01-26 15:06 - 2014-01-26 15:06 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight 2014-01-26 12:39 - 2014-01-26 12:39 - 00000000 ____D () C:\Users\user\AppData\Roaming\8floor 2014-01-26 12:30 - 2014-01-26 12:28 - 00000000 ____D () C:\Program Files (x86)\WinRAR 2014-01-26 09:49 - 2014-01-26 09:49 - 00000000 ____D () C:\Users\user\AppData\Roaming\Acronis 2014-01-26 09:47 - 2014-01-26 09:47 - 01464096 _____ (Acronis International GmbH) C:\Windows\system32\Drivers\tdrpman.sys 2014-01-26 09:47 - 2014-01-26 09:47 - 01120032 _____ (Acronis International GmbH) C:\Windows\system32\Drivers\tib.sys 2014-01-26 09:47 - 2014-01-26 09:47 - 00367200 _____ (Acronis) C:\Windows\system32\Drivers\afcdp.sys 2014-01-26 09:47 - 2014-01-26 09:47 - 00198432 _____ (Acronis International GmbH) C:\Windows\system32\Drivers\tib_mounter.sys 2014-01-26 09:47 - 2014-01-26 09:47 - 00000000 ____D () C:\ProgramData\Acronis 2014-01-26 09:46 - 2014-01-26 09:46 - 00269600 _____ (Acronis International GmbH) C:\Windows\system32\Drivers\snapman.sys 2014-01-26 09:46 - 2014-01-26 09:46 - 00116000 _____ (Acronis International GmbH) C:\Windows\system32\Drivers\fltsrv.sys 2014-01-26 09:46 - 2014-01-26 09:46 - 00001205 _____ () C:\Users\Public\Desktop\Acronis True Image 2014.lnk 2014-01-26 09:46 - 2014-01-26 09:46 - 00000000 ____D () C:\Program Files (x86)\Acronis 2014-01-25 22:48 - 2014-01-25 22:48 - 00522143 _____ () C:\Users\maiko_000\Downloads\exercise-2013-12-15.gpx 2014-01-25 22:42 - 2014-01-25 22:42 - 00475008 _____ () C:\Users\maiko_000\Downloads\exercise-2014-1-19.gpx 2014-01-25 22:39 - 2014-01-25 22:39 - 00467685 _____ () C:\Users\maiko_000\Downloads\Sorpe-2014-1-17.gpx 2014-01-25 22:34 - 2014-01-25 22:34 - 00437466 _____ () C:\Users\maiko_000\Downloads\exercise-2014-1-14.gpx 2014-01-25 22:30 - 2014-01-25 22:30 - 00499004 _____ () C:\Users\maiko_000\Downloads\exercise-2014-1-3.gpx 2014-01-25 22:19 - 2014-01-25 22:19 - 00338623 _____ () C:\Users\maiko_000\Downloads\exercise-2014-1-22.gpx 2014-01-25 22:15 - 2014-01-25 22:15 - 00622051 _____ () C:\Users\maiko_000\Downloads\exercise-2014-1-25(1).gpx 2014-01-25 22:15 - 2014-01-25 22:14 - 00622051 _____ () C:\Users\maiko_000\Downloads\exercise-2014-1-25.gpx 2014-01-25 21:34 - 2014-01-12 19:17 - 00002055 _____ () C:\Users\Public\Desktop\Polar WebSync.lnk 2014-01-25 21:33 - 2014-01-25 21:32 - 43340104 _____ (Polar Electro Oy ) C:\Users\maiko_000\Downloads\websync_2.8.1(4).exe 2014-01-24 19:31 - 2014-01-24 19:29 - 00000000 ____D () C:\Users\maiko_000\Desktop\ebay-bücher 2014-01-22 06:06 - 2014-01-11 23:58 - 00000000 ____D () C:\Users\maiko_000\AppData\Roaming\vlc 2014-01-21 20:30 - 2014-01-21 20:30 - 00062888 _____ () C:\Users\maiko_000\Desktop\Unbenannt 1.odt 2014-01-20 21:07 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\system32\FxsTmp 2014-01-20 21:04 - 2014-01-20 21:01 - 00000000 ____D () C:\Users\maiko_000\Documents\Fax 2014-01-20 20:25 - 2013-07-25 11:03 - 00000000 ____D () C:\ProgramData\Norton 2014-01-20 20:24 - 2014-01-10 09:27 - 00000000 ____D () C:\Users\maiko_000\AppData\Local\clear.fi 2014-01-19 21:51 - 2014-01-19 21:51 - 00000771 _____ () C:\Users\maiko_000\Downloads\confirmation.de.ics 2014-01-19 00:21 - 2014-01-19 00:21 - 00191563 _____ () C:\Users\maiko_000\Desktop\Oschmann, Maik - Einkommensteuererklärung 2013.s14 2014-01-19 00:21 - 2014-01-19 00:21 - 00000000 ____D () C:\Users\maiko_000\Documents\Steuer-Sparbuch 2014-01-18 23:45 - 2014-01-18 18:55 - 00000000 ____D () C:\Users\maiko_000\.gimp-2.8 2014-01-18 22:52 - 2014-01-13 21:29 - 00000000 ____D () C:\Users\maiko_000\AppData\Local\Buhl 2014-01-18 18:55 - 2014-01-18 18:55 - 00000000 ____D () C:\Users\maiko_000\AppData\Local\gegl-0.2 2014-01-18 18:55 - 2014-01-08 02:44 - 00000000 ____D () C:\Users\maiko_000 2014-01-18 17:05 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\WinStore 2014-01-17 20:35 - 2014-01-17 20:35 - 43340104 _____ (Polar Electro Oy ) C:\Users\maiko_000\Downloads\websync_2.8.1(3).exe Some content of TEMP: ==================== C:\Users\user\AppData\Local\Temp\Quarantine.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ==================== End Of Log ============================ --- --- --- --- --- --- Rechner ist sehr langsam im Moment. Gestern konnte ich ihn nicht mehr runter bzw. hochfahren. War nur schwarzer Bildschirm und Standbybetrieb. Konnte dann nur komplett ausschalten. :-( |
17.02.2014, 13:21 | #21 |
/// the machine /// TB-Ausbilder | Windows 8 GVU Trojaner Den Fund von ESET bitte manuell löschen. Und FInger weg vom Usenet Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter HKU\S-1-5-21-3049176386-3505927428-341134551-1002\...\Run: [DelayShred] - C:\Users\maiko_000\Documents\UseNeXT\wizard\Taxi.Tycoon.v2.4.GERMAN-HARPOON - (1_7) - _Taxi.Ty\Taxi.Tycoon.v2.4.GERMAN-HARPOON.exe [48625620 2014-01-06] () HKU\S-1-5-21-3049176386-3505927428-341134551-1002\...\Winlogon: [Userinit] userinit.exe, [25088 2012-07-26] (Microsoft Corporation) HKU\S-1-5-21-3049176386-3505927428-341134551-1002\...\Winlogon: [Shell] explorer.exe [2391280 2013-06-01] (Microsoft Corporation) <==== ATTENTION Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
__________________ --> Windows 8 GVU Trojaner |
17.02.2014, 19:03 | #22 |
| Windows 8 GVU TrojanerCode:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 16-02-2014 Ran by maiko_000 at 2014-02-17 19:01:47 Run:1 Running from C:\Users\maiko_000\Desktop Boot Mode: Normal ============================================== Content of fixlist: ***************** HKU\S-1-5-21-3049176386-3505927428-341134551-1002\...\Run: [DelayShred] - C:\Users\maiko_000\Documents\UseNeXT\wizard\Taxi.Tycoon.v2.4.GERMAN-HARPOON - (1_7) - _Taxi.Ty\Taxi.Tycoon.v2.4.GERMAN-HARPOON.exe [48625620 2014-01-06] () HKU\S-1-5-21-3049176386-3505927428-341134551-1002\...\Winlogon: [Userinit] userinit.exe, [25088 2012-07-26] (Microsoft Corporation) HKU\S-1-5-21-3049176386-3505927428-341134551-1002\...\Winlogon: [Shell] explorer.exe [2391280 2013-06-01] (Microsoft Corporation) <==== ATTENTION ***************** HKU\S-1-5-21-3049176386-3505927428-341134551-1002\Software\Microsoft\Windows\CurrentVersion\Run\\DelayShred => Value deleted successfully. HKU\S-1-5-21-3049176386-3505927428-341134551-1002\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Userinit => Value deleted successfully. HKU\S-1-5-21-3049176386-3505927428-341134551-1002\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value deleted successfully. ==== End of Fixlog ==== |
18.02.2014, 13:04 | #23 |
/// the machine /// TB-Ausbilder | Windows 8 GVU Trojaner Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
18.02.2014, 20:30 | #24 |
| Windows 8 GVU Trojaner Ist er denn jetzt wieder sauber? Was kann ich zu Vorbeugung am besten nehmen an Software? Gruß, elcardinal1 |
19.02.2014, 16:27 | #25 |
/// the machine /// TB-Ausbilder | Windows 8 GVU Trojaner Fertig Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
Themen zu Windows 8 GVU Trojaner |
anleitung, dankbar, entferne, entfernen, gvu trojaner, laptop, leitung, neue, neuen, troja, trojane, trojaner, versuch, versucht, windows, windows 8, youtube |