| |
| |||||||
Log-Analyse und Auswertung: E-Mail Adresse laut BSI ausspioniert - PC (Win Vista SP 2) infiziert?Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
06.02.2014, 19:13
| #1 |
 |  E-Mail Adresse laut BSI ausspioniert - PC (Win Vista SP 2) infiziert? Hallo Leute, die E-Mail-Adresse einer Bekannten ist laut dem Sicherheitstest des BSI samt Passwort ausspioniert worden. Jetzt möchte sie ausschließen, dass ihr heimischer PC infiziert ist; mit dem macht sie nämlich auch Online-Banking. Ich bin mit der Frage überfragt  , deswegen: Was könnt ihr aus den Logs rauslesen? Der PC selbst zeigt keine augenfälligen Symptome, er ist für mein Empfinden nur ziemlich langsam. Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2014.02.06.06 Windows Vista Service Pack 2 x86 NTFS Internet Explorer 9.0.8112.16421 Barbara :: BARBARA-PC [Administrator] 06.02.2014 17:57:34 MBAM-log-2014-02-06 (18-06-39).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 227914 Laufzeit: 8 Minute(n), 34 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 2 C:\$Recycle.Bin\S-1-5-21-1714189465-3832410263-427834631-1000\$RKZU23L.part (PUP.Optional.Somoto) -> Keine Aktion durchgeführt. C:\$Recycle.Bin\S-1-5-21-1714189465-3832410263-427834631-1000\$RXN77DR\ism.exe (PUP.Optional.Conduit.A) -> Keine Aktion durchgeführt. (Ende) Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 05-02-2014
Ran by Barbara (administrator) on BARBARA-PC on 06-02-2014 17:15:48
Running from C:\Users\Barbara\Downloads
Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) ===================
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Nuance Communications, Inc.) C:\Program Files\Common Files\Nuance\dgnsvc.exe
(PostgreSQL Global Development Group) C:\Program Files\Haufe\PostgreSQL\bin\pg_ctl.exe
() C:\Program Files\Haufe\iDesk\iDeskService\ideskservice.exe
(PostgreSQL Global Development Group) C:\Program Files\Haufe\PostgreSQL\bin\postgres.exe
(Sonic Solutions) C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
(Haufe Mediengruppe) C:\Program Files\Haufe\iDesk\iDeskService\ideskpython.exe
(PostgreSQL Global Development Group) C:\Program Files\Haufe\PostgreSQL\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files\Haufe\PostgreSQL\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files\Haufe\PostgreSQL\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files\Haufe\PostgreSQL\bin\postgres.exe
(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Acresso Corporation) C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Sonic Solutions) C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-18] (Microsoft Corporation)
HKLM\...\Run: [RtHDVCpl] - C:\Windows\RtHDVCpl.exe [4390912 2007-03-15] (Realtek Semiconductor)
HKLM\...\Run: [] - [X]
HKLM\...\Run: [NvSvc] - C:\Windows\system32\nvsvc.dll [86016 2007-05-28] (NVIDIA Corporation)
HKLM\...\Run: [NvCplDaemon] - C:\Windows\system32\NvCpl.dll [8429568 2007-05-28] (NVIDIA Corporation)
HKLM\...\Run: [NvMediaCenter] - C:\Windows\system32\NvMcTray.dll [81920 2007-05-28] (NVIDIA Corporation)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [684600 2014-01-11] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-1714189465-3832410263-427834631-1000\...\Run: [WMPNSCFG] - C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-18] (Microsoft Corporation)
HKU\S-1-5-21-1714189465-3832410263-427834631-1000\...\Run: [ISUSPM] - C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [222496 2010-07-29] (Acresso Corporation)
HKU\S-1-5-21-1714189465-3832410263-427834631-1000\...\MountPoints2: {511f30a5-5fc7-11dc-9464-001aa04c758e} - N:\LaunchU3.exe
AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL => C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll [123392 2009-12-10] (Google)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ig/dell?hl=de&client=dell-row&channel=de&ibd=0070728
HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://support.euro.dell.com/support/index.aspx?c=de&l=de&s=gen
SearchScopes: HKCU - {70D46D94-BF1E-45ED-B567-48701376298E} URL = hxxp://127.0.0.1:4664/search&s=khMv4O1ewPCRT5q12VA4xmBoIQY?q={searchTerms}
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll (Google Germany GmbH)
BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll (Dell Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (Google Germany GmbH)
Toolbar: HKCU - &Google - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (Google Germany GmbH)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
Handler: haufereader - No CLSID Value -
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Winsock: Catalog5 05 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Winsock: Catalog9 01 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 02 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 03 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 04 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 05 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 06 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 07 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 08 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 19 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [257608] (Avira Operations GmbH & Co. KG)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Barbara\AppData\Roaming\Mozilla\Firefox\Profiles\d7hrt2pz.default
FF user.js: detected! => C:\Users\Barbara\AppData\Roaming\Mozilla\Firefox\Profiles\d7hrt2pz.default\user.js
FF Homepage: www.google.de
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_44.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @canon.com/EPPEX - C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NPOFFICE.DLL (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: German Dictionary - C:\Users\Barbara\AppData\Roaming\Mozilla\Firefox\Profiles\d7hrt2pz.default\Extensions\de-DE@dictionaries.addons.mozilla.org [2012-10-14]
FF Extension: Microsoft .NET Framework Assistant - C:\Users\Barbara\AppData\Roaming\Mozilla\Firefox\Profiles\d7hrt2pz.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-05-03]
FF Extension: Adblock Plus - C:\Users\Barbara\AppData\Roaming\Mozilla\Firefox\Profiles\d7hrt2pz.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011-06-05]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []
========================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440376 2014-01-11] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440376 2014-01-11] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1011768 2014-01-11] (Avira Operations GmbH & Co. KG)
R2 DragonSvc; C:\Program Files\Common Files\Nuance\dgnsvc.exe [296808 2010-07-29] (Nuance Communications, Inc.)
S3 DSBrokerService; C:\Program Files\DellSupport\brkrsvc.exe [70656 2007-03-19] ()
S3 GoogleDesktopManager-110309-193829; C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [30192 2009-12-10] (Google)
R2 Haufe PostgreSQL; C:\Program Files\Haufe\PostgreSQL\bin\pg_ctl.exe [70384 2009-09-08] (PostgreSQL Global Development Group)
R2 HRService; C:\Program Files\Haufe\iDesk\iDeskService\iDeskService.exe [71024 2011-04-07] ()
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2014-01-11] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135648 2014-01-11] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2014-01-11] (Avira Operations GmbH & Co. KG)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2014-01-11] (Avira GmbH)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-02-06 16:42 - 2014-02-06 16:42 - 00380416 _____ () C:\Users\Barbara\Downloads\Gmer-19357.exe
2014-02-06 16:27 - 2014-02-06 17:15 - 00012760 _____ () C:\Users\Barbara\Downloads\FRST.txt
2014-02-06 16:27 - 2014-02-06 17:15 - 00000000 ____D () C:\FRST
2014-02-06 16:26 - 2014-02-06 16:26 - 01139200 _____ (Farbar) C:\Users\Barbara\Downloads\FRST(1).exe
2014-02-06 16:26 - 2014-02-06 16:26 - 00000000 ____D () C:\ProgramData\Oracle
2014-02-06 16:23 - 2014-02-06 16:23 - 01139200 _____ (Farbar) C:\Users\Barbara\Downloads\FRST.exe
2014-02-06 16:22 - 2014-02-06 16:22 - 00000000 _____ () C:\Users\Barbara\defogger_reenable
2014-02-06 16:21 - 2014-02-06 16:21 - 00050477 _____ () C:\Users\Barbara\Downloads\Defogger.exe
2014-02-06 16:20 - 2014-02-06 16:20 - 00000000 ____D () C:\ProgramData\Sun
2014-02-06 16:20 - 2014-02-06 16:18 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-02-06 16:19 - 2014-02-06 16:19 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-02-06 16:19 - 2014-02-06 16:18 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-02-06 16:19 - 2014-02-06 16:18 - 00174504 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-02-06 16:14 - 2014-02-06 16:17 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-02-06 16:02 - 2014-02-06 16:03 - 00614784 _____ (Chip Digital GmbH) C:\Users\Barbara\Downloads\HijackThis - CHIP-Downloader.exe
2014-01-22 19:24 - 2014-01-22 19:24 - 00001666 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-01-22 19:23 - 2014-01-22 19:24 - 00000000 ____D () C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2014-01-22 19:23 - 2014-01-22 19:24 - 00000000 ____D () C:\Program Files\iTunes
2014-01-22 19:23 - 2014-01-22 19:23 - 00000000 ____D () C:\Program Files\iPod
2014-01-22 19:14 - 2014-01-22 19:14 - 00001728 _____ () C:\Users\Public\Desktop\QuickTime Player.lnk
2014-01-22 19:13 - 2014-01-22 19:14 - 00000000 ____D () C:\Program Files\QuickTime
2014-01-12 10:27 - 2014-01-12 10:27 - 00000000 ____D () C:\Users\Barbara\AppData\Roaming\Avira
2014-01-12 10:20 - 2014-01-12 10:20 - 00001849 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-01-12 10:20 - 2014-01-11 11:31 - 00135648 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-01-12 10:20 - 2014-01-11 11:31 - 00090400 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-01-12 10:20 - 2014-01-11 11:31 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2014-01-12 10:18 - 2014-01-12 10:20 - 00000000 ____D () C:\ProgramData\Avira
2014-01-12 10:18 - 2014-01-12 10:18 - 00000000 ____D () C:\Program Files\Avira
2014-01-11 13:12 - 2014-01-26 15:17 - 00000000 ____D () C:\Windows\system32\MRT
2014-01-11 13:10 - 2013-11-15 00:13 - 12344320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-01-11 13:10 - 2013-11-14 23:50 - 09739264 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-01-11 13:10 - 2013-11-14 23:50 - 01806848 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-01-11 13:10 - 2013-11-14 23:43 - 01105408 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-01-11 13:10 - 2013-11-14 23:42 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-01-11 13:10 - 2013-11-14 23:42 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-01-11 13:10 - 2013-11-14 23:41 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-01-11 13:10 - 2013-11-14 23:40 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-01-11 13:10 - 2013-11-14 23:38 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-01-11 13:10 - 2013-11-14 23:38 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-01-11 13:10 - 2013-11-14 23:38 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-01-11 13:10 - 2013-11-14 23:37 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-01-11 13:10 - 2013-11-14 23:36 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-01-11 13:10 - 2013-11-14 23:36 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-01-11 13:10 - 2013-11-14 23:35 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-01-11 13:10 - 2013-11-14 23:32 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-01-11 10:28 - 2013-10-30 03:12 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\SysFxUI.dll
2014-01-11 10:28 - 2013-10-30 02:43 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys
2014-01-11 10:28 - 2013-10-30 01:43 - 00167936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2014-01-11 10:28 - 2013-10-30 01:35 - 02050560 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-11 10:28 - 2013-10-22 08:19 - 00158208 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2014-01-11 10:28 - 2013-10-11 03:08 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2014-01-11 10:28 - 2013-10-11 03:08 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2014-01-11 10:28 - 2013-10-11 03:08 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wshcon.dll
2014-01-11 10:28 - 2013-10-11 01:35 - 00155648 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2014-01-11 10:28 - 2013-10-11 01:35 - 00135168 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
==================== One Month Modified Files and Folders =======
2014-02-06 17:15 - 2014-02-06 16:27 - 00012760 _____ () C:\Users\Barbara\Downloads\FRST.txt
2014-02-06 17:15 - 2014-02-06 16:27 - 00000000 ____D () C:\FRST
2014-02-06 17:15 - 2007-07-27 22:09 - 01505090 _____ () C:\Windows\WindowsUpdate.log
2014-02-06 17:11 - 2012-09-28 18:09 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-06 17:11 - 2012-05-05 11:58 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-02-06 17:11 - 2009-09-08 20:15 - 00000000 ____D () C:\Program Files\Spybot - Search & Destroy
2014-02-06 17:11 - 2007-07-31 14:05 - 00105450 _____ () C:\Windows\PFRO.log
2014-02-06 17:11 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-06 17:11 - 2006-11-02 13:47 - 00003568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-06 17:11 - 2006-11-02 13:47 - 00003568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-06 17:09 - 2009-09-08 20:15 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-02-06 17:09 - 2006-11-02 14:01 - 00032510 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-02-06 16:58 - 2009-12-29 18:50 - 00000000 ____D () C:\Windows\pss
2014-02-06 16:57 - 2012-05-25 10:11 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-02-06 16:57 - 2011-07-28 11:07 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-02-06 16:42 - 2014-02-06 16:42 - 00380416 _____ () C:\Users\Barbara\Downloads\Gmer-19357.exe
2014-02-06 16:34 - 2013-07-02 19:39 - 00000000 ____D () C:\Program Files\MyPC Backup
2014-02-06 16:26 - 2014-02-06 16:26 - 01139200 _____ (Farbar) C:\Users\Barbara\Downloads\FRST(1).exe
2014-02-06 16:26 - 2014-02-06 16:26 - 00000000 ____D () C:\ProgramData\Oracle
2014-02-06 16:23 - 2014-02-06 16:23 - 01139200 _____ (Farbar) C:\Users\Barbara\Downloads\FRST.exe
2014-02-06 16:22 - 2014-02-06 16:22 - 00000000 _____ () C:\Users\Barbara\defogger_reenable
2014-02-06 16:22 - 2007-07-31 14:13 - 00000000 ____D () C:\Users\Barbara
2014-02-06 16:21 - 2014-02-06 16:21 - 00050477 _____ () C:\Users\Barbara\Downloads\Defogger.exe
2014-02-06 16:20 - 2014-02-06 16:20 - 00000000 ____D () C:\ProgramData\Sun
2014-02-06 16:20 - 2007-07-27 22:21 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-02-06 16:19 - 2014-02-06 16:19 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-02-06 16:18 - 2014-02-06 16:20 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-02-06 16:18 - 2014-02-06 16:19 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-02-06 16:18 - 2014-02-06 16:19 - 00174504 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-02-06 16:18 - 2007-07-27 22:21 - 00000000 ____D () C:\Program Files\Java
2014-02-06 16:17 - 2014-02-06 16:14 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-02-06 16:04 - 2012-11-26 16:24 - 00000000 ___RD () C:\Users\Barbara\Dropbox
2014-02-06 16:04 - 2012-11-26 16:18 - 00000000 ____D () C:\Users\Barbara\AppData\Roaming\Dropbox
2014-02-06 16:03 - 2014-02-06 16:02 - 00614784 _____ (Chip Digital GmbH) C:\Users\Barbara\Downloads\HijackThis - CHIP-Downloader.exe
2014-02-02 11:11 - 2011-03-02 17:14 - 00000000 ____D () C:\Users\Barbara\Desktop\beihilfe-anträge
2014-02-01 10:30 - 2006-11-02 11:33 - 01418612 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-01 10:29 - 2006-11-02 13:52 - 00093574 _____ () C:\Windows\setupact.log
2014-01-26 15:17 - 2014-01-11 13:12 - 00000000 ____D () C:\Windows\system32\MRT
2014-01-26 15:15 - 2006-11-02 11:24 - 83425928 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-01-22 19:24 - 2014-01-22 19:24 - 00001666 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-01-22 19:24 - 2014-01-22 19:23 - 00000000 ____D () C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2014-01-22 19:24 - 2014-01-22 19:23 - 00000000 ____D () C:\Program Files\iTunes
2014-01-22 19:23 - 2014-01-22 19:23 - 00000000 ____D () C:\Program Files\iPod
2014-01-22 19:23 - 2009-11-09 17:38 - 00000000 ____D () C:\Program Files\Common Files\Apple
2014-01-22 19:14 - 2014-01-22 19:14 - 00001728 _____ () C:\Users\Public\Desktop\QuickTime Player.lnk
2014-01-22 19:14 - 2014-01-22 19:13 - 00000000 ____D () C:\Program Files\QuickTime
2014-01-19 17:35 - 2012-11-26 16:18 - 00000000 ____D () C:\Users\Barbara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-01-12 18:13 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-01-12 10:36 - 2007-08-10 14:15 - 00002637 _____ () C:\Users\Barbara\Desktop\Microsoft Office Word 2003.lnk
2014-01-12 10:32 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\rescache
2014-01-12 10:27 - 2014-01-12 10:27 - 00000000 ____D () C:\Users\Barbara\AppData\Roaming\Avira
2014-01-12 10:20 - 2014-01-12 10:20 - 00001849 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-01-12 10:20 - 2014-01-12 10:18 - 00000000 ____D () C:\ProgramData\Avira
2014-01-12 10:18 - 2014-01-12 10:18 - 00000000 ____D () C:\Program Files\Avira
2014-01-12 10:15 - 2006-11-02 13:47 - 00330888 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-01-12 10:12 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\de-DE
2014-01-12 10:11 - 2007-07-27 22:09 - 00000000 ____D () C:\Windows\system32\RTCOM
2014-01-11 11:31 - 2014-01-12 10:20 - 00135648 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-01-11 11:31 - 2014-01-12 10:20 - 00090400 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-01-11 11:31 - 2014-01-12 10:20 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2014-01-11 11:31 - 2007-07-31 14:25 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
Some content of TEMP:
====================
C:\Users\Barbara\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-02-06 16:10
==================== End Of Log ============================
FRST Addition Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 05-02-2014
Ran by Barbara at 2014-02-06 17:16:05
Running from C:\Users\Barbara\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Disabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Disabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
Adobe Flash Player 12 Plugin (Version: 12.0.0.44 - Adobe Systems Incorporated)
Adobe Flash Player 9 ActiveX (Version: 9.0.124.0 - Adobe Systems Incorporated)
Adobe Flash Player ActiveX (Version: 9.0.124.0 - Adobe Systems Incorporated)
Adobe Reader 9.5.2 - Deutsch (Version: 9.5.2 - Adobe Systems Incorporated)
Apple Application Support (Version: 2.3.6 - Apple Inc.)
Apple Mobile Device Support (Version: 7.0.0.117 - Apple Inc.)
Apple Software Update (Version: 2.1.3.127 - Apple Inc.)
Assistant zum Anpassen des Dell-Systems (Version: 1.00.0000 - Dell Inc.)
Avira Free Antivirus (Version: 14.0.2.286 - Avira)
Benutzerhandbuch (Version: - )
Bonjour (Version: 3.0.0.10 - Apple Inc.)
Canon MP Navigator 3.0 (Version: - )
Canon MP Navigator EX 3.0 (Version: - )
Canon MP510 Benutzerregistrierung (Version: - )
Canon MP550 series Benutzerregistrierung (Version: - )
Canon MP550 series MP Drivers (Version: - )
Canon Utilities Easy-PhotoPrint EX (Version: - )
Canon Utilities My Printer (Version: - )
Compatibility Pack für 2007 Office System (Version: 12.0.6514.5001 - Microsoft Corporation)
Dell Support Center (Version: 1.0.07131 - Dell)
DellSupport (Version: 6.0.3075 - Dell)
Dragon NaturallySpeaking 11 (Version: 11.50.100 - Nuance Communications Inc.)
Dropbox (HKCU Version: 2.4.11 - Dropbox, Inc.)
Free YouTube to Mp3 Converter version 3.1 (Version: - DVD Video Soft Limited.)
Google Desktop (Version: 5.9.0911.03589 - Google)
Google Toolbar for Internet Explorer (Version: - )
Google Toolbar for Internet Explorer (Version: 4.0.0.002 - Google Inc.) Hidden
Haufe Formular-Manager (Version: 11.01.03.0001 - Haufe-Lexware GmbH & Co. KG)
Haufe iDesk-Browser (Version: 10.10.14.0000 - Haufe-Lexware GmbH & Co. KG)
Haufe iDesk-Service (Version: 11.04.07.7939 - Haufe)
Haufe Personal Office Premium (Version: 3.3.0.0 - Haufe-Lexware GmbH & Co. KG)
Haufe PostgreSQL (Version: 2.2.2 - Haufe Mediengruppe)
HijackThis 2.0.2 (Version: 2.0.2 - TrendMicro)
iTunes (Version: 11.1.3.8 - Apple Inc.)
Java 7 Update 51 (Version: 7.0.510 - Oracle)
Java Auto Updater (Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Java(TM) 6 Update 7 (Version: 1.6.0.70 - Sun Microsystems, Inc.)
Java(TM) SE Runtime Environment 6 (Version: 1.6.0.0 - Sun Microsystems, Inc.)
Kalender-Excel-8.7.1 (Version: 8.7.1 - MSDatec)
Microsoft .NET Framework 3.5 SP1 (Version: - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft Office Basic Edition 2003 (Version: 11.0.5614.0 - Microsoft Corporation)
Microsoft Silverlight (Version: 5.1.20125.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works (Version: 08.05.0822 - Microsoft Corporation)
Mozilla Firefox 27.0 (x86 de) (Version: 27.0 - Mozilla)
Mozilla Maintenance Service (Version: 27.0 - Mozilla)
Mozilla Thunderbird (2.0.0.6) (Version: 2.0.0.6 (de) - Mozilla)
msvc80 (Version: 1.00.0000 - Haufe Mediengruppe) Hidden
MSXML 4.0 SP2 (KB927978) (Version: 4.20.9841.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB936181) (Version: 4.20.9848.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0 - Microsoft Corporation)
NVIDIA Drivers (Version: - )
NVIDIANetworkDiagnostic (Version: 1.00.0000 - NVIDIA Corporation)
NVIDIANetworkDiagnostic (Version: 1.00.0000 - NVIDIA Corporation) Hidden
OpenOffice.org 2.2 (Version: 2.2.9161 - OpenOffice.org)
QuickTime (Version: 7.74.80.86 - Apple Inc.)
Realtek High Definition Audio Driver (Version: - )
Roxio Creator Audio (Version: 3.3.0 - Roxio)
Roxio Creator BDAV Plugin (Version: 3.3.0 - Roxio)
Roxio Creator Copy (Version: 3.3.0 - Roxio)
Roxio Creator Data (Version: 3.3.0 - Roxio)
Roxio Creator DE (Version: 3.3.0 - Roxio)
Roxio Creator Tools (Version: 3.3.0 - Roxio)
Roxio Express Labeler (Version: 2.1.0 - Roxio)
Roxio MyDVD DE (Version: 9.0.116 - Roxio, Inc.)
Roxio Update Manager (Version: 3.0.0 - Roxio)
ScanSoft OmniPage SE 4.0 (Version: 15.00.0020 - Nuance Communications, Inc.)
Sonic Activation Module (Version: 1.0 - Sonic Solutions) Hidden
Uninstall 1.0.0.1 (Version: - )
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1 - Microsoft Corporation)
URL Assistant (Version: - )
Virtua Tennis 3 (Version: 1.00.0000 - Sega)
Visual C++ 9.0 Runtime for Dragon NaturallySpeaking (Version: 11.0.0 - Nuance Communications Inc.)
Vuze (Version: 5.0.0.0 - Azureus Software, Inc.)
Windows Media Player Firefox Plugin (Version: 1.0.0.8 - Microsoft Corp)
==================== Restore Points =========================
29-07-2013 16:46:28 Geplanter Prüfpunkt
11-08-2013 13:16:13 Geplanter Prüfpunkt
12-08-2013 15:33:01 Geplanter Prüfpunkt
16-09-2013 15:17:25 Geplanter Prüfpunkt
17-09-2013 05:29:59 Geplanter Prüfpunkt
18-10-2013 15:41:19 Geplanter Prüfpunkt
06-12-2013 09:32:53 Geplanter Prüfpunkt
11-01-2014 11:25:33 Geplanter Prüfpunkt
11-01-2014 12:09:23 Windows Update
22-01-2014 18:18:30 Gerätetreiber-Paketinstallation: Apple Netzwerkadapter
26-01-2014 14:14:35 Windows Update
06-02-2014 15:16:37 Removed Java(TM) 6 Update 21
06-02-2014 15:18:32 Installed Java 7 Update 51
==================== Hosts content: ==========================
2006-11-02 11:23 - 2009-09-08 20:29 - 00327720 ____R C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
127.0.0.1 www.1-2005-search.com
127.0.0.1 1-2005-search.com
127.0.0.1 123haustiereundmehr.com
127.0.0.1 www.123haustiereundmehr.com
127.0.0.1 www.123moviedownload.com
127.0.0.1 123moviedownload.com
There are 1000 more lines.
==================== Scheduled Tasks (whitelisted) =============
Task: {0D17A91D-1C6F-49F8-A406-B69C07B9FA7C} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {1A783B71-E4C8-4CDF-A1E4-138BBE706D95} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {43127D50-5CED-47E7-A0BB-EAAD2D309675} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-02-06] (Adobe Systems Incorporated)
Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-18] (Microsoft Corporation)
Task: {A728AE6B-5AB8-4223-AD3E-E6341441A01C} - System32\Tasks\Microsoft\Windows\PLA\System\ConvertLogEntries => Rundll32.exe %windir%\system32\pla.dll,PlaConvertLogEntries
Task: {B5764D1B-0FFC-4B92-A17C-2228736341A4} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2006-11-02] (Microsoft Corporation)
Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-05] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) =============
2014-01-12 10:20 - 2014-01-11 11:31 - 00394808 _____ () C:\Program Files\Avira\AntiVir Desktop\sqlite3.dll
2011-09-27 06:23 - 2011-09-27 06:23 - 00087912 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2011-09-27 06:22 - 2011-09-27 06:22 - 01242472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2009-09-08 15:38 - 2009-09-08 15:38 - 00172776 _____ () C:\Program Files\Haufe\PostgreSQL\bin\LIBPQ.dll
2011-04-07 03:50 - 2011-04-07 03:50 - 00103792 _____ () C:\Program Files\Haufe\iDesk\iDeskService\pywintypes24.dll
2011-04-07 03:44 - 2011-04-07 03:44 - 00071024 _____ () C:\Program Files\Haufe\iDesk\iDeskService\DLLs\zlib.pyd
2011-04-07 03:50 - 2011-04-07 03:50 - 00032112 _____ () C:\Program Files\Haufe\iDesk\iDeskService\Lib\site-packages\win32\win32process.pyd
2011-04-07 03:50 - 2011-04-07 03:50 - 00019312 _____ () C:\Program Files\Haufe\iDesk\iDeskService\Lib\site-packages\win32\win32event.pyd
2011-04-07 03:44 - 2011-04-07 03:44 - 00054640 _____ () C:\Program Files\Haufe\iDesk\iDeskService\DLLs\_socket.pyd
2011-04-07 03:44 - 2011-04-07 03:44 - 00017264 _____ () C:\Program Files\Haufe\iDesk\iDeskService\DLLs\_ssl.pyd
2011-04-07 03:38 - 2011-04-07 03:38 - 00832880 _____ () C:\Program Files\Haufe\iDesk\iDeskService\DLLs\LIBEAY32.dll
2011-04-07 03:38 - 2011-04-07 03:38 - 00161136 _____ () C:\Program Files\Haufe\iDesk\iDeskService\DLLs\SSLEAY32.dll
2011-04-07 03:50 - 2011-04-07 03:50 - 00075120 _____ () C:\Program Files\Haufe\iDesk\iDeskService\Lib\site-packages\win32\win32api.pyd
2011-04-07 03:50 - 2011-04-07 03:50 - 00019312 _____ () C:\Program Files\Haufe\iDesk\iDeskService\Lib\site-packages\win32\win32evtlog.pyd
2011-04-07 03:50 - 2011-04-07 03:50 - 00029552 _____ () C:\Program Files\Haufe\iDesk\iDeskService\Lib\site-packages\win32\servicemanager.pyd
2011-04-07 03:50 - 2011-04-07 03:50 - 00083312 _____ () C:\Program Files\Haufe\iDesk\iDeskService\Lib\site-packages\win32\win32file.pyd
2011-04-07 03:50 - 2011-04-07 03:50 - 00021360 _____ () C:\Program Files\Haufe\iDesk\iDeskService\Lib\site-packages\win32\win32pipe.pyd
2011-04-07 03:50 - 2011-04-07 03:50 - 00107888 _____ () C:\Program Files\Haufe\iDesk\iDeskService\Lib\site-packages\win32\win32security.pyd
2011-04-07 03:50 - 2011-04-07 03:50 - 00037744 _____ () C:\Program Files\Haufe\iDesk\iDeskService\Lib\site-packages\win32\win32service.pyd
2009-09-08 15:38 - 2009-09-08 15:38 - 00968432 _____ () C:\Program Files\Haufe\PostgreSQL\bin\libxml2.dll
2009-09-08 15:39 - 2009-09-08 15:39 - 00064744 _____ () C:\Program Files\Haufe\PostgreSQL\bin\zlib1.dll
2006-11-05 10:28 - 2006-11-05 10:28 - 04587520 ____R () C:\Program Files\Common Files\Roxio Shared\9.0\DLLShared\ROXIPP41.dll
2011-04-07 04:30 - 2011-04-07 04:30 - 00021360 _____ () C:\Program Files\Haufe\iDesk\iDeskService\Zope\lib\python\persistent.cPersistence.pyd
2011-04-07 04:30 - 2011-04-07 04:30 - 00014192 _____ () C:\Program Files\Haufe\iDesk\iDeskService\Zope\lib\python\persistent.TimeStamp.pyd
2011-04-07 04:30 - 2011-04-07 04:30 - 00020848 _____ () C:\Program Files\Haufe\iDesk\iDeskService\Zope\lib\python\persistent.cPickleCache.pyd
2011-04-07 04:30 - 2011-04-07 04:30 - 00026480 _____ () C:\Program Files\Haufe\iDesk\iDeskService\Zope\lib\python\Acquisition._Acquisition.pyd
2011-04-07 04:30 - 2011-04-07 04:30 - 00020848 _____ () C:\Program Files\Haufe\iDesk\iDeskService\Zope\lib\python\ExtensionClass._ExtensionClass.pyd
2011-04-07 04:30 - 2011-04-07 04:30 - 00010608 _____ () C:\Program Files\Haufe\iDesk\iDeskService\Zope\lib\python\ComputedAttribute._ComputedAttribute.pyd
2011-04-07 04:30 - 2011-04-07 04:30 - 00026992 _____ () C:\Program Files\Haufe\iDesk\iDeskService\Zope\lib\python\AccessControl.cAccessControl.pyd
2011-04-07 04:31 - 2011-04-07 04:31 - 00013168 _____ () C:\Program Files\Haufe\iDesk\iDeskService\Zope\lib\python\Record._Record.pyd
2011-04-07 04:30 - 2011-04-07 04:30 - 00020336 _____ () C:\Program Files\Haufe\iDesk\iDeskService\Zope\lib\python\DocumentTemplate.cDocumentTemplate.pyd
2011-04-07 03:44 - 2011-04-07 03:44 - 00140656 _____ () C:\Program Files\Haufe\iDesk\iDeskService\DLLs\pyexpat.pyd
2011-04-07 04:30 - 2011-04-07 04:30 - 00058736 _____ () C:\Program Files\Haufe\iDesk\iDeskService\Zope\lib\python\BTrees._OOBTree.pyd
2011-04-07 04:30 - 2011-04-07 04:30 - 00062832 _____ () C:\Program Files\Haufe\iDesk\iDeskService\Zope\lib\python\BTrees._OIBTree.pyd
2011-04-07 04:30 - 2011-04-07 04:30 - 00062832 _____ () C:\Program Files\Haufe\iDesk\iDeskService\Zope\lib\python\BTrees._IOBTree.pyd
2011-04-07 04:30 - 2011-04-07 04:30 - 00062832 _____ () C:\Program Files\Haufe\iDesk\iDeskService\Zope\lib\python\BTrees._IIBTree.pyd
2011-04-07 04:30 - 2011-04-07 04:30 - 00011120 _____ () C:\Program Files\Haufe\iDesk\iDeskService\Zope\lib\python\Persistence._Persistence.pyd
2011-04-07 04:30 - 2011-04-07 04:30 - 00010096 _____ () C:\Program Files\Haufe\iDesk\iDeskService\Zope\lib\python\MethodObject._MethodObject.pyd
2011-04-07 04:30 - 2011-04-07 04:30 - 00011120 _____ () C:\Program Files\Haufe\iDesk\iDeskService\Zope\lib\python\Missing._Missing.pyd
2011-04-07 04:30 - 2011-04-07 04:30 - 00011632 _____ () C:\Program Files\Haufe\iDesk\iDeskService\Zope\lib\python\MultiMapping._MultiMapping.pyd
2011-04-07 03:44 - 2011-04-07 03:44 - 00013680 _____ () C:\Program Files\Haufe\iDesk\iDeskService\DLLs\select.pyd
2011-04-07 04:31 - 2011-04-07 04:31 - 00010096 _____ () C:\Program Files\Haufe\iDesk\iDeskService\Zope\lib\python\ZODB.winlock.pyd
2011-04-07 04:31 - 2011-04-07 04:31 - 00010096 _____ () C:\Program Files\Haufe\iDesk\iDeskService\Zope\lib\python\Products.ZCTextIndex.stopper.pyd
2011-04-07 04:31 - 2011-04-07 04:31 - 00010096 _____ () C:\Program Files\Haufe\iDesk\iDeskService\Zope\lib\python\Products.ZCTextIndex.okascore.pyd
2011-04-07 04:31 - 2011-04-07 04:31 - 00341360 _____ () C:\Program Files\Haufe\iDesk\iDeskService\Zope\lib\python\_jpype.pyd
2011-04-07 04:31 - 2011-04-07 04:31 - 00013168 _____ () C:\Program Files\Haufe\iDesk\iDeskService\Zope\lib\python\TextIndexNG2\normalizer.pyd
2011-04-07 04:31 - 2011-04-07 04:31 - 00012656 _____ () C:\Program Files\Haufe\iDesk\iDeskService\Zope\lib\python\TextIndexNG2\indexsupport.pyd
2010-10-14 05:38 - 2010-10-14 05:38 - 00583168 _____ () C:\Program Files\Haufe\iDesk\iDeskService\OSR32V10.dll
2011-04-07 04:30 - 2011-04-07 04:30 - 00062832 _____ () C:\Program Files\Haufe\iDesk\iDeskService\Zope\lib\python\BTrees._fsBTree.pyd
2011-04-07 04:30 - 2011-04-07 04:30 - 00271728 _____ () C:\Program Files\Haufe\iDesk\iDeskService\Zope\lib\python\M2Crypto.__m2crypto.pyd
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\ProgramData\TEMP:0FF263E8
==================== Safe Mode (whitelisted) ===================
==================== Faulty Device Manager Devices =============
Name: NVIDIA nForce Networking Controller
Description: NVIDIA nForce Networking Controller
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: NVIDIA
Service: NVENETFD
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (02/06/2014 04:50:56 PM) (Source: Perflib) (User: )
Description: EmdCacheC:\Windows\system32\emdmgmt.dll4
Error: (02/02/2014 11:20:00 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 1077
Error: (02/02/2014 11:20:00 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 1077
Error: (02/02/2014 11:20:00 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (02/02/2014 11:18:15 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 6910
Error: (02/02/2014 11:18:15 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 6910
Error: (02/02/2014 11:18:15 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (01/22/2014 07:30:32 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 5475
Error: (01/22/2014 07:30:32 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 5475
Error: (01/22/2014 07:30:32 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
System errors:
=============
Error: (02/06/2014 05:12:51 PM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058
Error: (02/06/2014 04:34:24 PM) (Source: Service Control Manager) (User: )
Description: Computer Backup (MyPC Backup)1
Error: (02/06/2014 04:03:15 PM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058
Error: (02/02/2014 10:23:49 AM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058
Error: (02/01/2014 10:24:38 AM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058
Error: (01/28/2014 05:11:29 PM) (Source: Service Control Manager) (User: )
Description: Avira Echtzeit-Scanner
Error: (01/28/2014 05:15:46 PM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058
Error: (01/26/2014 02:48:53 PM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058
Error: (01/25/2014 10:23:06 AM) (Source: Service Control Manager) (User: )
Description: Windows-Dienst für Schriftartencache%%1053
Error: (01/25/2014 10:23:06 AM) (Source: Service Control Manager) (User: )
Description: 30000Windows-Dienst für Schriftartencache
Microsoft Office Sessions:
=========================
Error: (02/06/2014 04:50:56 PM) (Source: Perflib)(User: )
Description: EmdCacheC:\Windows\system32\emdmgmt.dll4
Error: (02/02/2014 11:20:00 AM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 1077
Error: (02/02/2014 11:20:00 AM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledEvent 1077
Error: (02/02/2014 11:20:00 AM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (02/02/2014 11:18:15 AM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 6910
Error: (02/02/2014 11:18:15 AM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledEvent 6910
Error: (02/02/2014 11:18:15 AM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (01/22/2014 07:30:32 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 5475
Error: (01/22/2014 07:30:32 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledEvent 5475
Error: (01/22/2014 07:30:32 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: Continuously busy for more than a second
CodeIntegrity Errors:
===================================
Date: 2012-09-28 18:38:57.601
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2012-09-28 18:38:57.460
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2012-09-28 18:38:57.320
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2012-09-28 18:38:57.180
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2012-09-28 18:38:57.024
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-08-05 18:56:06.181
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-08-05 18:56:06.058
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-08-05 18:56:05.934
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-08-05 18:56:05.810
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-08-05 18:56:05.687
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Percentage of memory in use: 47%
Total physical RAM: 2045.76 MB
Available physical RAM: 1067.42 MB
Total Pagefile: 4333.57 MB
Available Pagefile: 2975.24 MB
Total Virtual: 2047.88 MB
Available Virtual: 1909.07 MB
==================== Drives ================================
Drive c: (OS) (Fixed) (Total:222.78 GB) (Free:131.88 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (DATAPART1) (Fixed) (Total:232.83 GB) (Free:232.43 GB) NTFS
Drive e: (RECOVERY) (Fixed) (Total:10 GB) (Free:6.37 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 233 GB) (Disk ID: 50000000)
Partition 1: (Not Active) - (Size=55 MB) - (Type=DE)
Partition 2: (Not Active) - (Size=10 GB) - (Type=07 NTFS)
Partition 3: (Active) - (Size=223 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows 7 or Vista) (Size: 233 GB) (Disk ID: 9FD77D98)
Partition 1: (Not Active) - (Size=233 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-02-06 17:33:10
Windows 6.0.6002 Service Pack 2 \Device\Harddisk0\DR0 -> \Device\0000004c ST325082 rev.3.AD 232,83GB
Running: Gmer-19357.exe; Driver: C:\Users\Barbara\AppData\Local\Temp\ufliyfog.sys
---- System - GMER 2.1 ----
SSDT 8A254E3E ZwCreateSection
SSDT 8A254E48 ZwRequestWaitReplyPort
SSDT 8A254E43 ZwSetContextThread
SSDT 8A254E4D ZwSetSecurityObject
SSDT 8A254E52 ZwSystemDebugControl
SSDT 8A254DDF ZwTerminateProcess
---- Kernel code sections - GMER 2.1 ----
.text ntkrnlpa.exe!KeSetEvent + 215 824C9860 4 Bytes [3E, 4E, 25, 8A]
.text ntkrnlpa.exe!KeSetEvent + 539 824C9B84 4 Bytes [48, 4E, 25, 8A]
.text ntkrnlpa.exe!KeSetEvent + 56D 824C9BB8 4 Bytes [43, 4E, 25, 8A]
.text ntkrnlpa.exe!KeSetEvent + 5D1 824C9C1C 4 Bytes [4D, 4E, 25, 8A]
.text ntkrnlpa.exe!KeSetEvent + 619 824C9C64 4 Bytes [52, 4E, 25, 8A]
.text ...
.text C:\Windows\system32\DRIVERS\nvlddmkm.sys section is writeable [0x8C20F340, 0x33F647, 0xE8000020]
---- Devices - GMER 2.1 ----
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys
---- Registry - GMER 2.1 ----
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.doc”
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.doc”\OpenWithList
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.doc”\OpenWithList@a firefox.exe
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.doc”\OpenWithList@MRUList a
---- EOF - GMER 2.1 ----
 |
|
06.02.2014, 20:25
| #2 |
| /// the machine /// TB-Ausbilder    | E-Mail Adresse laut BSI ausspioniert - PC (Win Vista SP 2) infiziert? Rechner ist sauber
__________________
__________________ |
|
| Themen zu E-Mail Adresse laut BSI ausspioniert - PC (Win Vista SP 2) infiziert? |
| 4d36e972-e325-11ce-bfc1-08002be10318, antivir, antivirus, ausspioniert, avira, bonjour, converter, desktop, e-mail, flash player, frage, google, helper, hijack, hijackthis, home, homepage, installation, mozilla, mp3, pc infiziert, realtek, registry, security, software, svchost.exe, vista, überfragt |
Linear-Darstellung
