|
Log-Analyse und Auswertung: Windows 7: Trojaner gefunden und entfernt, sauber?Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
07.02.2014, 18:34 | #1 |
| Windows 7: Trojaner gefunden und entfernt, sauber? Hallo zusammen... seit kurzer Zeit habe ich Probleme mit der Internetgeschwindigkeit (Seitenaufbau, downloads, usw.). Ich habe mir dann Malwarebytes runter geladen und trojaner entdeckt und entfernt. Microsoft security essentials fand dann noch zwei Trojaner die ebenfalls entfernt wurden. Ich würde gern wissen, ob ich jetzt "sauber" bin? Hier der erste log mit fund: Code:
ATTFilter Malwarebytes Anti-Rootkit BETA 1.07.0.1009 www.malwarebytes.org Database version: v2014.02.03.06 Windows 7 Service Pack 1 x86 NTFS Internet Explorer 10.0.9200.16750 Knippi :: KNIPPI-PC [administrator] 03.02.2014 23:34:06 mbar-log-2014-02-03 (23-34-06).txt Scan type: Quick scan Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken Scan options disabled: Objects scanned: 210966 Time elapsed: 15 minute(s), 17 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 10 HKLM\SOFTWARE\CLASSES\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007} (Adware.Agent) -> Delete on reboot. HKLM\SOFTWARE\CLASSES\TYPELIB\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408} (Adware.Agent) -> Delete on reboot. HKLM\SOFTWARE\CLASSES\INTERFACE\{1B97A696-5576-43AC-A73B-E1D2C78F21E8} (Adware.Agent) -> Delete on reboot. HKLM\SOFTWARE\CLASSES\INTERFACE\{75BF416E-4326-45B5-8A2D-AE32D05B930B} (Adware.Agent) -> Delete on reboot. HKLM\SOFTWARE\CLASSES\PricePeep.PricePeepBho.1 (Adware.Agent) -> Delete on reboot. HKLM\SOFTWARE\CLASSES\PricePeep.PricePeepBho (Adware.Agent) -> Delete on reboot. HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007} (Adware.Agent) -> Delete on reboot. HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007} (Adware.Agent) -> Delete on reboot. HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007} (Adware.Agent) -> Delete on reboot. HKLM\SOFTWARE\CLASSES\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}\INPROCSERVER32 (Adware.Agent) -> Delete on reboot. Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 1 C:\ProgramData\IBUpdaterService (Adware.InstallBrain) -> Delete on reboot. Files Detected: 4 C:\Program Files\PricePeep\pricepeep.dll (Adware.Agent) -> Delete on reboot. C:\ProgramData\eSafe\temp_000.exe (Trojan.Downloader) -> Delete on reboot. C:\Users\Knippi\AppData\Roaming\skype.dat (Trojan.Ransom.Gend) -> Delete on reboot. C:\ProgramData\IBUpdaterService\repository.xml (Adware.InstallBrain) -> Delete on reboot. Physical Sectors Detected: 0 (No malicious items detected) (end) defogger: Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1) Log created at 17:33 on 07/02/2014 (Knippi) Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers... -=E.O.F=- Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 07-02-2014 Ran by Knippi (administrator) on KNIPPI-PC on 07-02-2014 17:38:20 Running from C:\Users\Knippi\Desktop Microsoft Windows 7 Ultimate Service Pack 1 (X86) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal The only official download link for FRST: Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) =================== (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe (ABBYY) C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe () C:\Program Files\Twonky\TwonkyServer\twonkyproxy.exe (PacketVideo) C:\Program Files\Twonky\TwonkyServer\twonkystarter.exe () C:\Program Files\Twonky\TwonkyServer\twonkywebdav.exe () C:\Program Files\Twonky\TwonkyServer\twonkyserver.exe ( Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\w32x86\3\E_FATIHAE.EXE (SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\w32x86\3\E_FATIHAE.EXE (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avmailc7.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe (Nero AG) C:\Program Files\Nero\Update\NASvc.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe (IncrediMail, Ltd.) C:\Program Files\IncrediMail\Bin\IncMail.exe (IncrediMail, Ltd.) C:\Program Files\IncrediMail\Bin\ImApp.exe (Microsoft Corporation) C:\Windows\System32\vds.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [NvCplDaemon] - C:\Windows\system32\NvCpl.dll [13826664 2009-10-03] (NVIDIA Corporation) HKLM\...\Run: [QlbCtrl.exe] - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [323640 2009-11-24] ( Hewlett-Packard Development Company, L.P.) HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [684600 2014-02-03] (Avira Operations GmbH & Co. KG) HKLM\...\Run: [MSC] - c:\Program Files\Microsoft Security Client\msseces.exe [948440 2013-10-23] (Microsoft Corporation) HKLM\...\Run: [BCSSync] - C:\Program Files\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation) HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKU\S-1-5-21-3740978952-1829205604-2155228767-1000\...\Run: [EPLTarget\P0000000000000000] - C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIHAE.EXE [249440 2013-01-02] (SEIKO EPSON CORPORATION) HKU\S-1-5-21-3740978952-1829205604-2155228767-1000\...\Run: [EPLTarget\P0000000000000001] - C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIHAE.EXE [249440 2013-01-02] (SEIKO EPSON CORPORATION) HKU\S-1-5-21-3740978952-1829205604-2155228767-1000\...\Run: [NextLive] - C:\Windows\system32\rundll32.exe "C:\Users\Knippi\AppData\Roaming\newnext.me\nengine.dll",EntryPoint -m l ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x409190C1E2CFCD01 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE URLSearchHook: HKCU - (No Name) - {5bcf818d-78c8-41b8-ba89-65c5fdac4fc4} - No File URLSearchHook: HKCU - (No Name) - {93a3111f-4f74-4ed8-895e-d9708497629e} - No File StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.delta-homes.com/?utm_source=b&utm_medium=newgdp&utm_campaign=eXQ&utm_content=sc&from=newgdp&uid=FUJITSUXMHW2160BHXPL_K10NT7930RNA&ts=1380293783 SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = BHO: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC) BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.) BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.) DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\Knippi\AppData\Roaming\Mozilla\Firefox\Profiles\97id7u2z.default-1391546280742 FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_44.dll () FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin: @VideoDownloadConverter_4z.com/Plugin - C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\NP4zStub.dll No File FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Users\Knippi\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.) FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\delta-homes.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml FF HKLM\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012-12-04] FF HKCU\...\Firefox\Extensions: [{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}] - C:\Program Files\Wajam\Firefox\{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}.xpi ========================== Services (Whitelisted) ================= R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY) R2 AntiVirMailService; C:\Program Files\Avira\AntiVir Desktop\avmailc7.exe [908856 2014-02-03] (Avira Operations GmbH & Co. KG) R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440376 2014-02-03] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440376 2014-02-03] (Avira Operations GmbH & Co. KG) R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe [1011768 2014-02-03] (Avira Operations GmbH & Co. KG) S3 Droppix Service; C:\Program Files\Common Files\Droppix\DxService.exe [221184 2009-08-28] (Droppix) S2 KMService; C:\Windows\system32\srvany.exe [8192 2003-04-18] () R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22208 2013-10-23] (Microsoft Corporation) R2 NAUpdate; C:\Program Files\Nero\Update\NASvc.exe [769432 2012-07-13] (Nero AG) R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [280288 2013-10-23] (Microsoft Corporation) R2 TwonkyProxy; C:\Program Files\Twonky\TwonkyServer\twonkyproxy.exe [545608 2012-07-09] () R2 TwonkyServer; C:\Program Files\Twonky\TwonkyServer\twonkystarter.exe [549704 2012-07-09] (PacketVideo) R2 TwonkyWebDav; C:\Program Files\Twonky\TwonkyServer\twonkywebdav.exe [271176 2012-07-09] () S2 ca82e1a5; "c:\progra~1\optimi~1\OptProCrash.exe" [X] ==================== Drivers (Whitelisted) ==================== R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2014-02-03] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135648 2014-02-03] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2014-02-03] (Avira Operations GmbH & Co. KG) R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [69240 2014-02-03] (Avira Operations GmbH & Co. KG) S3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.) R0 hotcore3; C:\Windows\System32\DRIVERS\hotcore3.sys [40560 2010-05-20] (Paragon Software Group) R1 ISODrive; C:\Program Files\UltraISO\drivers\ISODrive.sys [82320 2010-01-29] (EZB Systems, Inc.) R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [214696 2013-09-27] (Microsoft Corporation) R0 oem-drv86; C:\Windows\System32\DRIVERS\oem-drv86.sys [28160 2014-02-07] (secr9tos) R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH) U3 DfSdkS; S3 VGPU; System32\drivers\rdvgkmd.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-02-07 17:38 - 2014-02-07 17:38 - 00012691 _____ () C:\Users\Knippi\Desktop\FRST.txt 2014-02-07 17:38 - 2014-02-07 17:38 - 00000000 ____D () C:\FRST 2014-02-07 17:36 - 2014-02-07 17:37 - 01136640 _____ (Farbar) C:\Users\Knippi\Desktop\FRST.exe 2014-02-07 17:33 - 2014-02-07 17:33 - 00000474 _____ () C:\Users\Knippi\Desktop\defogger_disable.log 2014-02-07 17:33 - 2014-02-07 17:33 - 00000000 _____ () C:\Users\Knippi\defogger_reenable 2014-02-07 17:32 - 2014-02-07 17:32 - 00050477 _____ () C:\Users\Knippi\Desktop\Defogger.exe 2014-02-07 15:29 - 2014-02-07 15:29 - 00000000 ____D () C:\ProgramData\Oracle 2014-02-07 15:29 - 2013-12-18 21:04 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe 2014-02-07 15:28 - 2014-02-07 15:28 - 00005355 _____ () C:\Windows\system32\jupdate-1.7.0_51-b13.log 2014-02-07 15:28 - 2013-12-18 21:10 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll 2014-02-07 15:28 - 2013-12-18 21:04 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe 2014-02-07 15:28 - 2013-12-18 21:03 - 00174504 _____ (Oracle Corporation) C:\Windows\system32\java.exe 2014-02-05 23:35 - 2014-02-07 15:31 - 00000280 _____ () C:\Windows\setupact.log 2014-02-05 23:35 - 2014-02-05 23:35 - 00000000 _____ () C:\Windows\setuperr.log 2014-02-05 18:50 - 2013-11-26 10:23 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-02-05 18:50 - 2013-11-26 10:22 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-02-05 18:50 - 2013-11-26 09:53 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-02-05 18:50 - 2013-11-26 09:52 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-02-05 18:50 - 2013-11-26 09:38 - 02166784 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-02-05 18:50 - 2013-11-26 09:38 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-02-05 18:50 - 2013-11-26 09:36 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-02-05 18:50 - 2013-11-26 09:32 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-02-05 18:50 - 2013-11-26 09:29 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-02-05 18:50 - 2013-11-26 09:29 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-02-05 18:50 - 2013-11-26 09:28 - 00553472 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-02-05 18:50 - 2013-11-26 09:13 - 00208896 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-02-05 18:50 - 2013-11-26 08:32 - 01928192 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-02-05 18:50 - 2013-11-26 07:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-02-05 18:50 - 2013-11-26 07:33 - 01820160 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-02-05 18:50 - 2013-11-26 07:27 - 01157632 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-02-05 18:49 - 2013-11-26 11:11 - 17112576 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-02-05 18:49 - 2013-11-26 09:16 - 04243968 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-02-05 18:49 - 2013-11-26 08:26 - 11221504 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-02-04 22:36 - 2014-02-04 22:36 - 00001912 _____ () C:\Windows\epplauncher.mif 2014-02-04 22:36 - 2014-02-04 22:36 - 00000000 ____D () C:\Program Files\Microsoft Security Client 2014-02-04 22:27 - 2014-02-04 22:35 - 11157328 _____ (Microsoft Corporation) C:\Users\Knippi\Downloads\mseinstall.exe 2014-02-04 22:24 - 2014-02-04 22:24 - 00000000 ___HD () C:\Users\Knippi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup-Disabled 2014-02-04 21:14 - 2014-02-07 14:27 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable) 2014-02-04 00:50 - 2014-02-04 00:50 - 01051136 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-02-04 00:50 - 2014-02-04 00:50 - 00645120 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat 2014-02-04 00:50 - 2014-02-04 00:50 - 00610304 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00523776 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\html.iec 2014-02-04 00:50 - 2014-02-04 00:50 - 00244736 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00238288 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00233472 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00208384 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00182272 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00151552 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe 2014-02-04 00:50 - 2014-02-04 00:50 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe 2014-02-04 00:50 - 2014-02-04 00:50 - 00127488 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00083456 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe 2014-02-04 00:50 - 2014-02-04 00:50 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe 2014-02-04 00:50 - 2014-02-04 00:50 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx 2014-02-04 00:50 - 2014-02-04 00:50 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe 2014-02-04 00:50 - 2014-02-04 00:50 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe 2014-02-04 00:05 - 2014-02-04 00:05 - 00000000 ____D () C:\Windows\ERUNT 2014-02-04 00:00 - 2014-02-04 00:04 - 01037068 _____ (Thisisu) C:\Users\Knippi\Desktop\JRT.exe 2014-02-03 23:33 - 2014-02-07 14:04 - 00107224 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-02-03 23:30 - 2014-02-07 17:13 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-02-03 23:28 - 2014-02-07 14:27 - 00000000 ____D () C:\Users\Knippi\Desktop\mbar 2014-02-03 23:22 - 2014-02-03 23:28 - 12589848 _____ (Malwarebytes Corp.) C:\Users\Knippi\Desktop\mbar-1.07.0.1009.exe 2014-02-03 23:11 - 2014-02-07 14:30 - 00000000 ____D () C:\Program Files\7-Zip 2014-02-03 23:11 - 2014-02-03 23:11 - 01110476 _____ () C:\Users\Knippi\Downloads\7z920.exe 2014-02-03 21:17 - 2014-02-03 21:17 - 00000000 _____ () C:\Users\Knippi\AppData\Local\QSwitch.txt 2014-02-03 21:17 - 2014-02-03 21:17 - 00000000 _____ () C:\Users\Knippi\AppData\Local\DSwitch.txt 2014-02-03 21:17 - 2014-02-03 21:17 - 00000000 _____ () C:\Users\Knippi\AppData\Local\AtStart.txt 2014-01-27 18:27 - 2014-01-27 18:27 - 00000000 ____D () C:\Windows\system32\SearchProtect 2014-01-23 12:35 - 2014-02-03 19:10 - 00000000 ____D () C:\ProgramData\Websteroids 2014-01-21 15:16 - 2014-01-21 15:16 - 00000000 ____D () C:\Users\Knippi\Documents\PC Speed Maximizer 2014-01-21 15:13 - 2014-02-03 19:10 - 00000000 ____D () C:\Users\Knippi\AppData\Roaming\Skype 2014-01-21 15:12 - 2014-02-03 19:10 - 00000000 ____D () C:\ProgramData\Skype 2014-01-21 15:12 - 2014-02-03 19:10 - 00000000 ____D () C:\Program Files\Skype 2014-01-21 15:10 - 2014-01-21 15:10 - 00657776 _____ (Conduit) C:\Users\Knippi\Downloads\Skype_TSV120179.exe 2014-01-17 18:28 - 2014-02-07 15:32 - 00000000 ____D () C:\Users\Knippi\AppData\Roaming\newnext.me 2014-01-17 18:28 - 2014-02-03 20:16 - 00000000 ____D () C:\Users\Knippi\AppData\Local\Mobogenie 2014-01-17 18:28 - 2014-01-17 18:28 - 00000000 ____D () C:\Users\Knippi\Documents\Mobogenie 2014-01-17 18:28 - 2014-01-17 18:28 - 00000000 ____D () C:\Users\Knippi\AppData\Local\genienext 2014-01-17 18:28 - 2014-01-17 18:28 - 00000000 ____D () C:\Users\Knippi\AppData\Local\cache 2014-01-17 18:28 - 2014-01-17 18:28 - 00000000 ____D () C:\Users\Knippi\.android 2014-01-17 18:26 - 2014-02-03 20:16 - 00000000 ____D () C:\Program Files\Mobogenie 2014-01-17 18:20 - 2014-01-17 18:20 - 00675988 _____ () C:\Users\Knippi\Downloads\Minecraft(1).exe 2014-01-17 17:00 - 2014-01-17 17:00 - 00000000 ____D () C:\Users\Knippi\AppData\Local\LogMeIn 2014-01-17 17:00 - 2014-01-17 17:00 - 00000000 ____D () C:\ProgramData\LogMeIn 2014-01-17 15:52 - 2014-01-17 15:52 - 05028760 _____ (Systweak Inc ) C:\Users\Knippi\Downloads\rcpsetup_chip_de_chip_de.exe 2014-01-16 16:36 - 2013-11-27 02:14 - 00258560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys 2014-01-16 16:36 - 2013-11-27 02:13 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys 2014-01-16 16:36 - 2013-11-27 02:13 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys 2014-01-16 16:36 - 2013-11-27 02:13 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys 2014-01-16 16:36 - 2013-11-27 02:13 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys 2014-01-16 16:36 - 2013-11-27 02:13 - 00020480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys 2014-01-16 16:36 - 2013-11-27 02:13 - 00006016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys 2014-01-16 16:36 - 2013-11-26 12:11 - 00240576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys 2014-01-16 16:36 - 2013-11-26 11:10 - 02349056 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-01-08 18:39 - 2014-02-07 14:52 - 00000000 ____D () C:\ProgramData\WPM 2014-01-08 18:39 - 2014-01-08 18:39 - 00000000 ____D () C:\Windows\system32\log ==================== One Month Modified Files and Folders ======= 2014-02-07 17:38 - 2014-02-07 17:38 - 00012691 _____ () C:\Users\Knippi\Desktop\FRST.txt 2014-02-07 17:38 - 2014-02-07 17:38 - 00000000 ____D () C:\FRST 2014-02-07 17:38 - 2012-12-01 17:28 - 01559046 _____ () C:\Windows\WindowsUpdate.log 2014-02-07 17:37 - 2014-02-07 17:36 - 01136640 _____ (Farbar) C:\Users\Knippi\Desktop\FRST.exe 2014-02-07 17:33 - 2014-02-07 17:33 - 00000474 _____ () C:\Users\Knippi\Desktop\defogger_disable.log 2014-02-07 17:33 - 2014-02-07 17:33 - 00000000 _____ () C:\Users\Knippi\defogger_reenable 2014-02-07 17:33 - 2012-12-01 17:36 - 00000000 ____D () C:\Users\Knippi 2014-02-07 17:32 - 2014-02-07 17:32 - 00050477 _____ () C:\Users\Knippi\Desktop\Defogger.exe 2014-02-07 17:31 - 2012-12-01 18:24 - 00000000 ____D () C:\Users\Knippi\Downloads\MSM 2014-02-07 17:13 - 2014-02-03 23:30 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-02-07 17:13 - 2012-12-18 10:11 - 00000000 ____D () C:\ProgramData\TwonkyServer 2014-02-07 16:45 - 2012-12-01 18:01 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-02-07 16:27 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\Microsoft.NET 2014-02-07 15:39 - 2009-07-14 05:34 - 00026352 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-02-07 15:39 - 2009-07-14 05:34 - 00026352 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-02-07 15:32 - 2014-01-17 18:28 - 00000000 ____D () C:\Users\Knippi\AppData\Roaming\newnext.me 2014-02-07 15:31 - 2014-02-05 23:35 - 00000280 _____ () C:\Windows\setupact.log 2014-02-07 15:31 - 2009-07-14 05:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-02-07 15:30 - 2012-12-01 17:32 - 00028160 _____ (secr9tos) C:\Windows\system32\Drivers\oem-drv86.sys 2014-02-07 15:29 - 2014-02-07 15:29 - 00000000 ____D () C:\ProgramData\Oracle 2014-02-07 15:28 - 2014-02-07 15:28 - 00005355 _____ () C:\Windows\system32\jupdate-1.7.0_51-b13.log 2014-02-07 15:28 - 2013-10-25 20:31 - 00000000 ____D () C:\Program Files\Java 2014-02-07 14:52 - 2014-01-08 18:39 - 00000000 ____D () C:\ProgramData\WPM 2014-02-07 14:43 - 2012-12-01 18:50 - 00000000 ____D () C:\Program Files\Common Files\Apple 2014-02-07 14:30 - 2014-02-03 23:11 - 00000000 ____D () C:\Program Files\7-Zip 2014-02-07 14:27 - 2014-02-04 21:14 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable) 2014-02-07 14:27 - 2014-02-03 23:28 - 00000000 ____D () C:\Users\Knippi\Desktop\mbar 2014-02-07 14:04 - 2014-02-03 23:33 - 00107224 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-02-07 13:59 - 2012-12-01 18:25 - 00002533 _____ () C:\Users\Public\Desktop\O&O SafeErase.lnk 2014-02-07 13:45 - 2009-07-14 05:52 - 00000000 ____D () C:\Windows\system32\FxsTmp 2014-02-05 23:35 - 2014-02-05 23:35 - 00000000 _____ () C:\Windows\setuperr.log 2014-02-05 23:32 - 2010-11-21 01:46 - 00000000 ____D () C:\Windows\system32\Drivers\de-DE 2014-02-05 23:32 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\de-DE 2014-02-05 18:57 - 2013-07-29 12:09 - 00000000 ____D () C:\Users\Knippi\AppData\Roaming\.minecraft 2014-02-05 18:49 - 2012-12-01 19:20 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-02-05 18:49 - 2009-07-14 03:04 - 00000478 _____ () C:\Windows\win.ini 2014-02-04 23:56 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\rescache 2014-02-04 22:36 - 2014-02-04 22:36 - 00001912 _____ () C:\Windows\epplauncher.mif 2014-02-04 22:36 - 2014-02-04 22:36 - 00000000 ____D () C:\Program Files\Microsoft Security Client 2014-02-04 22:35 - 2014-02-04 22:27 - 11157328 _____ (Microsoft Corporation) C:\Users\Knippi\Downloads\mseinstall.exe 2014-02-04 22:24 - 2014-02-04 22:24 - 00000000 ___HD () C:\Users\Knippi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup-Disabled 2014-02-04 21:49 - 2012-12-01 18:01 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe 2014-02-04 21:49 - 2012-12-01 18:01 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl 2014-02-04 00:53 - 2013-12-14 02:34 - 00185363 _____ () C:\Windows\IE11_main.log 2014-02-04 00:50 - 2014-02-04 00:50 - 01051136 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-02-04 00:50 - 2014-02-04 00:50 - 00645120 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat 2014-02-04 00:50 - 2014-02-04 00:50 - 00610304 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00523776 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\html.iec 2014-02-04 00:50 - 2014-02-04 00:50 - 00244736 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00238288 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00233472 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00208384 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00182272 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00151552 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe 2014-02-04 00:50 - 2014-02-04 00:50 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe 2014-02-04 00:50 - 2014-02-04 00:50 - 00127488 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00083456 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe 2014-02-04 00:50 - 2014-02-04 00:50 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe 2014-02-04 00:50 - 2014-02-04 00:50 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx 2014-02-04 00:50 - 2014-02-04 00:50 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe 2014-02-04 00:50 - 2014-02-04 00:50 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe 2014-02-04 00:05 - 2014-02-04 00:05 - 00000000 ____D () C:\Windows\ERUNT 2014-02-04 00:04 - 2014-02-04 00:00 - 01037068 _____ (Thisisu) C:\Users\Knippi\Desktop\JRT.exe 2014-02-03 23:53 - 2012-12-11 09:32 - 00281532 _____ () C:\Windows\PFRO.log 2014-02-03 23:28 - 2014-02-03 23:22 - 12589848 _____ (Malwarebytes Corp.) C:\Users\Knippi\Desktop\mbar-1.07.0.1009.exe 2014-02-03 23:11 - 2014-02-03 23:11 - 01110476 _____ () C:\Users\Knippi\Downloads\7z920.exe 2014-02-03 22:28 - 2009-07-14 03:03 - 51642368 _____ () C:\Windows\system32\config\SOFTWARE.gbck 2014-02-03 22:28 - 2009-07-14 03:03 - 14155776 _____ () C:\Windows\system32\config\SYSTEM.gbck 2014-02-03 22:28 - 2009-07-14 03:03 - 00262144 _____ () C:\Windows\system32\config\SECURITY.gbck 2014-02-03 22:28 - 2009-07-14 03:03 - 00262144 _____ () C:\Windows\system32\config\SAM.gbck 2014-02-03 22:28 - 2009-07-14 03:03 - 00262144 _____ () C:\Windows\system32\config\DEFAULT.gbck 2014-02-03 21:17 - 2014-02-03 21:17 - 00000000 _____ () C:\Users\Knippi\AppData\Local\QSwitch.txt 2014-02-03 21:17 - 2014-02-03 21:17 - 00000000 _____ () C:\Users\Knippi\AppData\Local\DSwitch.txt 2014-02-03 21:17 - 2014-02-03 21:17 - 00000000 _____ () C:\Users\Knippi\AppData\Local\AtStart.txt 2014-02-03 21:16 - 2012-12-01 17:56 - 00000000 ____D () C:\ProgramData\NVIDIA 2014-02-03 21:12 - 2012-12-11 09:47 - 00002016 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk 2014-02-03 21:09 - 2013-05-07 13:37 - 00069240 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys 2014-02-03 21:09 - 2012-12-11 09:46 - 00135648 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys 2014-02-03 21:09 - 2012-12-11 09:46 - 00090400 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys 2014-02-03 21:09 - 2012-12-11 09:46 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys 2014-02-03 20:16 - 2014-01-17 18:28 - 00000000 ____D () C:\Users\Knippi\AppData\Local\Mobogenie 2014-02-03 20:16 - 2014-01-17 18:26 - 00000000 ____D () C:\Program Files\Mobogenie 2014-02-03 20:16 - 2013-12-25 18:51 - 00000000 ____D () C:\Program Files\Mozilla Firefox 2014-02-03 20:16 - 2013-11-17 19:29 - 00000000 ____D () C:\Program Files\Mozilla Firefox.bak 2014-02-03 20:16 - 2013-09-19 16:46 - 00000000 ____D () C:\Windows\Minidump 2014-02-03 20:16 - 2012-12-01 18:55 - 00000000 ____D () C:\Users\Knippi\AppData\Roaming\Spotify 2014-02-03 19:37 - 2009-07-14 03:37 - 00000000 __RHD () C:\Users\Public\Libraries 2014-02-03 19:12 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\wfp 2014-02-03 19:10 - 2014-01-23 12:35 - 00000000 ____D () C:\ProgramData\Websteroids 2014-02-03 19:10 - 2014-01-21 15:13 - 00000000 ____D () C:\Users\Knippi\AppData\Roaming\Skype 2014-02-03 19:10 - 2014-01-21 15:12 - 00000000 ____D () C:\ProgramData\Skype 2014-02-03 19:10 - 2014-01-21 15:12 - 00000000 ____D () C:\Program Files\Skype 2014-02-03 19:10 - 2012-12-13 15:30 - 00000000 ____D () C:\Users\Knippi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\JoWooD 2014-02-03 19:10 - 2010-11-21 01:54 - 00000000 ___RD () C:\Users\Public\Recorded TV 2014-02-03 19:10 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\NDF 2014-02-03 19:09 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\registration 2014-02-03 19:07 - 2012-12-13 15:29 - 00000000 ____D () C:\Program Files\JoWooD 2014-02-02 11:04 - 2012-12-11 08:23 - 00000000 ____D () C:\Windows\system32\appmgmt 2014-01-27 18:27 - 2014-01-27 18:27 - 00000000 ____D () C:\Windows\system32\SearchProtect 2014-01-21 15:16 - 2014-01-21 15:16 - 00000000 ____D () C:\Users\Knippi\Documents\PC Speed Maximizer 2014-01-21 15:10 - 2014-01-21 15:10 - 00657776 _____ (Conduit) C:\Users\Knippi\Downloads\Skype_TSV120179.exe 2014-01-19 08:32 - 2011-05-12 12:25 - 00231584 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe 2014-01-17 18:28 - 2014-01-17 18:28 - 00000000 ____D () C:\Users\Knippi\Documents\Mobogenie 2014-01-17 18:28 - 2014-01-17 18:28 - 00000000 ____D () C:\Users\Knippi\AppData\Local\genienext 2014-01-17 18:28 - 2014-01-17 18:28 - 00000000 ____D () C:\Users\Knippi\AppData\Local\cache 2014-01-17 18:28 - 2014-01-17 18:28 - 00000000 ____D () C:\Users\Knippi\.android 2014-01-17 18:20 - 2014-01-17 18:20 - 00675988 _____ () C:\Users\Knippi\Downloads\Minecraft(1).exe 2014-01-17 17:00 - 2014-01-17 17:00 - 00000000 ____D () C:\Users\Knippi\AppData\Local\LogMeIn 2014-01-17 17:00 - 2014-01-17 17:00 - 00000000 ____D () C:\ProgramData\LogMeIn 2014-01-17 15:52 - 2014-01-17 15:52 - 05028760 _____ (Systweak Inc ) C:\Users\Knippi\Downloads\rcpsetup_chip_de_chip_de.exe 2014-01-17 12:46 - 2009-07-14 05:33 - 00416488 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-01-17 12:27 - 2013-07-17 09:55 - 00000000 ____D () C:\Windows\system32\MRT 2014-01-17 12:23 - 2011-05-12 12:26 - 83425928 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-01-12 10:52 - 2013-08-02 10:42 - 00001148 _____ () C:\Users\Knippi\my_skin.txt 2014-01-08 18:39 - 2014-01-08 18:39 - 00000000 ____D () C:\Windows\system32\log 2014-01-08 17:37 - 2012-12-02 22:51 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service Files to move or delete: ==================== C:\Users\Knippi\AppData\Roaming\skype.ini Some content of TEMP: ==================== C:\Users\Knippi\AppData\Local\Temp\avgnt.exe C:\Users\Knippi\AppData\Local\Temp\First15.exe C:\Users\Knippi\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe C:\Users\Knippi\AppData\Local\Temp\nsrC64F.exe C:\Users\Knippi\AppData\Local\Temp\SIntf16.dll C:\Users\Knippi\AppData\Local\Temp\SPSetup.exe C:\Users\Knippi\AppData\Local\Temp\VP6Install.exe C:\Users\Knippi\AppData\Local\Temp\VP6VFW.dll ==================== Bamital & volsnap Check ================= C:\Windows\explorer.exe => MD5 is legit C:\Windows\system32\winlogon.exe => MD5 is legit C:\Windows\system32\wininit.exe => MD5 is legit C:\Windows\system32\svchost.exe => MD5 is legit C:\Windows\system32\services.exe => MD5 is legit C:\Windows\system32\User32.dll => MD5 is legit C:\Windows\system32\userinit.exe => MD5 is legit C:\Windows\system32\rpcss.dll => MD5 is legit C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-02-04 21:11 ==================== End Of Log ============================ Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 07-02-2014 Ran by Knippi at 2014-02-07 17:39:52 Running from C:\Users\Knippi\Desktop Boot Mode: Normal ========================================================== ==================== Security Center ======================== AV: Microsoft Security Essentials (Enabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F} AV: Avira Desktop (Disabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C} AS: Avira Desktop (Disabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: Microsoft Security Essentials (Enabled - Up to date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2} ==================== Installed Programs ====================== 123 Free Solitaire 2011 v8.0 (Version: - TreeCardGames) ABBYY FineReader 9.0 Sprint (Version: 9.01.513.58212 - ABBYY) ABBYY FineReader 9.0 Sprint (Version: 9.01.513.58212 - ABBYY) Hidden Adobe Flash Player 12 ActiveX (Version: 12.0.0.44 - Adobe Systems Incorporated) Adobe Flash Player 12 Plugin (Version: 12.0.0.44 - Adobe Systems Incorporated) Adobe Reader XI (11.0.06) - Deutsch (Version: 11.0.06 - Adobe Systems Incorporated) Amazon MP3-Downloader 1.0.18 (HKCU Version: 1.0.18 - Amazon Services LLC) Apple Software Update (Version: 2.1.3.127 - Apple Inc.) Ashampoo Burning Studio 2013 v.11.0.6 (Version: 11.0.6 - Ashampoo GmbH & Co. KG) Ashampoo WinOptimizer 9 v.9.2.0 (Version: 9.2.0 - Ashampoo GmbH & Co. KG) Avira Antivirus Suite (Version: 14.0.2.286 - Avira) Caesar IV (Version: 0.18.13 - Tilted Mill Entertainment) Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (Version: - Microsoft) Die Sims 2 (Version: - ) Die Sims™ 2 H&M®-Fashion-Accessoires (Version: - ) Die Völker 2 Gold Edition (Version: 2.0.2 - JoWooD Productions Software AG) DivX-Setup (Version: 2.6.1.22 - DivX, LLC) Droppix Label Maker 2.x (Version: 2.9.8 - Droppix) Easy Phone Tunes (Version: 137 - Easy Phone Tunes) ElsterFormular (Version: 14.3.20130522 - Landesfinanzdirektion Thüringen) Epson Easy Photo Print 2 (Version: 2.2.4.0 - SEIKO EPSON CORPORATION) Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser) (Version: 1.00.0000 - SEIKO EPSON CORPORATION) Epson Event Manager (Version: 2.50.0000 - SEIKO EPSON CORPORATION) EPSON Scan (Version: - Seiko Epson Corporation) EPSON SX430 Series Printer Uninstall (Version: - SEIKO EPSON Corporation) EpsonNet Print (Version: 2.4j - SEIKO EPSON CORPORATION) Free Audio Converter version 5.0.20.1031 (Version: 5.0.20.1031 - DVDVideoSoft Ltd.) Free M4a to MP3 Converter 8.0 (Version: - ManiacTools.com) GIMP 2.8.10 (Version: 2.8.10 - The GIMP Team) HP Quick Launch Buttons (Version: 6.50.14.1 - Hewlett-Packard Company) ICQ7M (Version: 7.8 - ICQ) IncrediMail (Version: 6.6.0.5246 - IncrediMail) Hidden IncrediMail 2.5 (Version: 6.6.0.5246 - IncrediMail Ltd.) iTunes (Version: 11.0.4.4 - Apple Inc.) Java 7 Update 51 (Version: 7.0.510 - Oracle) Java Auto Updater (Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden JDownloader 0.9 (Version: 0.9 - AppWork GmbH) LightScribe Applications (Version: 1.18.27.10 - LightScribe) LightScribe System Software (Version: 1.18.27.10 - LightScribe) LightScribe Template Labeler (Version: 1.18.27.10 - LightScribe) MediaManager (Version: 3.0.3 (60) - PacketVideo) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden Microsoft Office Access MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Excel MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Groove MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office InfoPath MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office OneNote MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Outlook MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office PowerPoint MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Professional Plus 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Microsoft Office Professional Plus 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (French) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (Italian) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Proofing (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Publisher MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Shared MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Office Word MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden Microsoft Security Client (Version: 4.4.0304.0 - Microsoft Corporation) Hidden Microsoft Security Essentials (Version: 4.4.304.0 - Microsoft Corporation) Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (Version: 9.0.21022 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation) Mozilla Firefox 26.0 (x86 de) (Version: 26.0 - Mozilla) Mozilla Maintenance Service (Version: 26.0 - Mozilla) Nero ControlCenter (Version: 11.0.15500 - Nero AG) Hidden Nero ControlCenter Help (CHM) (Version: 12.0.7000 - Nero AG) Hidden Nero Core Components (Version: 11.0.20200 - Nero AG) Hidden Nero CoverDesigner (Version: 12.0.01500 - Nero AG) Nero CoverDesigner (Version: 12.0.10003 - Nero AG) Hidden Nero CoverDesigner Help (CHM) (Version: 12.0.2000 - Nero AG) Hidden Nero Update (Version: 11.0.11800.31.0 - Nero AG) Hidden NVIDIA Drivers (Version: 1.10 - NVIDIA Corporation) O&O SafeErase Professional (Version: 7.0.165 - O&O Software GmbH) Paragon Partition Manager™ 11 Professional (Version: 90.00.0003 - Paragon Software) Photo Notifier and Animation Creator (Version: 1.0.0.1009 - Ihr Firmenname) Hidden Photo Notifier and Animation Creator (Version: 1.0.0.1009 - IncrediMail Ltd.) Prerequisite installer (Version: 12.0.0003 - Nero AG) Hidden PVSonyDll (Version: 1.00.0001 - NVIDIA Corporation) Hidden QLBCASL (Version: 6.40.17.2 - Hewlett-Packard) Hidden Qtrax Player (HKCU Version: - portal.qtrax.com) QuickTime (Version: 7.73.80.64 - Apple Inc.) Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (Version: - Microsoft) Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (Version: - Microsoft) Hidden Spotify (HKCU Version: 0.8.5.1333.g822e0de8 - Spotify AB) Twonky Windows Components (Version: 3.0.3 - PacketVideo) UltraISO Premium V9.53 (Version: - ) Update for Image Editor (HKCU Version: - ) <==== ATTENTION Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1 - Microsoft Corporation) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1 - Microsoft Corporation) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1 - Microsoft Corporation) Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1 - Microsoft Corporation) Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (Version: 3 - Microsoft Corporation) Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (Version: - Microsoft) Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (Version: - Microsoft) Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (Version: - Microsoft) Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (Version: - Microsoft) Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (Version: - Microsoft) Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (Version: - Microsoft) Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (Version: - Microsoft) Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (Version: - Microsoft) Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (Version: - Microsoft) Update for Microsoft Office 2010 (KB2825640) 32-Bit Edition (Version: - Microsoft) Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition (Version: - Microsoft) Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (Version: - Microsoft) Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition (Version: - Microsoft) Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (Version: - Microsoft) Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (Version: - Microsoft) Update for Microsoft Word 2010 (KB2837593) 32-Bit Edition (Version: - Microsoft) VC80CRTRedist - 8.0.50727.6195 (Version: 1.2.0 - DivX, Inc) Hidden VLC media player 2.0.4 (Version: 2.0.4 - VideoLAN) WinRAR 4.20 (32-Bit) (Version: 4.20.0 - win.rar GmbH) Zoo Tycoon: Complete Collection (Version: - ) ==================== Restore Points ========================= 03-02-2014 22:51:03 Malwarebytes Anti-Rootkit Restore Point 03-02-2014 23:48:44 Windows Update 05-02-2014 17:34:32 Windows Update 07-02-2014 12:58:05 O&O SafeErase Professional wird installiert 07-02-2014 13:40:21 Removed Apple Application Support 07-02-2014 13:42:04 Removed Apple Mobile Device Support 07-02-2014 13:48:12 Removed Bonjour 07-02-2014 14:27:38 Installed Java 7 Update 51 ==================== Hosts content: ========================== 2009-07-14 03:04 - 2009-06-10 22:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: {70FCED73-82E7-4393-ADF5-7924EBD7F31C} - \Desk 365 RunAsStdUser No Task File Task: {8798140B-AEBD-47B9-9BE6-D09B8F0BDF62} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.) Task: {ADDF4F30-235F-42CD-8611-AB398080532F} - \QtraxPlayer No Task File Task: {B84B1422-8FCD-4E34-8831-65594784D8CE} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-02-04] (Adobe Systems Incorporated) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe ==================== Loaded Modules (whitelisted) ============= 2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF 2013-12-25 18:51 - 2013-12-25 18:51 - 03559024 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll 2012-12-02 21:33 - 2012-12-02 21:33 - 00032680 _____ () C:\Program Files\IncrediMail\Bin\IMHttpComm.dll 2012-12-02 21:33 - 2012-12-02 21:33 - 00071664 _____ () C:\Program Files\IncrediMail\Bin\wlessfp1.dll 2012-12-02 21:33 - 2012-12-02 21:33 - 00272368 _____ () C:\Program Files\IncrediMail\Bin\ImLookExU.dll 2012-11-13 17:20 - 2012-11-13 17:20 - 00108448 _____ () C:\Program Files\IncrediMail\Bin\pmc.dll 2012-12-02 21:33 - 2012-12-02 21:33 - 00079856 _____ () C:\Program Files\IncrediMail\bin\ImAppRU.dll 2012-12-02 21:33 - 2012-12-02 21:33 - 00133104 _____ () C:\Program Files\IncrediMail\Bin\ImComUtlU.dll ==================== Alternate Data Streams (whitelisted) ========= AlternateDataStreams: C:\ProgramData\TEMP:373E1720 AlternateDataStreams: C:\ProgramData\TEMP:AD022376 ==================== Safe Mode (whitelisted) =================== HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver" ==================== Faulty Device Manager Devices ============= Name: Basissystemgerät Description: Basissystemgerät Class Guid: Manufacturer: Service: Problem: : The drivers for this device are not installed. (Code 28) Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard. Name: Basissystemgerät Description: Basissystemgerät Class Guid: Manufacturer: Service: Problem: : The drivers for this device are not installed. (Code 28) Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard. Name: Coprozessor Description: Coprozessor Class Guid: Manufacturer: Service: Problem: : The drivers for this device are not installed. (Code 28) Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard. ==================== Event log errors: ========================= Application errors: ================== Error: (02/07/2014 03:32:53 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (02/07/2014 02:41:40 PM) (Source: Microsoft-Windows-RestartManager) (User: Knippi-PC) Description: Die Anwendung oder der Dienst "Apple Mobile Device" konnte nicht neu gestartet werden. Error: (02/07/2014 02:32:06 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (02/07/2014 01:44:29 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (02/05/2014 11:40:40 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (02/05/2014 11:36:26 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (02/05/2014 11:32:01 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 16377858 Error: (02/05/2014 11:32:01 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: m->NextScheduledEvent 16377858 Error: (02/05/2014 11:32:00 PM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (02/05/2014 06:46:37 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 System errors: ============= Error: (02/07/2014 03:34:21 PM) (Source: DCOM) (User: NT-AUTORITÄT) Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTLOKALER DIENSTS-1-5-19LocalHost (unter Verwendung von LRPC) Error: (02/07/2014 03:32:34 PM) (Source: DCOM) (User: NT-AUTORITÄT) Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC) Error: (02/07/2014 02:41:40 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Apple Mobile Device" wurde aufgrund folgenden Fehlers nicht gestartet: %%1053 Error: (02/07/2014 02:41:40 PM) (Source: Service Control Manager) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Apple Mobile Device erreicht. Error: (02/07/2014 02:33:35 PM) (Source: DCOM) (User: NT-AUTORITÄT) Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC) Error: (02/07/2014 02:32:36 PM) (Source: DCOM) (User: NT-AUTORITÄT) Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTLOKALER DIENSTS-1-5-19LocalHost (unter Verwendung von LRPC) Error: (02/07/2014 02:01:13 PM) (Source: cdrom) (User: ) Description: Der Treiber hat einen Controllerfehler auf \Device\CdRom0 gefunden. Error: (02/07/2014 02:01:11 PM) (Source: cdrom) (User: ) Description: Der Treiber hat einen Controllerfehler auf \Device\CdRom0 gefunden. Error: (02/07/2014 02:01:09 PM) (Source: cdrom) (User: ) Description: Der Treiber hat einen Controllerfehler auf \Device\CdRom0 gefunden. Error: (02/07/2014 02:01:07 PM) (Source: cdrom) (User: ) Description: Der Treiber hat einen Controllerfehler auf \Device\CdRom0 gefunden. Microsoft Office Sessions: ========================= Error: (02/07/2014 03:32:53 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (02/07/2014 02:41:40 PM) (Source: Microsoft-Windows-RestartManager)(User: Knippi-PC) Description: 0AppleMobileDeviceService.exeApple Mobile Device03026217818440 Error: (02/07/2014 02:32:06 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (02/07/2014 01:44:29 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (02/05/2014 11:40:40 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (02/05/2014 11:36:26 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (02/05/2014 11:32:01 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: m->NextScheduledSPRetry 16377858 Error: (02/05/2014 11:32:01 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: m->NextScheduledEvent 16377858 Error: (02/05/2014 11:32:00 PM) (Source: Bonjour Service)(User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (02/05/2014 06:46:37 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 ==================== Memory info =========================== Percentage of memory in use: 51% Total physical RAM: 2046.98 MB Available physical RAM: 983.21 MB Total Pagefile: 4093.97 MB Available Pagefile: 2553.98 MB Total Virtual: 2047.88 MB Available Virtual: 1913.64 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:102.87 GB) (Free:56.36 GB) NTFS ==>[Drive with boot components (obtained from BCD)] Drive d: (Volume) (Fixed) (Total:46.13 GB) (Free:8.59 GB) NTFS Drive e: (Die Voelker Gold) (CDROM) (Total:0.4 GB) (Free:0 GB) CDFS Drive f: () (Removable) (Total:7.39 GB) (Free:6.92 GB) FAT32 ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 149 GB) (Disk ID: CBBB331B) Partition 1: (Active) - (Size=103 GB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=46 GB) - (Type=07 NTFS) ======================================================== Disk: 1 (Size: 7 GB) (Disk ID: 00000000) Partition 1: (Not Active) - (Size=7 GB) - (Type=0B) ==================== End Of Log ============================ Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net Rootkit scan 2014-02-07 18:11:35 Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-3 FUJITSU_MHW2160BH_PL rev.891F 149,05GB Running: ieodktnk.exe; Driver: C:\Users\Knippi\AppData\Local\Temp\uxdiipoc.sys ---- System - GMER 2.1 ---- SSDT 8D87062E ZwCreateSection SSDT 8D870606 ZwCreateSymbolicLinkObject SSDT 8D87060B ZwLoadDriver SSDT 8D870601 ZwOpenSection SSDT 8D870638 ZwRequestWaitReplyPort SSDT 8D870633 ZwSetContextThread SSDT 8D87063D ZwSetSecurityObject SSDT 8D870610 ZwSetSystemInformation SSDT 8D870642 ZwSystemDebugControl SSDT 8D8705CF ZwTerminateProcess SSDT 8D8705CA ZwWriteVirtualMemory ---- Kernel code sections - GMER 2.1 ---- .text ntkrnlpa.exe!ZwRollbackEnlistment + 142D 82C3FA15 1 Byte [06] .text ntkrnlpa.exe!MmUnmapReservedMapping + 2D3 82C71772 7 Bytes JMP 8333792C \SystemRoot\system32\DRIVERS\oem-drv86.sys .text ntkrnlpa.exe!MmProtectMdlSystemAddress + 293 82C71C9E 7 Bytes JMP 833378FA \SystemRoot\system32\DRIVERS\oem-drv86.sys .text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 82C79212 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3} .text ntkrnlpa.exe!KeRemoveQueueEx + 11F7 82C8058C 4 Bytes [2E, 06, 87, 8D] .text ntkrnlpa.exe!KeRemoveQueueEx + 11FF 82C80594 4 Bytes [06, 06, 87, 8D] .text ntkrnlpa.exe!KeRemoveQueueEx + 1313 82C806A8 4 Bytes [0B, 06, 87, 8D] .text ntkrnlpa.exe!KeRemoveQueueEx + 13AF 82C80744 4 Bytes [01, 06, 87, 8D] .text ntkrnlpa.exe!KeRemoveQueueEx + 1553 82C808E8 4 Bytes [38, 06, 87, 8D] .text ... ---- Devices - GMER 2.1 ---- AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 hotcore3.sys AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 hotcore3.sys AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 hotcore3.sys AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys ---- Registry - GMER 2.1 ---- Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OOSE06.00.00.01PRO EA0A76FC53D43089E272667B1A50B294B78036AFC1E7A3DCCD39CD8C0B1AE2AE7CD449E9587ED4D27AFB41C46AAE2FB958DB12569C7BC6770C853FF83BF7808F071DDFDA64D23D14E65B9CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B9808A6171C11EC38DE3DC038D530D6EB3452A6171C11EC38DE3D13DE3208829EDA9763243A6AC3FA489DF7615C13D516B7E62A16010CAE3DB780B955DED4FDDEF07185B1CC5449C02C3A0B25EBE1D42F1A65401DA05867CEFD23B183DD44CC7515FB7F6A390FBC92DE8A183952507DACA7CD54ED929DEAEA6B035973AF72B7AA869BCB8484A993B537B255193CFE91EDE9A4FAEDC62AE6A55EA53F94A803786F987517168937358F9A992DA6A612C2F27CB2FAE681557DB94AD329B7F1993ED5B1F2C29A774DFD2E86E9BEA5E4303D5F1204CF86D9F4C406B31A0E930761AC144DC36470CC063EBF8B13DB3E1E851DFDEF682A5D3B68468AB44B1C443B085A057B58C6DC6202B9994EC80BFC4DC073BA6F74EB60668E816FFD7A34C5313ED1295FE9E5866063A7B2058107524096C4A67D802EEA6ECBE6FCCE0368FB623A92A2AEEEF47844CFB5A7FD77BE131B3E8AF69AA7B938BB0ADCA180FE83AC9B3510B7B727D7A2E0F202381A2B547653F33104DD4A11EB0AB5BC6EFA530203FC6D3 Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OOSE07.00.00.01PRO 0E227B0DB2C86104296B48CEFA3973F85519AC565D6B20CAF70ADB0F8CD9B4D90F687A97F8DE3004F649C363DE7B6D29CA18B43269F1500DCD5E47D1682C970763CD48338EF52B741B272FCFC70687104CE310DF18D3AF853D3C19D910C1B765E17322CB5117D9DCA3FCC77D9CC49CC13D689EE4F60108742424EFEA5DB07104028E0681821C48B543558C8728F789462CA481FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA9C6AECB7A5D14078EDD5E5BE2F6E667A2D97226D213B555A2D97226D213B55519178BD17733F978FB554446CCE84AF7E2C1170C20626D334D93B8825CB8F6540DDF4A9068ED50D02772630D6D056DD387AAEA30752F49BF89F13D225906383EC8BAA50B79D308D74996A8BBCF70702AE7551A62C52954A020BB875567BFD1C823BFEFE65B6F2229B862CA48B00DC937F40DE108FAAA1CD0C0847C93C059864EA5ED51CA34EE369FFBDED6ADC4E107F6D501548DF534400ECD4551D6116CAA7192A5C6641F23EEDC5074AE67339AC42D63C5D7600BE8F45DDEDA119F7B36A7945C2B1F6429030A4627718679958538DE2B50A5F282910283BB841B731317FA60A92AFD7FD328D984A389E667FC16A757EDFDCBBB979A450E65E821D6E295B5C0D62F5BED1650C3071F522DBBEA626FA3A10E2BB6F9922DCA0E8D2CD6E ---- EOF - GMER 2.1 ---- Danke :-) |
07.02.2014, 19:13 | #2 |
/// the machine /// TB-Ausbilder | Windows 7: Trojaner gefunden und entfernt, sauber? hi,
__________________Downloade Dir bitte AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ |
07.02.2014, 21:03 | #3 |
| Windows 7: Trojaner gefunden und entfernt, sauber? so, da war wohl doch noch einiges zu finden...
__________________AdwCleaner: Code:
ATTFilter # AdwCleaner v3.018 - Bericht erstellt am 07/02/2014 um 20:40:12 # Updated 28/01/2014 von Xplode # Betriebssystem : Windows 7 Ultimate Service Pack 1 (32 bits) # Benutzername : Knippi - KNIPPI-PC # Gestartet von : C:\Users\Knippi\Desktop\adwcleaner.exe # Option : Löschen ***** [ Dienste ] ***** ***** [ Dateien / Ordner ] ***** Ordner Gelöscht : C:\Program Files\Common Files\337 Ordner Gelöscht : C:\Program Files\Common Files\DVDVideoSoft\TB Ordner Gelöscht : C:\Windows\system32\Searchprotect Ordner Gelöscht : C:\Users\Knippi\Documents\PC Speed Maximizer Datei Gelöscht : C:\Users\Knippi\Desktop\Qtrax Player.lnk ***** [ Verknüpfungen ] ***** ***** [ Registrierungsdatenbank ] ***** Wert Gelöscht : HKCU\Software\Mozilla\Firefox\Extensions [{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}] Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\jifflliplgeajjdhmkcfnngfpgbjonjg [#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Desk 365 RunAsStdUser [#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{70FCED73-82E7-4393-ADF5-7924EBD7F31C} [#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{70FCED73-82E7-4393-ADF5-7924EBD7F31C} [#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\QtraxPlayer [#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{ADDF4F30-235F-42CD-8611-AB398080532F} [#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{ADDF4F30-235F-42CD-8611-AB398080532F} Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\DeskSvc Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WajamUpdater Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WsysSvc Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{336D0C35-8A85-403A-B9D2-65C292C39087} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5D64294B-1341-4FE7-B6D8-7C36828D4DD5} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{095BFD3C-4602-4FE1-96F1-AEFAFBFD067D} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{336D0C35-8A85-403A-B9D2-65C292C39087} Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{336D0C35-8A85-403A-B9D2-65C292C39087} Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{93A3111F-4F74-4ED8-895E-D9708497629E}] Daten Wiederhergestellt : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command Schlüssel Gelöscht : HKCU\Software\Conduit Schlüssel Gelöscht : HKCU\Software\IM Schlüssel Gelöscht : HKCU\Software\OCS Schlüssel Gelöscht : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F} Schlüssel Gelöscht : HKLM\Software\{1146AC44-2F03-4431-B4FD-889BC837521F} Schlüssel Gelöscht : HKLM\Software\{6791A2F3-FC80-475C-A002-C014AF797E9C} Schlüssel Gelöscht : HKLM\Software\delta-homesSoftware ***** [ Browser ] ***** -\\ Internet Explorer v11.0.9600.16428 -\\ Mozilla Firefox v26.0 (de) [ Datei : C:\Users\Knippi\AppData\Roaming\Mozilla\Firefox\Profiles\97id7u2z.default-1391546280742\prefs.js ] ************************* AdwCleaner[R0].txt - [4067 octets] - [07/02/2014 20:38:53] AdwCleaner[S0].txt - [3900 octets] - [07/02/2014 20:40:12] ########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [3960 octets] ########## Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 6.1.1 (02.04.2014:1) OS: Windows 7 Ultimate x86 Ran by Knippi on 07.02.2014 at 20:49:29,98 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values Suspicious HKCU\..\Run entries found. Trojan:JS/Medfos.B? Value Name Type Value Data ======================================================================================== NextLive REG_SZ C:\Windows\system32\rundll32.exe "C:\Users\Knippi\AppData\Roaming\newnext.me\nengine.dll",EntryPoint -m l ~~~ Registry Keys ~~~ Files ~~~ Folders ~~~ FireFox Emptied folder: C:\Users\Knippi\AppData\Roaming\mozilla\firefox\profiles\97id7u2z.default-1391546280742\minidumps [1 files] ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 07.02.2014 at 20:54:55,93 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 07-02-2014 Ran by Knippi (administrator) on KNIPPI-PC on 07-02-2014 20:57:09 Running from C:\Users\Knippi\Desktop Microsoft Windows 7 Ultimate Service Pack 1 (X86) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) =================== (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe (ABBYY) C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe () C:\Program Files\Twonky\TwonkyServer\twonkyproxy.exe (PacketVideo) C:\Program Files\Twonky\TwonkyServer\twonkystarter.exe () C:\Program Files\Twonky\TwonkyServer\twonkywebdav.exe () C:\Program Files\Twonky\TwonkyServer\twonkyserver.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avmailc7.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe (Nero AG) C:\Program Files\Nero\Update\NASvc.exe ( Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\w32x86\3\E_FATIHAE.EXE (SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\w32x86\3\E_FATIHAE.EXE (Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [NvCplDaemon] - C:\Windows\system32\NvCpl.dll [13826664 2009-10-03] (NVIDIA Corporation) HKLM\...\Run: [QlbCtrl.exe] - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [323640 2009-11-24] ( Hewlett-Packard Development Company, L.P.) HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [684600 2014-02-03] (Avira Operations GmbH & Co. KG) HKLM\...\Run: [MSC] - c:\Program Files\Microsoft Security Client\msseces.exe [948440 2013-10-23] (Microsoft Corporation) HKLM\...\Run: [BCSSync] - C:\Program Files\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation) HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKU\S-1-5-21-3740978952-1829205604-2155228767-1000\...\Run: [EPLTarget\P0000000000000000] - C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIHAE.EXE [249440 2013-01-02] (SEIKO EPSON CORPORATION) HKU\S-1-5-21-3740978952-1829205604-2155228767-1000\...\Run: [EPLTarget\P0000000000000001] - C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIHAE.EXE [249440 2013-01-02] (SEIKO EPSON CORPORATION) HKU\S-1-5-21-3740978952-1829205604-2155228767-1000\...\Run: [NextLive] - C:\Windows\system32\rundll32.exe "C:\Users\Knippi\AppData\Roaming\newnext.me\nengine.dll",EntryPoint -m l ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x409190C1E2CFCD01 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE URLSearchHook: HKCU - (No Name) - {5bcf818d-78c8-41b8-ba89-65c5fdac4fc4} - No File SearchScopes: HKLM - DefaultScope value is missing. BHO: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC) BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.) BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.) DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\Knippi\AppData\Roaming\Mozilla\Firefox\Profiles\97id7u2z.default-1391546280742 FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_44.dll () FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin: @VideoDownloadConverter_4z.com/Plugin - C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\NP4zStub.dll No File FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Users\Knippi\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.) FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\delta-homes.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml FF HKLM\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012-12-04] ========================== Services (Whitelisted) ================= R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY) R2 AntiVirMailService; C:\Program Files\Avira\AntiVir Desktop\avmailc7.exe [908856 2014-02-03] (Avira Operations GmbH & Co. KG) R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440376 2014-02-03] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440376 2014-02-03] (Avira Operations GmbH & Co. KG) R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe [1011768 2014-02-03] (Avira Operations GmbH & Co. KG) S3 Droppix Service; C:\Program Files\Common Files\Droppix\DxService.exe [221184 2009-08-28] (Droppix) S2 KMService; C:\Windows\system32\srvany.exe [8192 2003-04-18] () R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22208 2013-10-23] (Microsoft Corporation) R2 NAUpdate; C:\Program Files\Nero\Update\NASvc.exe [769432 2012-07-13] (Nero AG) R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [280288 2013-10-23] (Microsoft Corporation) R2 TwonkyProxy; C:\Program Files\Twonky\TwonkyServer\twonkyproxy.exe [545608 2012-07-09] () R2 TwonkyServer; C:\Program Files\Twonky\TwonkyServer\twonkystarter.exe [549704 2012-07-09] (PacketVideo) R2 TwonkyWebDav; C:\Program Files\Twonky\TwonkyServer\twonkywebdav.exe [271176 2012-07-09] () S2 ca82e1a5; "c:\progra~1\optimi~1\OptProCrash.exe" [X] ==================== Drivers (Whitelisted) ==================== R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2014-02-03] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135648 2014-02-03] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2014-02-03] (Avira Operations GmbH & Co. KG) R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [69240 2014-02-03] (Avira Operations GmbH & Co. KG) S3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.) R0 hotcore3; C:\Windows\System32\DRIVERS\hotcore3.sys [40560 2010-05-20] (Paragon Software Group) R1 ISODrive; C:\Program Files\UltraISO\drivers\ISODrive.sys [82320 2010-01-29] (EZB Systems, Inc.) R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [214696 2013-09-27] (Microsoft Corporation) R1 MpKsl4d7e906b; c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{92264A49-2A80-4149-AE3C-586539D55F0B}\MpKsl4d7e906b.sys [40392 2014-02-07] (Microsoft Corporation) R0 oem-drv86; C:\Windows\System32\DRIVERS\oem-drv86.sys [28160 2014-02-07] (secr9tos) R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH) U3 DfSdkS; S3 VGPU; System32\drivers\rdvgkmd.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-02-07 20:54 - 2014-02-07 20:54 - 00001146 _____ () C:\Users\Knippi\Desktop\JRT.txt 2014-02-07 20:48 - 2014-02-04 08:38 - 01037530 _____ (Thisisu) C:\Users\Knippi\Desktop\JRT_NEW.exe 2014-02-07 20:47 - 2014-02-07 20:47 - 00004040 _____ () C:\Users\Knippi\Desktop\AdwCleaner[S0].txt 2014-02-07 20:38 - 2014-02-07 20:40 - 00000000 ____D () C:\AdwCleaner 2014-02-07 20:14 - 2014-02-07 20:15 - 01166132 _____ () C:\Users\Knippi\Desktop\adwcleaner.exe 2014-02-07 18:11 - 2014-02-07 18:11 - 00005815 _____ () C:\Users\Knippi\Desktop\save GMER.log 2014-02-07 17:44 - 2014-02-07 17:45 - 00380416 _____ () C:\Users\Knippi\Desktop\ieodktnk.exe 2014-02-07 17:39 - 2014-02-07 17:40 - 00020944 _____ () C:\Users\Knippi\Desktop\Addition.txt 2014-02-07 17:38 - 2014-02-07 20:57 - 00012124 _____ () C:\Users\Knippi\Desktop\FRST.txt 2014-02-07 17:38 - 2014-02-07 20:57 - 00000000 ____D () C:\FRST 2014-02-07 17:36 - 2014-02-07 17:37 - 01136640 _____ (Farbar) C:\Users\Knippi\Desktop\FRST.exe 2014-02-07 17:33 - 2014-02-07 17:33 - 00000474 _____ () C:\Users\Knippi\Desktop\defogger_disable.log 2014-02-07 17:33 - 2014-02-07 17:33 - 00000000 _____ () C:\Users\Knippi\defogger_reenable 2014-02-07 17:32 - 2014-02-07 17:32 - 00050477 _____ () C:\Users\Knippi\Desktop\Defogger.exe 2014-02-07 15:29 - 2014-02-07 15:29 - 00000000 ____D () C:\ProgramData\Oracle 2014-02-07 15:29 - 2013-12-18 21:04 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe 2014-02-07 15:28 - 2014-02-07 15:28 - 00005355 _____ () C:\Windows\system32\jupdate-1.7.0_51-b13.log 2014-02-07 15:28 - 2013-12-18 21:10 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll 2014-02-07 15:28 - 2013-12-18 21:04 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe 2014-02-07 15:28 - 2013-12-18 21:03 - 00174504 _____ (Oracle Corporation) C:\Windows\system32\java.exe 2014-02-05 23:35 - 2014-02-07 20:42 - 00000336 _____ () C:\Windows\setupact.log 2014-02-05 23:35 - 2014-02-05 23:35 - 00000000 _____ () C:\Windows\setuperr.log 2014-02-05 18:50 - 2013-11-26 10:23 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-02-05 18:50 - 2013-11-26 10:22 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-02-05 18:50 - 2013-11-26 09:53 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-02-05 18:50 - 2013-11-26 09:52 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-02-05 18:50 - 2013-11-26 09:38 - 02166784 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-02-05 18:50 - 2013-11-26 09:38 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-02-05 18:50 - 2013-11-26 09:36 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-02-05 18:50 - 2013-11-26 09:32 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-02-05 18:50 - 2013-11-26 09:29 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-02-05 18:50 - 2013-11-26 09:29 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-02-05 18:50 - 2013-11-26 09:28 - 00553472 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-02-05 18:50 - 2013-11-26 09:13 - 00208896 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-02-05 18:50 - 2013-11-26 08:32 - 01928192 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-02-05 18:50 - 2013-11-26 07:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-02-05 18:50 - 2013-11-26 07:33 - 01820160 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-02-05 18:50 - 2013-11-26 07:27 - 01157632 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-02-05 18:49 - 2013-11-26 11:11 - 17112576 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-02-05 18:49 - 2013-11-26 09:16 - 04243968 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-02-05 18:49 - 2013-11-26 08:26 - 11221504 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-02-04 22:36 - 2014-02-04 22:36 - 00001912 _____ () C:\Windows\epplauncher.mif 2014-02-04 22:36 - 2014-02-04 22:36 - 00000000 ____D () C:\Program Files\Microsoft Security Client 2014-02-04 22:27 - 2014-02-04 22:35 - 11157328 _____ (Microsoft Corporation) C:\Users\Knippi\Downloads\mseinstall.exe 2014-02-04 22:24 - 2014-02-04 22:24 - 00000000 ___HD () C:\Users\Knippi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup-Disabled 2014-02-04 21:14 - 2014-02-07 14:27 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable) 2014-02-04 00:50 - 2014-02-04 00:50 - 01051136 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-02-04 00:50 - 2014-02-04 00:50 - 00645120 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat 2014-02-04 00:50 - 2014-02-04 00:50 - 00610304 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00523776 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\html.iec 2014-02-04 00:50 - 2014-02-04 00:50 - 00244736 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00238288 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00233472 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00208384 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00182272 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00151552 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe 2014-02-04 00:50 - 2014-02-04 00:50 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe 2014-02-04 00:50 - 2014-02-04 00:50 - 00127488 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00083456 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe 2014-02-04 00:50 - 2014-02-04 00:50 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe 2014-02-04 00:50 - 2014-02-04 00:50 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx 2014-02-04 00:50 - 2014-02-04 00:50 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe 2014-02-04 00:50 - 2014-02-04 00:50 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe 2014-02-04 00:05 - 2014-02-04 00:05 - 00000000 ____D () C:\Windows\ERUNT 2014-02-04 00:00 - 2014-02-04 00:04 - 01037068 _____ (Thisisu) C:\Users\Knippi\Desktop\JRT.exe 2014-02-03 23:33 - 2014-02-07 14:04 - 00107224 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-02-03 23:30 - 2014-02-07 18:38 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-02-03 23:28 - 2014-02-07 14:27 - 00000000 ____D () C:\Users\Knippi\Desktop\mbar 2014-02-03 23:22 - 2014-02-03 23:28 - 12589848 _____ (Malwarebytes Corp.) C:\Users\Knippi\Desktop\mbar-1.07.0.1009.exe 2014-02-03 23:11 - 2014-02-07 14:30 - 00000000 ____D () C:\Program Files\7-Zip 2014-02-03 23:11 - 2014-02-03 23:11 - 01110476 _____ () C:\Users\Knippi\Downloads\7z920.exe 2014-02-03 21:17 - 2014-02-03 21:17 - 00000000 _____ () C:\Users\Knippi\AppData\Local\QSwitch.txt 2014-02-03 21:17 - 2014-02-03 21:17 - 00000000 _____ () C:\Users\Knippi\AppData\Local\DSwitch.txt 2014-02-03 21:17 - 2014-02-03 21:17 - 00000000 _____ () C:\Users\Knippi\AppData\Local\AtStart.txt 2014-01-23 12:35 - 2014-02-03 19:10 - 00000000 ____D () C:\ProgramData\Websteroids 2014-01-21 15:13 - 2014-02-03 19:10 - 00000000 ____D () C:\Users\Knippi\AppData\Roaming\Skype 2014-01-21 15:12 - 2014-02-03 19:10 - 00000000 ____D () C:\ProgramData\Skype 2014-01-21 15:12 - 2014-02-03 19:10 - 00000000 ____D () C:\Program Files\Skype 2014-01-21 15:10 - 2014-01-21 15:10 - 00657776 _____ (Conduit) C:\Users\Knippi\Downloads\Skype_TSV120179.exe 2014-01-17 18:28 - 2014-02-07 20:47 - 00000000 ____D () C:\Users\Knippi\AppData\Roaming\newnext.me 2014-01-17 18:28 - 2014-02-03 20:16 - 00000000 ____D () C:\Users\Knippi\AppData\Local\Mobogenie 2014-01-17 18:28 - 2014-01-17 18:28 - 00000000 ____D () C:\Users\Knippi\Documents\Mobogenie 2014-01-17 18:28 - 2014-01-17 18:28 - 00000000 ____D () C:\Users\Knippi\AppData\Local\genienext 2014-01-17 18:28 - 2014-01-17 18:28 - 00000000 ____D () C:\Users\Knippi\AppData\Local\cache 2014-01-17 18:28 - 2014-01-17 18:28 - 00000000 ____D () C:\Users\Knippi\.android 2014-01-17 18:26 - 2014-02-03 20:16 - 00000000 ____D () C:\Program Files\Mobogenie 2014-01-17 18:20 - 2014-01-17 18:20 - 00675988 _____ () C:\Users\Knippi\Downloads\Minecraft(1).exe 2014-01-17 17:00 - 2014-01-17 17:00 - 00000000 ____D () C:\Users\Knippi\AppData\Local\LogMeIn 2014-01-17 17:00 - 2014-01-17 17:00 - 00000000 ____D () C:\ProgramData\LogMeIn 2014-01-17 15:52 - 2014-01-17 15:52 - 05028760 _____ (Systweak Inc ) C:\Users\Knippi\Downloads\rcpsetup_chip_de_chip_de.exe 2014-01-16 16:36 - 2013-11-27 02:14 - 00258560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys 2014-01-16 16:36 - 2013-11-27 02:13 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys 2014-01-16 16:36 - 2013-11-27 02:13 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys 2014-01-16 16:36 - 2013-11-27 02:13 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys 2014-01-16 16:36 - 2013-11-27 02:13 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys 2014-01-16 16:36 - 2013-11-27 02:13 - 00020480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys 2014-01-16 16:36 - 2013-11-27 02:13 - 00006016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys 2014-01-16 16:36 - 2013-11-26 12:11 - 00240576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys 2014-01-16 16:36 - 2013-11-26 11:10 - 02349056 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-01-08 18:39 - 2014-02-07 14:52 - 00000000 ____D () C:\ProgramData\WPM 2014-01-08 18:39 - 2014-01-08 18:39 - 00000000 ____D () C:\Windows\system32\log ==================== One Month Modified Files and Folders ======= 2014-02-07 20:57 - 2014-02-07 17:38 - 00012124 _____ () C:\Users\Knippi\Desktop\FRST.txt 2014-02-07 20:57 - 2014-02-07 17:38 - 00000000 ____D () C:\FRST 2014-02-07 20:55 - 2012-12-18 10:11 - 00000000 ____D () C:\ProgramData\TwonkyServer 2014-02-07 20:54 - 2014-02-07 20:54 - 00001146 _____ () C:\Users\Knippi\Desktop\JRT.txt 2014-02-07 20:50 - 2009-07-14 05:34 - 00026352 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-02-07 20:50 - 2009-07-14 05:34 - 00026352 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-02-07 20:47 - 2014-02-07 20:47 - 00004040 _____ () C:\Users\Knippi\Desktop\AdwCleaner[S0].txt 2014-02-07 20:47 - 2014-01-17 18:28 - 00000000 ____D () C:\Users\Knippi\AppData\Roaming\newnext.me 2014-02-07 20:46 - 2012-12-01 17:28 - 01569977 _____ () C:\Windows\WindowsUpdate.log 2014-02-07 20:45 - 2012-12-01 18:01 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-02-07 20:42 - 2014-02-05 23:35 - 00000336 _____ () C:\Windows\setupact.log 2014-02-07 20:42 - 2009-07-14 05:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-02-07 20:41 - 2012-12-01 17:32 - 00028160 _____ (secr9tos) C:\Windows\system32\Drivers\oem-drv86.sys 2014-02-07 20:40 - 2014-02-07 20:38 - 00000000 ____D () C:\AdwCleaner 2014-02-07 20:40 - 2012-12-01 19:17 - 00000000 ____D () C:\Program Files\Common Files\DVDVideoSoft 2014-02-07 20:15 - 2014-02-07 20:14 - 01166132 _____ () C:\Users\Knippi\Desktop\adwcleaner.exe 2014-02-07 19:36 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\rescache 2014-02-07 18:38 - 2014-02-03 23:30 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-02-07 18:11 - 2014-02-07 18:11 - 00005815 _____ () C:\Users\Knippi\Desktop\save GMER.log 2014-02-07 17:45 - 2014-02-07 17:44 - 00380416 _____ () C:\Users\Knippi\Desktop\ieodktnk.exe 2014-02-07 17:40 - 2014-02-07 17:39 - 00020944 _____ () C:\Users\Knippi\Desktop\Addition.txt 2014-02-07 17:37 - 2014-02-07 17:36 - 01136640 _____ (Farbar) C:\Users\Knippi\Desktop\FRST.exe 2014-02-07 17:33 - 2014-02-07 17:33 - 00000474 _____ () C:\Users\Knippi\Desktop\defogger_disable.log 2014-02-07 17:33 - 2014-02-07 17:33 - 00000000 _____ () C:\Users\Knippi\defogger_reenable 2014-02-07 17:33 - 2012-12-01 17:36 - 00000000 ____D () C:\Users\Knippi 2014-02-07 17:32 - 2014-02-07 17:32 - 00050477 _____ () C:\Users\Knippi\Desktop\Defogger.exe 2014-02-07 17:31 - 2012-12-01 18:24 - 00000000 ____D () C:\Users\Knippi\Downloads\MSM 2014-02-07 16:27 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\Microsoft.NET 2014-02-07 15:29 - 2014-02-07 15:29 - 00000000 ____D () C:\ProgramData\Oracle 2014-02-07 15:28 - 2014-02-07 15:28 - 00005355 _____ () C:\Windows\system32\jupdate-1.7.0_51-b13.log 2014-02-07 15:28 - 2013-10-25 20:31 - 00000000 ____D () C:\Program Files\Java 2014-02-07 14:52 - 2014-01-08 18:39 - 00000000 ____D () C:\ProgramData\WPM 2014-02-07 14:43 - 2012-12-01 18:50 - 00000000 ____D () C:\Program Files\Common Files\Apple 2014-02-07 14:30 - 2014-02-03 23:11 - 00000000 ____D () C:\Program Files\7-Zip 2014-02-07 14:27 - 2014-02-04 21:14 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable) 2014-02-07 14:27 - 2014-02-03 23:28 - 00000000 ____D () C:\Users\Knippi\Desktop\mbar 2014-02-07 14:04 - 2014-02-03 23:33 - 00107224 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-02-07 13:59 - 2012-12-01 18:25 - 00002533 _____ () C:\Users\Public\Desktop\O&O SafeErase.lnk 2014-02-07 13:45 - 2009-07-14 05:52 - 00000000 ____D () C:\Windows\system32\FxsTmp 2014-02-05 23:35 - 2014-02-05 23:35 - 00000000 _____ () C:\Windows\setuperr.log 2014-02-05 23:32 - 2010-11-21 01:46 - 00000000 ____D () C:\Windows\system32\Drivers\de-DE 2014-02-05 23:32 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\de-DE 2014-02-05 18:57 - 2013-07-29 12:09 - 00000000 ____D () C:\Users\Knippi\AppData\Roaming\.minecraft 2014-02-05 18:49 - 2012-12-01 19:20 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-02-05 18:49 - 2009-07-14 03:04 - 00000478 _____ () C:\Windows\win.ini 2014-02-04 22:36 - 2014-02-04 22:36 - 00001912 _____ () C:\Windows\epplauncher.mif 2014-02-04 22:36 - 2014-02-04 22:36 - 00000000 ____D () C:\Program Files\Microsoft Security Client 2014-02-04 22:35 - 2014-02-04 22:27 - 11157328 _____ (Microsoft Corporation) C:\Users\Knippi\Downloads\mseinstall.exe 2014-02-04 22:24 - 2014-02-04 22:24 - 00000000 ___HD () C:\Users\Knippi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup-Disabled 2014-02-04 21:49 - 2012-12-01 18:01 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe 2014-02-04 21:49 - 2012-12-01 18:01 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl 2014-02-04 08:38 - 2014-02-07 20:48 - 01037530 _____ (Thisisu) C:\Users\Knippi\Desktop\JRT_NEW.exe 2014-02-04 00:53 - 2013-12-14 02:34 - 00185363 _____ () C:\Windows\IE11_main.log 2014-02-04 00:50 - 2014-02-04 00:50 - 01051136 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-02-04 00:50 - 2014-02-04 00:50 - 00645120 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat 2014-02-04 00:50 - 2014-02-04 00:50 - 00610304 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00523776 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\html.iec 2014-02-04 00:50 - 2014-02-04 00:50 - 00244736 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00238288 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00233472 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00208384 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00182272 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00151552 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe 2014-02-04 00:50 - 2014-02-04 00:50 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe 2014-02-04 00:50 - 2014-02-04 00:50 - 00127488 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00083456 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe 2014-02-04 00:50 - 2014-02-04 00:50 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe 2014-02-04 00:50 - 2014-02-04 00:50 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx 2014-02-04 00:50 - 2014-02-04 00:50 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe 2014-02-04 00:50 - 2014-02-04 00:50 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe 2014-02-04 00:05 - 2014-02-04 00:05 - 00000000 ____D () C:\Windows\ERUNT 2014-02-04 00:04 - 2014-02-04 00:00 - 01037068 _____ (Thisisu) C:\Users\Knippi\Desktop\JRT.exe 2014-02-03 23:53 - 2012-12-11 09:32 - 00281532 _____ () C:\Windows\PFRO.log 2014-02-03 23:28 - 2014-02-03 23:22 - 12589848 _____ (Malwarebytes Corp.) C:\Users\Knippi\Desktop\mbar-1.07.0.1009.exe 2014-02-03 23:11 - 2014-02-03 23:11 - 01110476 _____ () C:\Users\Knippi\Downloads\7z920.exe 2014-02-03 22:28 - 2009-07-14 03:03 - 51642368 _____ () C:\Windows\system32\config\SOFTWARE.gbck 2014-02-03 22:28 - 2009-07-14 03:03 - 14155776 _____ () C:\Windows\system32\config\SYSTEM.gbck 2014-02-03 22:28 - 2009-07-14 03:03 - 00262144 _____ () C:\Windows\system32\config\SECURITY.gbck 2014-02-03 22:28 - 2009-07-14 03:03 - 00262144 _____ () C:\Windows\system32\config\SAM.gbck 2014-02-03 22:28 - 2009-07-14 03:03 - 00262144 _____ () C:\Windows\system32\config\DEFAULT.gbck 2014-02-03 21:17 - 2014-02-03 21:17 - 00000000 _____ () C:\Users\Knippi\AppData\Local\QSwitch.txt 2014-02-03 21:17 - 2014-02-03 21:17 - 00000000 _____ () C:\Users\Knippi\AppData\Local\DSwitch.txt 2014-02-03 21:17 - 2014-02-03 21:17 - 00000000 _____ () C:\Users\Knippi\AppData\Local\AtStart.txt 2014-02-03 21:16 - 2012-12-01 17:56 - 00000000 ____D () C:\ProgramData\NVIDIA 2014-02-03 21:12 - 2012-12-11 09:47 - 00002016 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk 2014-02-03 21:09 - 2013-05-07 13:37 - 00069240 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys 2014-02-03 21:09 - 2012-12-11 09:46 - 00135648 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys 2014-02-03 21:09 - 2012-12-11 09:46 - 00090400 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys 2014-02-03 21:09 - 2012-12-11 09:46 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys 2014-02-03 20:16 - 2014-01-17 18:28 - 00000000 ____D () C:\Users\Knippi\AppData\Local\Mobogenie 2014-02-03 20:16 - 2014-01-17 18:26 - 00000000 ____D () C:\Program Files\Mobogenie 2014-02-03 20:16 - 2013-12-25 18:51 - 00000000 ____D () C:\Program Files\Mozilla Firefox 2014-02-03 20:16 - 2013-11-17 19:29 - 00000000 ____D () C:\Program Files\Mozilla Firefox.bak 2014-02-03 20:16 - 2013-09-19 16:46 - 00000000 ____D () C:\Windows\Minidump 2014-02-03 20:16 - 2012-12-01 18:55 - 00000000 ____D () C:\Users\Knippi\AppData\Roaming\Spotify 2014-02-03 19:37 - 2009-07-14 03:37 - 00000000 __RHD () C:\Users\Public\Libraries 2014-02-03 19:12 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\wfp 2014-02-03 19:10 - 2014-01-23 12:35 - 00000000 ____D () C:\ProgramData\Websteroids 2014-02-03 19:10 - 2014-01-21 15:13 - 00000000 ____D () C:\Users\Knippi\AppData\Roaming\Skype 2014-02-03 19:10 - 2014-01-21 15:12 - 00000000 ____D () C:\ProgramData\Skype 2014-02-03 19:10 - 2014-01-21 15:12 - 00000000 ____D () C:\Program Files\Skype 2014-02-03 19:10 - 2012-12-13 15:30 - 00000000 ____D () C:\Users\Knippi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\JoWooD 2014-02-03 19:10 - 2010-11-21 01:54 - 00000000 ___RD () C:\Users\Public\Recorded TV 2014-02-03 19:10 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\NDF 2014-02-03 19:09 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\registration 2014-02-03 19:07 - 2012-12-13 15:29 - 00000000 ____D () C:\Program Files\JoWooD 2014-02-02 11:04 - 2012-12-11 08:23 - 00000000 ____D () C:\Windows\system32\appmgmt 2014-01-21 15:10 - 2014-01-21 15:10 - 00657776 _____ (Conduit) C:\Users\Knippi\Downloads\Skype_TSV120179.exe 2014-01-19 08:32 - 2011-05-12 12:25 - 00231584 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe 2014-01-17 18:28 - 2014-01-17 18:28 - 00000000 ____D () C:\Users\Knippi\Documents\Mobogenie 2014-01-17 18:28 - 2014-01-17 18:28 - 00000000 ____D () C:\Users\Knippi\AppData\Local\genienext 2014-01-17 18:28 - 2014-01-17 18:28 - 00000000 ____D () C:\Users\Knippi\AppData\Local\cache 2014-01-17 18:28 - 2014-01-17 18:28 - 00000000 ____D () C:\Users\Knippi\.android 2014-01-17 18:20 - 2014-01-17 18:20 - 00675988 _____ () C:\Users\Knippi\Downloads\Minecraft(1).exe 2014-01-17 17:00 - 2014-01-17 17:00 - 00000000 ____D () C:\Users\Knippi\AppData\Local\LogMeIn 2014-01-17 17:00 - 2014-01-17 17:00 - 00000000 ____D () C:\ProgramData\LogMeIn 2014-01-17 15:52 - 2014-01-17 15:52 - 05028760 _____ (Systweak Inc ) C:\Users\Knippi\Downloads\rcpsetup_chip_de_chip_de.exe 2014-01-17 12:46 - 2009-07-14 05:33 - 00416488 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-01-17 12:27 - 2013-07-17 09:55 - 00000000 ____D () C:\Windows\system32\MRT 2014-01-17 12:23 - 2011-05-12 12:26 - 83425928 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-01-12 10:52 - 2013-08-02 10:42 - 00001148 _____ () C:\Users\Knippi\my_skin.txt 2014-01-08 18:39 - 2014-01-08 18:39 - 00000000 ____D () C:\Windows\system32\log 2014-01-08 17:37 - 2012-12-02 22:51 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service Files to move or delete: ==================== C:\Users\Knippi\AppData\Roaming\skype.ini Some content of TEMP: ==================== C:\Users\Knippi\AppData\Local\Temp\avgnt.exe C:\Users\Knippi\AppData\Local\Temp\First15.exe C:\Users\Knippi\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe C:\Users\Knippi\AppData\Local\Temp\nsrC64F.exe C:\Users\Knippi\AppData\Local\Temp\Quarantine.exe C:\Users\Knippi\AppData\Local\Temp\SIntf16.dll C:\Users\Knippi\AppData\Local\Temp\SPSetup.exe C:\Users\Knippi\AppData\Local\Temp\VP6Install.exe C:\Users\Knippi\AppData\Local\Temp\VP6VFW.dll ==================== Bamital & volsnap Check ================= C:\Windows\explorer.exe => MD5 is legit C:\Windows\system32\winlogon.exe => MD5 is legit C:\Windows\system32\wininit.exe => MD5 is legit C:\Windows\system32\svchost.exe => MD5 is legit C:\Windows\system32\services.exe => MD5 is legit C:\Windows\system32\User32.dll => MD5 is legit C:\Windows\system32\userinit.exe => MD5 is legit C:\Windows\system32\rpcss.dll => MD5 is legit C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-02-04 21:11 ==================== End Of Log ============================ |
08.02.2014, 15:06 | #4 |
/// the machine /// TB-Ausbilder | Windows 7: Trojaner gefunden und entfernt, sauber?ESET Online Scanner
Downloade Dir bitte SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
08.02.2014, 21:31 | #5 |
| Windows 7: Trojaner gefunden und entfernt, sauber? So, der ESET-scan hat vier Stunden gedauert Ich glaube aber, jetzt ist es gut?! (zumindest hoffe ich es) ESET: Code:
ATTFilter ESETSmartInstaller@High as downloader log: all ok # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6920 # api_version=3.0.2 # EOSSerial=d911b77b66c7094fb7fd083f92fb05cd # engine=16487 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=false # unsafe_checked=false # antistealth_checked=true # utc_time=2014-02-08 08:15:13 # local_time=2014-02-08 09:15:13 (+0100, Mitteleuropäische Zeit) # country="Germany" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=5893 16776574 100 94 18350059 143521704 0 0 # scanned=141531 # found=0 # cleaned=0 # scan_time=14405 Code:
ATTFilter Results of screen317's Security Check version 0.99.79 Windows 7 Service Pack 1 x86 (UAC is enabled) Internet Explorer 11 ``````````````Antivirus/Firewall Check:`````````````` Microsoft Security Essentials Avira Desktop Antivirus up to date! (On Access scanning disabled!) `````````Anti-malware/Other Utilities Check:````````` Java 7 Update 51 Adobe Flash Player 12.0.0.44 Adobe Reader XI Mozilla Firefox (26.0) ````````Process Check: objlist.exe by Laurent```````` Microsoft Security Essentials MSMpEng.exe Microsoft Security Essentials msseces.exe Avira Antivir avgnt.exe Avira Antivir avguard.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 07-02-2014 Ran by Knippi (administrator) on KNIPPI-PC on 08-02-2014 21:23:41 Running from C:\Users\Knippi\Desktop Microsoft Windows 7 Ultimate Service Pack 1 (X86) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) =================== (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe (ABBYY) C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe () C:\Program Files\Twonky\TwonkyServer\twonkyproxy.exe (PacketVideo) C:\Program Files\Twonky\TwonkyServer\twonkystarter.exe () C:\Program Files\Twonky\TwonkyServer\twonkywebdav.exe () C:\Program Files\Twonky\TwonkyServer\twonkyserver.exe ( Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\w32x86\3\E_FATIHAE.EXE (SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\w32x86\3\E_FATIHAE.EXE (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avmailc7.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe (Nero AG) C:\Program Files\Nero\Update\NASvc.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [NvCplDaemon] - C:\Windows\system32\NvCpl.dll [13826664 2009-10-03] (NVIDIA Corporation) HKLM\...\Run: [QlbCtrl.exe] - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [323640 2009-11-24] ( Hewlett-Packard Development Company, L.P.) HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [684600 2014-02-03] (Avira Operations GmbH & Co. KG) HKLM\...\Run: [MSC] - c:\Program Files\Microsoft Security Client\msseces.exe [948440 2013-10-23] (Microsoft Corporation) HKLM\...\Run: [BCSSync] - C:\Program Files\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation) HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKU\S-1-5-21-3740978952-1829205604-2155228767-1000\...\Run: [EPLTarget\P0000000000000000] - C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIHAE.EXE [249440 2013-01-02] (SEIKO EPSON CORPORATION) HKU\S-1-5-21-3740978952-1829205604-2155228767-1000\...\Run: [EPLTarget\P0000000000000001] - C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIHAE.EXE [249440 2013-01-02] (SEIKO EPSON CORPORATION) HKU\S-1-5-21-3740978952-1829205604-2155228767-1000\...\Run: [NextLive] - C:\Windows\system32\rundll32.exe "C:\Users\Knippi\AppData\Roaming\newnext.me\nengine.dll",EntryPoint -m l ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x409190C1E2CFCD01 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE URLSearchHook: HKCU - (No Name) - {5bcf818d-78c8-41b8-ba89-65c5fdac4fc4} - No File SearchScopes: HKLM - DefaultScope value is missing. BHO: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC) BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.) BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.) DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\Knippi\AppData\Roaming\Mozilla\Firefox\Profiles\97id7u2z.default-1391546280742 FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_44.dll () FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin: @VideoDownloadConverter_4z.com/Plugin - C:\Program Files\VideoDownloadConverter_4z\bar\1.bin\NP4zStub.dll No File FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Users\Knippi\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.) FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\delta-homes.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml FF HKLM\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012-12-04] ========================== Services (Whitelisted) ================= R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY) R2 AntiVirMailService; C:\Program Files\Avira\AntiVir Desktop\avmailc7.exe [908856 2014-02-03] (Avira Operations GmbH & Co. KG) R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440376 2014-02-03] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440376 2014-02-03] (Avira Operations GmbH & Co. KG) R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe [1011768 2014-02-03] (Avira Operations GmbH & Co. KG) S3 Droppix Service; C:\Program Files\Common Files\Droppix\DxService.exe [221184 2009-08-28] (Droppix) S2 KMService; C:\Windows\system32\srvany.exe [8192 2003-04-18] () R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22208 2013-10-23] (Microsoft Corporation) R2 NAUpdate; C:\Program Files\Nero\Update\NASvc.exe [769432 2012-07-13] (Nero AG) R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [280288 2013-10-23] (Microsoft Corporation) R2 TwonkyProxy; C:\Program Files\Twonky\TwonkyServer\twonkyproxy.exe [545608 2012-07-09] () R2 TwonkyServer; C:\Program Files\Twonky\TwonkyServer\twonkystarter.exe [549704 2012-07-09] (PacketVideo) R2 TwonkyWebDav; C:\Program Files\Twonky\TwonkyServer\twonkywebdav.exe [271176 2012-07-09] () S2 ca82e1a5; "c:\progra~1\optimi~1\OptProCrash.exe" [X] ==================== Drivers (Whitelisted) ==================== R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2014-02-03] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135648 2014-02-03] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2014-02-03] (Avira Operations GmbH & Co. KG) R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [69240 2014-02-03] (Avira Operations GmbH & Co. KG) S3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.) R0 hotcore3; C:\Windows\System32\DRIVERS\hotcore3.sys [40560 2010-05-20] (Paragon Software Group) R1 ISODrive; C:\Program Files\UltraISO\drivers\ISODrive.sys [82320 2010-01-29] (EZB Systems, Inc.) R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [214696 2013-09-27] (Microsoft Corporation) R0 oem-drv86; C:\Windows\System32\DRIVERS\oem-drv86.sys [28160 2014-02-08] (secr9tos) R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH) U3 DfSdkS; S3 VGPU; System32\drivers\rdvgkmd.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-02-08 21:23 - 2014-02-08 21:23 - 00000898 _____ () C:\Users\Knippi\Desktop\checkup.txt 2014-02-08 21:19 - 2014-02-08 21:20 - 00987425 _____ () C:\Users\Knippi\Desktop\SecurityCheck.exe 2014-02-08 16:53 - 2014-02-08 16:53 - 00000000 ____D () C:\Program Files\ESET 2014-02-08 16:50 - 2014-02-08 16:51 - 02347384 _____ (ESET) C:\Users\Knippi\Desktop\esetsmartinstaller_enu.exe 2014-02-07 20:54 - 2014-02-07 20:54 - 00001146 _____ () C:\Users\Knippi\Desktop\JRT.txt 2014-02-07 20:48 - 2014-02-04 08:38 - 01037530 _____ (Thisisu) C:\Users\Knippi\Desktop\JRT_NEW.exe 2014-02-07 20:47 - 2014-02-07 20:47 - 00004040 _____ () C:\Users\Knippi\Desktop\AdwCleaner[S0].txt 2014-02-07 20:38 - 2014-02-07 20:40 - 00000000 ____D () C:\AdwCleaner 2014-02-07 20:14 - 2014-02-07 20:15 - 01166132 _____ () C:\Users\Knippi\Desktop\adwcleaner.exe 2014-02-07 18:11 - 2014-02-07 18:11 - 00005815 _____ () C:\Users\Knippi\Desktop\save GMER.log 2014-02-07 17:44 - 2014-02-07 17:45 - 00380416 _____ () C:\Users\Knippi\Desktop\ieodktnk.exe 2014-02-07 17:39 - 2014-02-07 17:40 - 00020944 _____ () C:\Users\Knippi\Desktop\Addition.txt 2014-02-07 17:38 - 2014-02-08 21:23 - 00011939 _____ () C:\Users\Knippi\Desktop\FRST.txt 2014-02-07 17:38 - 2014-02-08 21:23 - 00000000 ____D () C:\FRST 2014-02-07 17:36 - 2014-02-07 17:37 - 01136640 _____ (Farbar) C:\Users\Knippi\Desktop\FRST.exe 2014-02-07 17:33 - 2014-02-07 17:33 - 00000474 _____ () C:\Users\Knippi\Desktop\defogger_disable.log 2014-02-07 17:33 - 2014-02-07 17:33 - 00000000 _____ () C:\Users\Knippi\defogger_reenable 2014-02-07 17:32 - 2014-02-07 17:32 - 00050477 _____ () C:\Users\Knippi\Desktop\Defogger.exe 2014-02-07 15:29 - 2014-02-07 15:29 - 00000000 ____D () C:\ProgramData\Oracle 2014-02-07 15:29 - 2013-12-18 21:04 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe 2014-02-07 15:28 - 2014-02-07 15:28 - 00005355 _____ () C:\Windows\system32\jupdate-1.7.0_51-b13.log 2014-02-07 15:28 - 2013-12-18 21:10 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll 2014-02-07 15:28 - 2013-12-18 21:04 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe 2014-02-07 15:28 - 2013-12-18 21:03 - 00174504 _____ (Oracle Corporation) C:\Windows\system32\java.exe 2014-02-05 23:35 - 2014-02-08 16:46 - 00000392 _____ () C:\Windows\setupact.log 2014-02-05 23:35 - 2014-02-05 23:35 - 00000000 _____ () C:\Windows\setuperr.log 2014-02-05 18:50 - 2013-11-26 10:23 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-02-05 18:50 - 2013-11-26 10:22 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-02-05 18:50 - 2013-11-26 09:53 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-02-05 18:50 - 2013-11-26 09:52 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-02-05 18:50 - 2013-11-26 09:38 - 02166784 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-02-05 18:50 - 2013-11-26 09:38 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-02-05 18:50 - 2013-11-26 09:36 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-02-05 18:50 - 2013-11-26 09:32 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-02-05 18:50 - 2013-11-26 09:29 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-02-05 18:50 - 2013-11-26 09:29 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-02-05 18:50 - 2013-11-26 09:28 - 00553472 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-02-05 18:50 - 2013-11-26 09:13 - 00208896 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-02-05 18:50 - 2013-11-26 08:32 - 01928192 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-02-05 18:50 - 2013-11-26 07:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-02-05 18:50 - 2013-11-26 07:33 - 01820160 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-02-05 18:50 - 2013-11-26 07:27 - 01157632 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-02-05 18:49 - 2013-11-26 11:11 - 17112576 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-02-05 18:49 - 2013-11-26 09:16 - 04243968 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-02-05 18:49 - 2013-11-26 08:26 - 11221504 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-02-04 22:36 - 2014-02-04 22:36 - 00001912 _____ () C:\Windows\epplauncher.mif 2014-02-04 22:36 - 2014-02-04 22:36 - 00000000 ____D () C:\Program Files\Microsoft Security Client 2014-02-04 22:27 - 2014-02-04 22:35 - 11157328 _____ (Microsoft Corporation) C:\Users\Knippi\Downloads\mseinstall.exe 2014-02-04 22:24 - 2014-02-04 22:24 - 00000000 ___HD () C:\Users\Knippi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup-Disabled 2014-02-04 21:14 - 2014-02-07 14:27 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable) 2014-02-04 00:50 - 2014-02-04 00:50 - 01051136 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-02-04 00:50 - 2014-02-04 00:50 - 00645120 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat 2014-02-04 00:50 - 2014-02-04 00:50 - 00610304 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00523776 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\html.iec 2014-02-04 00:50 - 2014-02-04 00:50 - 00244736 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00238288 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00233472 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00208384 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00182272 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00151552 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe 2014-02-04 00:50 - 2014-02-04 00:50 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe 2014-02-04 00:50 - 2014-02-04 00:50 - 00127488 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00083456 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe 2014-02-04 00:50 - 2014-02-04 00:50 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe 2014-02-04 00:50 - 2014-02-04 00:50 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx 2014-02-04 00:50 - 2014-02-04 00:50 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe 2014-02-04 00:50 - 2014-02-04 00:50 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe 2014-02-04 00:05 - 2014-02-04 00:05 - 00000000 ____D () C:\Windows\ERUNT 2014-02-04 00:00 - 2014-02-04 00:04 - 01037068 _____ (Thisisu) C:\Users\Knippi\Desktop\JRT.exe 2014-02-03 23:33 - 2014-02-07 14:04 - 00107224 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-02-03 23:30 - 2014-02-07 18:38 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-02-03 23:28 - 2014-02-07 14:27 - 00000000 ____D () C:\Users\Knippi\Desktop\mbar 2014-02-03 23:22 - 2014-02-03 23:28 - 12589848 _____ (Malwarebytes Corp.) C:\Users\Knippi\Desktop\mbar-1.07.0.1009.exe 2014-02-03 23:11 - 2014-02-07 14:30 - 00000000 ____D () C:\Program Files\7-Zip 2014-02-03 23:11 - 2014-02-03 23:11 - 01110476 _____ () C:\Users\Knippi\Downloads\7z920.exe 2014-02-03 21:17 - 2014-02-03 21:17 - 00000000 _____ () C:\Users\Knippi\AppData\Local\QSwitch.txt 2014-02-03 21:17 - 2014-02-03 21:17 - 00000000 _____ () C:\Users\Knippi\AppData\Local\DSwitch.txt 2014-02-03 21:17 - 2014-02-03 21:17 - 00000000 _____ () C:\Users\Knippi\AppData\Local\AtStart.txt 2014-01-23 12:35 - 2014-02-03 19:10 - 00000000 ____D () C:\ProgramData\Websteroids 2014-01-21 15:13 - 2014-02-03 19:10 - 00000000 ____D () C:\Users\Knippi\AppData\Roaming\Skype 2014-01-21 15:12 - 2014-02-03 19:10 - 00000000 ____D () C:\ProgramData\Skype 2014-01-21 15:12 - 2014-02-03 19:10 - 00000000 ____D () C:\Program Files\Skype 2014-01-21 15:10 - 2014-01-21 15:10 - 00657776 _____ (Conduit) C:\Users\Knippi\Downloads\Skype_TSV120179.exe 2014-01-17 18:28 - 2014-02-08 16:46 - 00000000 ____D () C:\Users\Knippi\AppData\Roaming\newnext.me 2014-01-17 18:28 - 2014-02-03 20:16 - 00000000 ____D () C:\Users\Knippi\AppData\Local\Mobogenie 2014-01-17 18:28 - 2014-01-17 18:28 - 00000000 ____D () C:\Users\Knippi\Documents\Mobogenie 2014-01-17 18:28 - 2014-01-17 18:28 - 00000000 ____D () C:\Users\Knippi\AppData\Local\genienext 2014-01-17 18:28 - 2014-01-17 18:28 - 00000000 ____D () C:\Users\Knippi\AppData\Local\cache 2014-01-17 18:28 - 2014-01-17 18:28 - 00000000 ____D () C:\Users\Knippi\.android 2014-01-17 18:26 - 2014-02-03 20:16 - 00000000 ____D () C:\Program Files\Mobogenie 2014-01-17 18:20 - 2014-01-17 18:20 - 00675988 _____ () C:\Users\Knippi\Downloads\Minecraft(1).exe 2014-01-17 17:00 - 2014-01-17 17:00 - 00000000 ____D () C:\Users\Knippi\AppData\Local\LogMeIn 2014-01-17 17:00 - 2014-01-17 17:00 - 00000000 ____D () C:\ProgramData\LogMeIn 2014-01-17 15:52 - 2014-01-17 15:52 - 05028760 _____ (Systweak Inc ) C:\Users\Knippi\Downloads\rcpsetup_chip_de_chip_de.exe 2014-01-16 16:36 - 2013-11-27 02:14 - 00258560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys 2014-01-16 16:36 - 2013-11-27 02:13 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys 2014-01-16 16:36 - 2013-11-27 02:13 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys 2014-01-16 16:36 - 2013-11-27 02:13 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys 2014-01-16 16:36 - 2013-11-27 02:13 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys 2014-01-16 16:36 - 2013-11-27 02:13 - 00020480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys 2014-01-16 16:36 - 2013-11-27 02:13 - 00006016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys 2014-01-16 16:36 - 2013-11-26 12:11 - 00240576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys 2014-01-16 16:36 - 2013-11-26 11:10 - 02349056 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys ==================== One Month Modified Files and Folders ======= 2014-02-08 21:23 - 2014-02-08 21:23 - 00000898 _____ () C:\Users\Knippi\Desktop\checkup.txt 2014-02-08 21:23 - 2014-02-07 17:38 - 00011939 _____ () C:\Users\Knippi\Desktop\FRST.txt 2014-02-08 21:23 - 2014-02-07 17:38 - 00000000 ____D () C:\FRST 2014-02-08 21:20 - 2014-02-08 21:19 - 00987425 _____ () C:\Users\Knippi\Desktop\SecurityCheck.exe 2014-02-08 21:16 - 2012-12-18 10:11 - 00000000 ____D () C:\ProgramData\TwonkyServer 2014-02-08 20:45 - 2012-12-01 18:01 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-02-08 20:20 - 2012-12-01 17:28 - 01624236 _____ () C:\Windows\WindowsUpdate.log 2014-02-08 16:54 - 2009-07-14 05:34 - 00026352 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-02-08 16:54 - 2009-07-14 05:34 - 00026352 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-02-08 16:53 - 2014-02-08 16:53 - 00000000 ____D () C:\Program Files\ESET 2014-02-08 16:51 - 2014-02-08 16:50 - 02347384 _____ (ESET) C:\Users\Knippi\Desktop\esetsmartinstaller_enu.exe 2014-02-08 16:48 - 2009-07-14 05:52 - 00000000 ____D () C:\Windows\system32\FxsTmp 2014-02-08 16:46 - 2014-02-05 23:35 - 00000392 _____ () C:\Windows\setupact.log 2014-02-08 16:46 - 2014-01-17 18:28 - 00000000 ____D () C:\Users\Knippi\AppData\Roaming\newnext.me 2014-02-08 16:46 - 2009-07-14 05:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-02-08 16:45 - 2012-12-01 17:32 - 00028160 _____ (secr9tos) C:\Windows\system32\Drivers\oem-drv86.sys 2014-02-07 20:54 - 2014-02-07 20:54 - 00001146 _____ () C:\Users\Knippi\Desktop\JRT.txt 2014-02-07 20:47 - 2014-02-07 20:47 - 00004040 _____ () C:\Users\Knippi\Desktop\AdwCleaner[S0].txt 2014-02-07 20:40 - 2014-02-07 20:38 - 00000000 ____D () C:\AdwCleaner 2014-02-07 20:40 - 2012-12-01 19:17 - 00000000 ____D () C:\Program Files\Common Files\DVDVideoSoft 2014-02-07 20:15 - 2014-02-07 20:14 - 01166132 _____ () C:\Users\Knippi\Desktop\adwcleaner.exe 2014-02-07 19:36 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\rescache 2014-02-07 18:38 - 2014-02-03 23:30 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-02-07 18:11 - 2014-02-07 18:11 - 00005815 _____ () C:\Users\Knippi\Desktop\save GMER.log 2014-02-07 17:45 - 2014-02-07 17:44 - 00380416 _____ () C:\Users\Knippi\Desktop\ieodktnk.exe 2014-02-07 17:40 - 2014-02-07 17:39 - 00020944 _____ () C:\Users\Knippi\Desktop\Addition.txt 2014-02-07 17:37 - 2014-02-07 17:36 - 01136640 _____ (Farbar) C:\Users\Knippi\Desktop\FRST.exe 2014-02-07 17:33 - 2014-02-07 17:33 - 00000474 _____ () C:\Users\Knippi\Desktop\defogger_disable.log 2014-02-07 17:33 - 2014-02-07 17:33 - 00000000 _____ () C:\Users\Knippi\defogger_reenable 2014-02-07 17:33 - 2012-12-01 17:36 - 00000000 ____D () C:\Users\Knippi 2014-02-07 17:32 - 2014-02-07 17:32 - 00050477 _____ () C:\Users\Knippi\Desktop\Defogger.exe 2014-02-07 17:31 - 2012-12-01 18:24 - 00000000 ____D () C:\Users\Knippi\Downloads\MSM 2014-02-07 16:27 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\Microsoft.NET 2014-02-07 15:29 - 2014-02-07 15:29 - 00000000 ____D () C:\ProgramData\Oracle 2014-02-07 15:28 - 2014-02-07 15:28 - 00005355 _____ () C:\Windows\system32\jupdate-1.7.0_51-b13.log 2014-02-07 15:28 - 2013-10-25 20:31 - 00000000 ____D () C:\Program Files\Java 2014-02-07 14:52 - 2014-01-08 18:39 - 00000000 ____D () C:\ProgramData\WPM 2014-02-07 14:43 - 2012-12-01 18:50 - 00000000 ____D () C:\Program Files\Common Files\Apple 2014-02-07 14:30 - 2014-02-03 23:11 - 00000000 ____D () C:\Program Files\7-Zip 2014-02-07 14:27 - 2014-02-04 21:14 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable) 2014-02-07 14:27 - 2014-02-03 23:28 - 00000000 ____D () C:\Users\Knippi\Desktop\mbar 2014-02-07 14:04 - 2014-02-03 23:33 - 00107224 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-02-07 13:59 - 2012-12-01 18:25 - 00002533 _____ () C:\Users\Public\Desktop\O&O SafeErase.lnk 2014-02-05 23:35 - 2014-02-05 23:35 - 00000000 _____ () C:\Windows\setuperr.log 2014-02-05 23:32 - 2010-11-21 01:46 - 00000000 ____D () C:\Windows\system32\Drivers\de-DE 2014-02-05 23:32 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\de-DE 2014-02-05 18:57 - 2013-07-29 12:09 - 00000000 ____D () C:\Users\Knippi\AppData\Roaming\.minecraft 2014-02-05 18:49 - 2012-12-01 19:20 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-02-05 18:49 - 2009-07-14 03:04 - 00000478 _____ () C:\Windows\win.ini 2014-02-04 22:36 - 2014-02-04 22:36 - 00001912 _____ () C:\Windows\epplauncher.mif 2014-02-04 22:36 - 2014-02-04 22:36 - 00000000 ____D () C:\Program Files\Microsoft Security Client 2014-02-04 22:35 - 2014-02-04 22:27 - 11157328 _____ (Microsoft Corporation) C:\Users\Knippi\Downloads\mseinstall.exe 2014-02-04 22:24 - 2014-02-04 22:24 - 00000000 ___HD () C:\Users\Knippi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup-Disabled 2014-02-04 21:49 - 2012-12-01 18:01 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe 2014-02-04 21:49 - 2012-12-01 18:01 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl 2014-02-04 08:38 - 2014-02-07 20:48 - 01037530 _____ (Thisisu) C:\Users\Knippi\Desktop\JRT_NEW.exe 2014-02-04 00:53 - 2013-12-14 02:34 - 00185363 _____ () C:\Windows\IE11_main.log 2014-02-04 00:50 - 2014-02-04 00:50 - 01051136 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-02-04 00:50 - 2014-02-04 00:50 - 00645120 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat 2014-02-04 00:50 - 2014-02-04 00:50 - 00610304 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00523776 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\html.iec 2014-02-04 00:50 - 2014-02-04 00:50 - 00244736 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00238288 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00233472 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00208384 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00182272 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00151552 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe 2014-02-04 00:50 - 2014-02-04 00:50 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe 2014-02-04 00:50 - 2014-02-04 00:50 - 00127488 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00083456 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe 2014-02-04 00:50 - 2014-02-04 00:50 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe 2014-02-04 00:50 - 2014-02-04 00:50 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx 2014-02-04 00:50 - 2014-02-04 00:50 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll 2014-02-04 00:50 - 2014-02-04 00:50 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe 2014-02-04 00:50 - 2014-02-04 00:50 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe 2014-02-04 00:05 - 2014-02-04 00:05 - 00000000 ____D () C:\Windows\ERUNT 2014-02-04 00:04 - 2014-02-04 00:00 - 01037068 _____ (Thisisu) C:\Users\Knippi\Desktop\JRT.exe 2014-02-03 23:53 - 2012-12-11 09:32 - 00281532 _____ () C:\Windows\PFRO.log 2014-02-03 23:28 - 2014-02-03 23:22 - 12589848 _____ (Malwarebytes Corp.) C:\Users\Knippi\Desktop\mbar-1.07.0.1009.exe 2014-02-03 23:11 - 2014-02-03 23:11 - 01110476 _____ () C:\Users\Knippi\Downloads\7z920.exe 2014-02-03 22:28 - 2009-07-14 03:03 - 51642368 _____ () C:\Windows\system32\config\SOFTWARE.gbck 2014-02-03 22:28 - 2009-07-14 03:03 - 14155776 _____ () C:\Windows\system32\config\SYSTEM.gbck 2014-02-03 22:28 - 2009-07-14 03:03 - 00262144 _____ () C:\Windows\system32\config\SECURITY.gbck 2014-02-03 22:28 - 2009-07-14 03:03 - 00262144 _____ () C:\Windows\system32\config\SAM.gbck 2014-02-03 22:28 - 2009-07-14 03:03 - 00262144 _____ () C:\Windows\system32\config\DEFAULT.gbck 2014-02-03 21:17 - 2014-02-03 21:17 - 00000000 _____ () C:\Users\Knippi\AppData\Local\QSwitch.txt 2014-02-03 21:17 - 2014-02-03 21:17 - 00000000 _____ () C:\Users\Knippi\AppData\Local\DSwitch.txt 2014-02-03 21:17 - 2014-02-03 21:17 - 00000000 _____ () C:\Users\Knippi\AppData\Local\AtStart.txt 2014-02-03 21:16 - 2012-12-01 17:56 - 00000000 ____D () C:\ProgramData\NVIDIA 2014-02-03 21:12 - 2012-12-11 09:47 - 00002016 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk 2014-02-03 21:09 - 2013-05-07 13:37 - 00069240 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys 2014-02-03 21:09 - 2012-12-11 09:46 - 00135648 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys 2014-02-03 21:09 - 2012-12-11 09:46 - 00090400 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys 2014-02-03 21:09 - 2012-12-11 09:46 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys 2014-02-03 20:16 - 2014-01-17 18:28 - 00000000 ____D () C:\Users\Knippi\AppData\Local\Mobogenie 2014-02-03 20:16 - 2014-01-17 18:26 - 00000000 ____D () C:\Program Files\Mobogenie 2014-02-03 20:16 - 2013-12-25 18:51 - 00000000 ____D () C:\Program Files\Mozilla Firefox 2014-02-03 20:16 - 2013-11-17 19:29 - 00000000 ____D () C:\Program Files\Mozilla Firefox.bak 2014-02-03 20:16 - 2013-09-19 16:46 - 00000000 ____D () C:\Windows\Minidump 2014-02-03 20:16 - 2012-12-01 18:55 - 00000000 ____D () C:\Users\Knippi\AppData\Roaming\Spotify 2014-02-03 19:37 - 2009-07-14 03:37 - 00000000 __RHD () C:\Users\Public\Libraries 2014-02-03 19:12 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\wfp 2014-02-03 19:10 - 2014-01-23 12:35 - 00000000 ____D () C:\ProgramData\Websteroids 2014-02-03 19:10 - 2014-01-21 15:13 - 00000000 ____D () C:\Users\Knippi\AppData\Roaming\Skype 2014-02-03 19:10 - 2014-01-21 15:12 - 00000000 ____D () C:\ProgramData\Skype 2014-02-03 19:10 - 2014-01-21 15:12 - 00000000 ____D () C:\Program Files\Skype 2014-02-03 19:10 - 2012-12-13 15:30 - 00000000 ____D () C:\Users\Knippi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\JoWooD 2014-02-03 19:10 - 2010-11-21 01:54 - 00000000 ___RD () C:\Users\Public\Recorded TV 2014-02-03 19:10 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\NDF 2014-02-03 19:09 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\registration 2014-02-03 19:07 - 2012-12-13 15:29 - 00000000 ____D () C:\Program Files\JoWooD 2014-02-02 11:04 - 2012-12-11 08:23 - 00000000 ____D () C:\Windows\system32\appmgmt 2014-01-21 15:10 - 2014-01-21 15:10 - 00657776 _____ (Conduit) C:\Users\Knippi\Downloads\Skype_TSV120179.exe 2014-01-19 08:32 - 2011-05-12 12:25 - 00231584 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe 2014-01-17 18:28 - 2014-01-17 18:28 - 00000000 ____D () C:\Users\Knippi\Documents\Mobogenie 2014-01-17 18:28 - 2014-01-17 18:28 - 00000000 ____D () C:\Users\Knippi\AppData\Local\genienext 2014-01-17 18:28 - 2014-01-17 18:28 - 00000000 ____D () C:\Users\Knippi\AppData\Local\cache 2014-01-17 18:28 - 2014-01-17 18:28 - 00000000 ____D () C:\Users\Knippi\.android 2014-01-17 18:20 - 2014-01-17 18:20 - 00675988 _____ () C:\Users\Knippi\Downloads\Minecraft(1).exe 2014-01-17 17:00 - 2014-01-17 17:00 - 00000000 ____D () C:\Users\Knippi\AppData\Local\LogMeIn 2014-01-17 17:00 - 2014-01-17 17:00 - 00000000 ____D () C:\ProgramData\LogMeIn 2014-01-17 15:52 - 2014-01-17 15:52 - 05028760 _____ (Systweak Inc ) C:\Users\Knippi\Downloads\rcpsetup_chip_de_chip_de.exe 2014-01-17 12:46 - 2009-07-14 05:33 - 00416488 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-01-17 12:27 - 2013-07-17 09:55 - 00000000 ____D () C:\Windows\system32\MRT 2014-01-17 12:23 - 2011-05-12 12:26 - 83425928 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-01-12 10:52 - 2013-08-02 10:42 - 00001148 _____ () C:\Users\Knippi\my_skin.txt Files to move or delete: ==================== C:\Users\Knippi\AppData\Roaming\skype.ini Some content of TEMP: ==================== C:\Users\Knippi\AppData\Local\Temp\avgnt.exe C:\Users\Knippi\AppData\Local\Temp\First15.exe C:\Users\Knippi\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe C:\Users\Knippi\AppData\Local\Temp\nsrC64F.exe C:\Users\Knippi\AppData\Local\Temp\Quarantine.exe C:\Users\Knippi\AppData\Local\Temp\SIntf16.dll C:\Users\Knippi\AppData\Local\Temp\SPSetup.exe C:\Users\Knippi\AppData\Local\Temp\VP6Install.exe C:\Users\Knippi\AppData\Local\Temp\VP6VFW.dll ==================== Bamital & volsnap Check ================= C:\Windows\explorer.exe => MD5 is legit C:\Windows\system32\winlogon.exe => MD5 is legit C:\Windows\system32\wininit.exe => MD5 is legit C:\Windows\system32\svchost.exe => MD5 is legit C:\Windows\system32\services.exe => MD5 is legit C:\Windows\system32\User32.dll => MD5 is legit C:\Windows\system32\userinit.exe => MD5 is legit C:\Windows\system32\rpcss.dll => MD5 is legit C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-02-04 21:11 ==================== End Of Log ============================ |
09.02.2014, 16:56 | #6 |
/// the machine /// TB-Ausbilder | Windows 7: Trojaner gefunden und entfernt, sauber? Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter C:\Users\Knippi\AppData\Roaming\skype.ini Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Fertig Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ --> Windows 7: Trojaner gefunden und entfernt, sauber? |
09.02.2014, 20:35 | #7 |
| Windows 7: Trojaner gefunden und entfernt, sauber? Vielen Dank für Deine schnelle Hilfe, es scheint jetzt alles in Ordnung zu sein?! :-) Fixlog: Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 09-02-2014 02 Ran by Knippi at 2014-02-09 20:28:37 Run:1 Running from C:\Users\Knippi\Desktop Boot Mode: Normal ============================================== Content of fixlist: ***************** C:\Users\Knippi\AppData\Roaming\skype.ini ***************** C:\Users\Knippi\AppData\Roaming\skype.ini => Moved successfully. ==== End of Fixlog ==== |
10.02.2014, 17:11 | #8 |
/// the machine /// TB-Ausbilder | Windows 7: Trojaner gefunden und entfernt, sauber? Gern Geschehen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
Themen zu Windows 7: Trojaner gefunden und entfernt, sauber? |
administrator, adware.agent, adware.installbrain, antivirus, avira, defender, dvdvideosoft ltd., firefox, flash player, iexplore.exe, launch, mobogenie, mobogenie entfernen, mozilla, nextlive, registry, security, services.exe, svchost.exe, system, trojan.downloader, trojan.ransom.gend, trojan:js/medfos.b, trojaner, windows, winlogon.exe |