| |
| |||||||
Log-Analyse und Auswertung: Windows 7: Virenbefall durch AntiVir entdeckt TR/Dropper.MSIL.43179Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
05.03.2014, 16:37
| #1 |
| |  Windows 7: Virenbefall durch AntiVir entdeckt TR/Dropper.MSIL.43179 Hallo zusammen! Als ich heute meinen USB Stick an einem anderen PC angeschlossen habe, hat Sophos darauf einen Virus erkannt. Daraufhin hab ich meinen PC mit AntiVir und Malwarebytes AntiMalware gescannt und es hat jeweils zwei Funde regestriert, aber unterschiedliche. zuerst mal Defogger Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 15:45 on 05/03/2014 (Sandra)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 05-03-2014
Ran by Sandra (administrator) on SANDRAS-LAPTOP on 05-03-2014 15:45:46
Running from C:\Users\Sandra\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\system32\atiesrxx.exe
(ASUSTeK Computer Inc.) C:\Windows\system32\FBAgent.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
(AMD) C:\Windows\system32\atieclxx.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
( ) C:\Windows\system32\lxczcoms.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
() C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(ASUS) C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe
(ASUS) C:\Program Files\P4G\BatteryLife.exe
(ASUS) C:\Windows\AsScrPro.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(ELAN Microelectronic Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Lexmark International, Inc.) C:\Program Files (x86)\Lexmark 1200 Series\LXCZbmgr.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Google Inc.) C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
() C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
(Lexmark International, Inc.) C:\Program Files (x86)\Lexmark 1200 Series\lxczbmon.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
() C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(APN) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Premium Sound Control Panel\SRSPremiumPanel_64.exe
(Dropbox, Inc.) C:\Users\Sandra\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
(ELAN Microelectronic Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(asus) C:\Program Files (x86)\ASUS\ControlDeck\ControlDeck.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
() C:\Users\Sandra\Downloads\Defogger.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [SmartAudio] - C:\Program Files\CONEXANT\SAII\SAIICpl.exe [316032 2010-12-14] (Conexant systems, Inc.)
HKLM\...\Run: [ETDWare] - C:\Program Files\Elantech\ETDCtrl.exe [649608 2010-04-13] (ELAN Microelectronic Corp.)
HKLM\...\Run: [lxczbmgr.exe] - C:\Program Files (x86)\Lexmark 1200 Series\lxczbmgr.exe [74672 2007-04-19] (Lexmark International, Inc.)
HKLM-x32\...\Run: [UpdateLBPShortCut] - C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [222504 2009-05-20] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdateP2GoShortCut] - C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-20] (CyberLink Corp.)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-08-12] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [ATKMEDIA] - C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [170624 2010-05-03] (ASUS)
HKLM-x32\...\Run: [HControlUser] - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
HKLM-x32\...\Run: [Wireless Console 3] - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe [1597440 2010-07-02] ()
HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-18] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [ApnTBMon] - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1758160 2014-02-13] (APN)
HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [186408 2013-12-06] (Geek Software GmbH)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [3814736 2014-02-26] (LogMeIn Inc.)
HKU\S-1-5-21-248383319-906549810-607593882-1000\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2011-01-12] (Google Inc.)
HKU\S-1-5-21-248383319-906549810-607593882-1000\...\Run: [Pando Media Booster] - C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe [3093624 2012-12-18] ()
Startup: C:\Users\Sandra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Sandra\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Sandra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Sandra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://asus.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus.msn.com
SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT
BHO: Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO-x32: Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Handler: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\system32\urlmon.dll (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\..\Interfaces\{E6BE1AF5-1BF7-46CD-9F7A-907DF6743805}: [NameServer]212.123.96.110,141.82.16.200
FireFox:
========
FF ProfilePath: C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\qk2a4lxz.default
FF user.js: detected! => C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\qk2a4lxz.default\user.js
FF Homepage: hxxp://www.ecosia.org/?ref=fb-409730502
FF NetworkProxy: "http", "174.129.135.239 "
FF NetworkProxy: "http_port", 5555
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_70.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_70.dll ()
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF SearchPlugin: C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\qk2a4lxz.default\searchplugins\ecosia.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Avira SearchFree Toolbar plus Web Protection - C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\qk2a4lxz.default\Extensions\toolbar_AVIRA-V7@apn.ask.com.xpi [2013-07-26]
FF Extension: Ecosia - The search engine that plants trees - C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\qk2a4lxz.default\Extensions\{d04b0b40-3dab-4f0b-97a6-04ec3eddbfb0}.xpi [2013-11-26]
FF Extension: Adblock Plus - C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\qk2a4lxz.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-10-02]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-02-17]
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1017424 2014-02-18] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2014-02-13] (APN LLC.)
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [377616 2014-02-26] (LogMeIn, Inc.)
R2 lxcz_device; C:\Windows\system32\lxczcoms.exe [566192 2007-04-19] ( )
R2 lxcz_device; C:\Windows\SysWOW64\lxczcoms.exe [537520 2007-04-19] ( )
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-07] (Avira Operations GmbH & Co. KG)
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1800192 2009-08-20] ()
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-03-05 15:11 - 2014-03-05 15:11 - 00380416 _____ () C:\Users\Sandra\Downloads\Gmer-19357.exe
2014-03-05 15:08 - 2014-03-05 15:10 - 00032493 _____ () C:\Users\Sandra\Downloads\Addition.txt
2014-03-05 15:07 - 2014-03-05 15:45 - 00017088 _____ () C:\Users\Sandra\Downloads\FRST.txt
2014-03-05 15:07 - 2014-03-05 15:45 - 00000000 ____D () C:\FRST
2014-03-05 15:05 - 2014-03-05 15:05 - 02157056 _____ (Farbar) C:\Users\Sandra\Downloads\FRST64.exe
2014-03-05 15:04 - 2014-03-05 15:45 - 00000474 _____ () C:\Users\Sandra\Downloads\defogger_disable.log
2014-03-05 15:04 - 2014-03-05 15:04 - 00000000 _____ () C:\Users\Sandra\defogger_reenable
2014-03-05 14:40 - 2014-03-05 14:40 - 00050477 _____ () C:\Users\Sandra\Downloads\Defogger.exe
2014-03-05 13:59 - 2014-03-05 14:00 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Sandra\Downloads\mbam-setup-1.75.0.1300.exe
2014-03-05 13:55 - 2014-03-05 13:55 - 04051872 _____ (Avira Operations GmbH & Co. KG) C:\Users\Sandra\Downloads\avira_de_av___ws.exe
2014-03-05 13:38 - 2014-03-05 13:38 - 10345466 _____ () C:\Users\Sandra\Downloads\sophos-win.exe
2014-02-28 18:10 - 2014-02-28 18:10 - 00000000 ____D () C:\Program Files (x86)\LogMeIn Hamachi
2014-02-26 09:16 - 2014-02-26 09:22 - 00000000 ____D () C:\Users\Sandra\Desktop\Musik für Fairphone
2014-02-21 12:34 - 2014-02-21 12:34 - 17858952 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-02-17 15:59 - 2013-12-21 10:53 - 00548864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-02-17 15:59 - 2013-12-21 09:56 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-02-17 15:58 - 2014-02-06 12:30 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-17 15:58 - 2014-02-06 11:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-02-17 15:58 - 2014-02-06 11:17 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-02-17 15:58 - 2014-02-06 10:25 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-02-17 15:57 - 2014-02-06 13:16 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-17 15:57 - 2014-02-06 12:30 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-02-17 15:57 - 2014-02-06 12:12 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-17 15:57 - 2014-02-06 12:07 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-02-17 15:57 - 2014-02-06 12:06 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-02-17 15:57 - 2014-02-06 11:57 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-17 15:57 - 2014-02-06 11:56 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-02-17 15:57 - 2014-02-06 11:52 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-17 15:57 - 2014-02-06 11:49 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-17 15:57 - 2014-02-06 11:48 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-02-17 15:57 - 2014-02-06 11:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-02-17 15:57 - 2014-02-06 11:38 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-02-17 15:57 - 2014-02-06 11:32 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-02-17 15:57 - 2014-02-06 11:11 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-17 15:57 - 2014-02-06 11:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-02-17 15:57 - 2014-02-06 11:00 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-02-17 15:57 - 2014-02-06 10:57 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-02-17 15:57 - 2014-02-06 10:57 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-17 15:57 - 2014-02-06 10:52 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-02-17 15:57 - 2014-02-06 10:52 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-02-17 15:57 - 2014-02-06 10:50 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-17 15:57 - 2014-02-06 10:49 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-02-17 15:57 - 2014-02-06 10:47 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-02-17 15:57 - 2014-02-06 10:46 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-02-17 15:57 - 2014-02-06 10:25 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-02-17 15:57 - 2014-02-06 10:24 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-17 15:57 - 2014-02-06 10:22 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-17 15:57 - 2014-02-06 10:13 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-02-17 15:57 - 2014-02-06 10:09 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-02-17 15:57 - 2014-02-06 10:03 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-02-17 15:57 - 2014-02-06 09:55 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-17 15:57 - 2014-02-06 09:41 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-02-17 15:57 - 2014-02-06 09:40 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-02-17 15:57 - 2014-02-06 09:36 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-02-17 15:57 - 2014-02-06 09:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-02-17 14:24 - 2014-02-17 14:24 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_WinUsb_01009.Wdf
2014-02-17 12:33 - 2014-02-17 12:33 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-02-17 10:25 - 2014-01-01 00:05 - 00420008 _____ () C:\Windows\SysWOW64\locale.nls
2014-02-17 10:25 - 2014-01-01 00:04 - 00420008 _____ () C:\Windows\system32\locale.nls
2014-02-17 10:25 - 2013-12-25 00:09 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-02-17 10:25 - 2013-12-24 23:48 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-02-17 10:25 - 2013-12-06 03:30 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-02-17 10:25 - 2013-12-06 03:30 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-02-17 10:25 - 2013-12-06 03:02 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-02-17 10:25 - 2013-12-06 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-02-17 10:25 - 2013-12-04 03:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll
2014-02-17 10:25 - 2013-12-04 03:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll
2014-02-17 10:25 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll
2014-02-17 10:25 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll
2014-02-17 10:25 - 2013-12-04 03:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll
2014-02-17 10:25 - 2013-12-04 03:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe
2014-02-17 10:25 - 2013-12-04 03:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe
2014-02-17 10:25 - 2013-12-04 03:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe
2014-02-17 10:25 - 2013-12-04 03:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe
2014-02-17 10:25 - 2013-12-04 03:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll
2014-02-17 10:25 - 2013-12-04 03:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll
2014-02-17 10:25 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll
2014-02-17 10:25 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll
2014-02-17 10:25 - 2013-12-04 03:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll
2014-02-17 10:25 - 2013-12-04 02:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe
2014-02-17 10:25 - 2013-12-04 02:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe
2014-02-17 10:25 - 2013-12-04 02:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe
2014-02-17 10:25 - 2013-12-04 02:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe
2014-02-17 10:25 - 2013-11-26 09:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2014-02-17 10:25 - 2013-11-22 23:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2014-02-13 17:05 - 2014-02-13 17:05 - 00000000 ____D () C:\Users\Sandra\AppData\Roaming\Malwarebytes
2014-02-13 17:03 - 2014-02-13 17:03 - 00001107 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-02-13 17:03 - 2014-02-13 17:03 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-13 17:03 - 2014-02-13 17:03 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-02-13 17:03 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-02-13 17:01 - 2014-02-13 17:01 - 00614792 _____ (Chip Digital GmbH) C:\Users\Sandra\Downloads\Malwarebytes Anti Malware - CHIP-Downloader.exe
2014-02-13 16:58 - 2014-02-13 16:58 - 00000000 ____D () C:\Users\Sandra\Desktop\Neuer Ordner
2014-02-13 16:53 - 2014-02-13 16:53 - 00031024 _____ () C:\Users\Sandra\Documents\Portfolio Bevc endgültige Fassung.odt
2014-02-07 14:53 - 2014-02-08 10:53 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
==================== One Month Modified Files and Folders =======
2014-03-05 15:47 - 2014-03-05 15:07 - 00017088 _____ () C:\Users\Sandra\Downloads\FRST.txt
2014-03-05 15:46 - 2012-12-18 09:17 - 00000000 ____D () C:\Users\Sandra\AppData\Local\PMB Files
2014-03-05 15:45 - 2014-03-05 15:07 - 00000000 ____D () C:\FRST
2014-03-05 15:45 - 2014-03-05 15:04 - 00000474 _____ () C:\Users\Sandra\Downloads\defogger_disable.log
2014-03-05 15:43 - 2013-12-16 19:31 - 00000000 ___RD () C:\Users\Sandra\Dropbox
2014-03-05 15:43 - 2013-12-16 19:29 - 00000000 ____D () C:\Users\Sandra\AppData\Roaming\Dropbox
2014-03-05 15:42 - 2012-12-09 20:28 - 00000000 ____D () C:\Users\Sandra\AppData\Local\LogMeIn Hamachi
2014-03-05 15:41 - 2012-11-14 12:13 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-03-05 15:41 - 2011-05-06 03:25 - 00000000 ____D () C:\Program Files\P4G
2014-03-05 15:39 - 2011-05-06 03:13 - 01926441 _____ () C:\Windows\WindowsUpdate.log
2014-03-05 15:39 - 2011-05-06 03:09 - 00719724 _____ () C:\Windows\PFRO.log
2014-03-05 15:39 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-03-05 15:39 - 2009-07-14 05:51 - 00250357 _____ () C:\Windows\setupact.log
2014-03-05 15:32 - 2013-03-24 14:05 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-03-05 15:11 - 2014-03-05 15:11 - 00380416 _____ () C:\Users\Sandra\Downloads\Gmer-19357.exe
2014-03-05 15:10 - 2014-03-05 15:08 - 00032493 _____ () C:\Users\Sandra\Downloads\Addition.txt
2014-03-05 15:10 - 2009-07-14 05:45 - 00009920 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-03-05 15:10 - 2009-07-14 05:45 - 00009920 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-03-05 15:05 - 2014-03-05 15:05 - 02157056 _____ (Farbar) C:\Users\Sandra\Downloads\FRST64.exe
2014-03-05 15:04 - 2014-03-05 15:04 - 00000000 _____ () C:\Users\Sandra\defogger_reenable
2014-03-05 15:04 - 2011-07-21 14:45 - 00000000 ____D () C:\Users\Sandra
2014-03-05 14:56 - 2012-11-14 12:13 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-03-05 14:40 - 2014-03-05 14:40 - 00050477 _____ () C:\Users\Sandra\Downloads\Defogger.exe
2014-03-05 14:00 - 2014-03-05 13:59 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Sandra\Downloads\mbam-setup-1.75.0.1300.exe
2014-03-05 13:55 - 2014-03-05 13:55 - 04051872 _____ (Avira Operations GmbH & Co. KG) C:\Users\Sandra\Downloads\avira_de_av___ws.exe
2014-03-05 13:38 - 2014-03-05 13:38 - 10345466 _____ () C:\Users\Sandra\Downloads\sophos-win.exe
2014-03-05 08:20 - 2013-01-08 13:48 - 00003958 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{01969AC8-B8F0-48C9-A737-500E9D388A8F}
2014-03-04 22:46 - 2009-08-04 11:34 - 00610996 _____ () C:\Windows\system32\perfh008.dat
2014-03-04 22:46 - 2009-08-04 11:34 - 00115282 _____ () C:\Windows\system32\perfc008.dat
2014-03-04 22:46 - 2009-08-04 10:51 - 00711546 _____ () C:\Windows\system32\perfh007.dat
2014-03-04 22:46 - 2009-08-04 10:51 - 00153736 _____ () C:\Windows\system32\perfc007.dat
2014-03-04 22:46 - 2009-07-14 06:13 - 02376808 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-28 18:10 - 2014-02-28 18:10 - 00000000 ____D () C:\Program Files (x86)\LogMeIn Hamachi
2014-02-28 18:10 - 2014-01-27 14:41 - 00000928 _____ () C:\Users\Public\Desktop\LogMeIn Hamachi.lnk
2014-02-26 13:05 - 2011-08-03 22:50 - 02328674 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-02-26 09:22 - 2014-02-26 09:16 - 00000000 ____D () C:\Users\Sandra\Desktop\Musik für Fairphone
2014-02-25 16:05 - 2011-09-01 10:37 - 00002699 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-02-25 16:05 - 2011-09-01 10:37 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-02-25 16:05 - 2011-09-01 10:37 - 00000000 ____D () C:\ProgramData\Skype
2014-02-21 12:34 - 2014-02-21 12:34 - 17858952 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-02-21 12:34 - 2013-03-24 14:05 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-02-21 12:34 - 2012-11-18 13:10 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-02-21 12:34 - 2011-09-24 13:19 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-02-18 11:46 - 2013-08-06 17:00 - 00000000 ____D () C:\Windows\system32\MRT
2014-02-17 16:08 - 2011-07-21 21:11 - 88567024 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-02-17 14:24 - 2014-02-17 14:24 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_WinUsb_01009.Wdf
2014-02-17 12:33 - 2014-02-17 12:33 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-02-17 12:33 - 2012-04-25 12:04 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-02-13 17:24 - 2013-08-11 10:39 - 00000000 ____D () C:\Users\Sandra\AppData\Roaming\DVDVideoSoft
2014-02-13 17:05 - 2014-02-13 17:05 - 00000000 ____D () C:\Users\Sandra\AppData\Roaming\Malwarebytes
2014-02-13 17:03 - 2014-02-13 17:03 - 00001107 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-02-13 17:03 - 2014-02-13 17:03 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-13 17:03 - 2014-02-13 17:03 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-02-13 17:01 - 2014-02-13 17:01 - 00614792 _____ (Chip Digital GmbH) C:\Users\Sandra\Downloads\Malwarebytes Anti Malware - CHIP-Downloader.exe
2014-02-13 16:58 - 2014-02-13 16:58 - 00000000 ____D () C:\Users\Sandra\Desktop\Neuer Ordner
2014-02-13 16:53 - 2014-02-13 16:53 - 00031024 _____ () C:\Users\Sandra\Documents\Portfolio Bevc endgültige Fassung.odt
2014-02-13 16:52 - 2014-01-27 15:09 - 00031030 _____ () C:\Users\Sandra\Documents\Portfolio Bevc.odt
2014-02-13 13:51 - 2012-11-14 12:13 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-02-13 13:51 - 2012-11-14 12:13 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-02-12 11:04 - 2014-01-07 14:07 - 00023671 _____ () C:\Users\Sandra\Documents\Buchführung 2014.xlsx
2014-02-08 10:53 - 2014-02-07 14:53 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-02-07 22:24 - 2011-09-01 10:37 - 00000000 ____D () C:\Users\Sandra\AppData\Roaming\Skype
2014-02-06 13:16 - 2014-02-17 15:57 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-06 12:30 - 2014-02-17 15:58 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-06 12:30 - 2014-02-17 15:57 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-02-06 12:12 - 2014-02-17 15:57 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-06 12:07 - 2014-02-17 15:57 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-02-06 12:06 - 2014-02-17 15:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-02-06 11:57 - 2014-02-17 15:57 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-06 11:56 - 2014-02-17 15:57 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-02-06 11:52 - 2014-02-17 15:57 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-06 11:49 - 2014-02-17 15:57 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-06 11:48 - 2014-02-17 15:57 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-02-06 11:48 - 2014-02-17 15:57 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-02-06 11:38 - 2014-02-17 15:57 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-02-06 11:32 - 2014-02-17 15:57 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-02-06 11:20 - 2014-02-17 15:58 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-02-06 11:17 - 2014-02-17 15:58 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-02-06 11:11 - 2014-02-17 15:57 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-06 11:01 - 2014-02-17 15:57 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-02-06 11:00 - 2014-02-17 15:57 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-02-06 10:57 - 2014-02-17 15:57 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-02-06 10:57 - 2014-02-17 15:57 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-06 10:52 - 2014-02-17 15:57 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-02-06 10:52 - 2014-02-17 15:57 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-02-06 10:50 - 2014-02-17 15:57 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-06 10:49 - 2014-02-17 15:57 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-02-06 10:47 - 2014-02-17 15:57 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-02-06 10:46 - 2014-02-17 15:57 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-02-06 10:25 - 2014-02-17 15:58 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-02-06 10:25 - 2014-02-17 15:57 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-02-06 10:24 - 2014-02-17 15:57 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-06 10:22 - 2014-02-17 15:57 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-06 10:13 - 2014-02-17 15:57 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-02-06 10:09 - 2014-02-17 15:57 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-02-06 10:03 - 2014-02-17 15:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-02-06 09:55 - 2014-02-17 15:57 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-06 09:41 - 2014-02-17 15:57 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-02-06 09:40 - 2014-02-17 15:57 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-02-06 09:36 - 2014-02-17 15:57 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-02-06 09:34 - 2014-02-17 15:57 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
Some content of TEMP:
====================
C:\Users\Sandra\AppData\Local\Temp\avgnt.exe
C:\Users\Sandra\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\Sandra\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe
C:\Users\Sandra\AppData\Local\Temp\PicasaUpdater_39f5.exe
C:\Users\Sandra\AppData\Local\Temp\rtdrvmon.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-11-05 21:00
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 05-03-2014
Ran by Sandra at 2014-03-05 15:08:23
Running from C:\Users\Sandra\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
Update for Microsoft Office 2007 (KB2508958) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version: - Microsoft)
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Flash Player 12 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 12.0.0.70 - Adobe Systems Incorporated)
Adobe Flash Player 12 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 12.0.0.70 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated)
Age of Empires II - the Conquerors WideScreen Patcher (HKLM-x32\...\{BA2F3EBC-FE07-4AB5-B906-14DF2C74C523}) (Version: 1.0.40 - Boekabart)
ASUS AI Recovery (HKLM-x32\...\{38253529-D97D-4901-AE53-5CC9736D3A2E}) (Version: 1.0.13 - ASUS)
ASUS LifeFrame3 (HKLM-x32\...\{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}) (Version: 3.0.20 - ASUS)
ASUS Live Update (HKLM-x32\...\{E657B243-9AD4-4ECC-BE81-4CCF8D667FD0}) (Version: 2.5.9 - ASUS)
ASUS MultiFrame (HKLM-x32\...\{9D48531D-2135-49FC-BC29-ACCDA5396A76}) (Version: 1.0.0021 - ASUS)
ASUS Power4Gear Hybrid (HKLM\...\{9B6239BF-4E85-4590-8D72-51E30DB1A9AA}) (Version: 1.1.40 - ASUS)
ASUS SmartLogon (HKLM-x32\...\{64452561-169F-4A36-A2FF-B5E118EC65F5}) (Version: 1.0.0008 - ASUS)
ASUS Virtual Camera (HKLM-x32\...\{EC8BD21F-0CA0-4BBF-97D9-4A52B30041A1}) (Version: 1.0.20 - asus)
ATI AVIVO64 Codecs (Version: 11.6.0.50811 - ATI Technologies Inc.) Hidden
ATI Catalyst Install Manager (HKLM\...\{FDB61EAE-7C1D-7EB6-E1EE-14528E3EB266}) (Version: 3.0.790.0 - ATI Technologies, Inc.)
ATK Package (HKLM-x32\...\{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}) (Version: 1.0.0006 - ASUS)
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.3.338 - Avira)
Avira SearchFree Toolbar (HKLM-x32\...\{41564952-412D-5637-00A7-A758B70C0A03}) (Version: 12.10.3.4487 - APN, LLC)
Bookworm Deluxe (HKLM-x32\...\Bookworm Deluxe) (Version: - Oberon Media Inc.)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - ATI) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2010.0811.2122.36462 - ATI) Hidden
Catalyst Control Center Graphics Previews Vista (x32 Version: 2010.0811.2122.36462 - ATI) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2010.0811.2122.36462 - ATI Technologies, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2010.0811.2122.36462 - ATI) Hidden
CCC Help Chinese Standard (x32 Version: 2010.0811.2121.36462 - ATI) Hidden
CCC Help Chinese Traditional (x32 Version: 2010.0811.2121.36462 - ATI) Hidden
CCC Help Czech (x32 Version: 2010.0811.2121.36462 - ATI) Hidden
CCC Help Danish (x32 Version: 2010.0811.2121.36462 - ATI) Hidden
CCC Help Dutch (x32 Version: 2010.0811.2121.36462 - ATI) Hidden
CCC Help English (x32 Version: 2010.0811.2121.36462 - ATI) Hidden
CCC Help Finnish (x32 Version: 2010.0811.2121.36462 - ATI) Hidden
CCC Help French (x32 Version: 2010.0811.2121.36462 - ATI) Hidden
CCC Help German (x32 Version: 2010.0811.2121.36462 - ATI) Hidden
CCC Help Greek (x32 Version: 2010.0811.2121.36462 - ATI) Hidden
CCC Help Hungarian (x32 Version: 2010.0811.2121.36462 - ATI) Hidden
CCC Help Italian (x32 Version: 2010.0811.2121.36462 - ATI) Hidden
CCC Help Japanese (x32 Version: 2010.0811.2121.36462 - ATI) Hidden
CCC Help Korean (x32 Version: 2010.0811.2121.36462 - ATI) Hidden
CCC Help Norwegian (x32 Version: 2010.0811.2121.36462 - ATI) Hidden
CCC Help Polish (x32 Version: 2010.0811.2121.36462 - ATI) Hidden
CCC Help Portuguese (x32 Version: 2010.0811.2121.36462 - ATI) Hidden
CCC Help Russian (x32 Version: 2010.0811.2121.36462 - ATI) Hidden
CCC Help Spanish (x32 Version: 2010.0811.2121.36462 - ATI) Hidden
CCC Help Swedish (x32 Version: 2010.0811.2121.36462 - ATI) Hidden
CCC Help Thai (x32 Version: 2010.0811.2121.36462 - ATI) Hidden
CCC Help Turkish (x32 Version: 2010.0811.2121.36462 - ATI) Hidden
ccc-core-static (x32 Version: 2010.0811.2122.36462 - ATI) Hidden
ccc-utility64 (Version: 2010.0811.2122.36462 - ATI) Hidden
Cisco Systems VPN Client 5.0.07.0440 (HKLM\...\{5FDC06BF-3D3D-4367-8FFB-4FAFCB61972D}) (Version: 5.0.7 - Cisco Systems, Inc.)
Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 4.127.0.63 - Conexant)
Control ActiveX de Windows Live Mesh para conexiones remotas (HKLM-x32\...\{04668DF2-D32F-4555-9C7E-35523DCD6544}) (Version: 15.4.5722.2 - Microsoft Corporation)
ControlDeck (HKLM-x32\...\{5B65EF64-1DFA-414A-8C94-7BB726158E21}) (Version: 1.0.8 - ASUS)
Contrôle ActiveX Windows Live Mesh pour connexions à distance (HKLM-x32\...\{55D003F4-9599-44BF-BA9E-95D060730DD3}) (Version: 15.4.5722.2 - Microsoft Corporation)
Controlo ActiveX do Windows Live Mesh para Ligações Remotas (HKLM-x32\...\{E54EEB5D-41ED-40FE-B4A8-8565DB81469B}) (Version: 15.4.5722.2 - Microsoft Corporation)
Cooking Dash (HKLM-x32\...\Cooking Dash) (Version: - Oberon Media Inc.)
CyberLink LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.1908 - CyberLink Corp.)
CyberLink LabelPrint (x32 Version: 2.5.1908 - CyberLink Corp.) Hidden
CyberLink Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.1.3602c - CyberLink Corp.)
CyberLink Power2Go (x32 Version: 6.1.3602c - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dropbox (HKCU\...\Dropbox) (Version: 2.4.11 - Dropbox, Inc.)
ETDWare PS/2-x64 7.0.5.11_WHQL (HKLM\...\Elantech) (Version: 7.0.5.11 - ELAN Microelectronics Corp.)
f4 2012 (HKLM-x32\...\f42012) (Version: - audiotranskription.de)
Fast Boot (HKLM\...\{13F4A7F3-EABC-4261-AF6B-1317777F0755}) (Version: 1.0.8 - ASUS)
FormatFactory 3.00 (HKLM-x32\...\FormatFactory) (Version: 3.00 - Free Time)
Free M4a to MP3 Converter 7.0 (HKLM-x32\...\Free M4a to MP3 Converter_is1) (Version: - ManiacTools.com)
Free YouTube to MP3 Converter version 3.12.9.725 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.9.725 - DVDVideoSoft Ltd.)
Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.4805.320 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.22.5 - Google Inc.) Hidden
Google+ Auto Backup (HKLM-x32\...\{A50DE037-B5C0-4C8A-8049-B0C576B313D1}) (Version: 1.0.21.81 - Google)
Governor of Poker (HKLM-x32\...\Governor of Poker) (Version: - Oberon Media Inc.)
Hotel Dash Suite Success (HKLM-x32\...\Hotel Dash Suite Success) (Version: - Oberon Media Inc.)
ICQ7.5 (HKLM-x32\...\{7578ADEA-D65F-4C89-A249-B1C88B6FFC20}) (Version: 7.5 - ICQ)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation)
Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.510 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Jewel Quest 3 (HKLM-x32\...\Jewel Quest 3) (Version: - Oberon Media Inc.)
JMicron Ethernet Adapter NDIS Driver (HKLM-x32\...\{96DCEE2F-98EE-4F80-8C0F-7C04D1FB9D7F}) (Version: 6.0.17.1 - JMicron Technology Corp.)
JMicron Flash Media Controller Driver (HKLM-x32\...\{26604C7E-A313-4D12-867F-7C6E7820BE4C}) (Version: 1.0.33.2 - JMicron Technology Corp.)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
K_Series_ScreenSaver_EN (HKLM-x32\...\K_Series_ScreenSaver_EN) (Version: - )
League of Legends (HKLM-x32\...\{92606477-9366-4D3B-8AE3-6BE4B29727AB}) (Version: 1.3 - Riot Games)
Lexmark 1200 Series (HKLM\...\Lexmark 1200 Series) (Version: - Lexmark International, Inc.)
LogMeIn Hamachi (HKLM-x32\...\LogMeIn Hamachi) (Version: 2.2.0.173 - LogMeIn, Inc.)
LogMeIn Hamachi (x32 Version: 2.2.0.173 - LogMeIn, Inc.) Hidden
Luxor 3 (HKLM-x32\...\Luxor 3) (Version: - Oberon Media Inc.)
Mahjongg dimensions (HKLM-x32\...\Mahjongg dimensions) (Version: - Oberon Media Inc.)
Malwarebytes Anti-Malware Version 1.75.0.1300 (HKLM-x32\...\Malwarebytes' Anti-Malware_is1) (Version: 1.75.0.1300 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Klick-und-Los 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden
Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Starter 2010 - Deutsch (HKLM-x32\...\{90140011-0066-0407-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft PowerPoint Viewer (HKLM-x32\...\{95140000-00AF-0407-0000-0000000FF1CE}) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 27.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 27.0.1 (x86 de)) (Version: 27.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 27.0.1 - Mozilla)
Mozilla Thunderbird 24.3.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 24.3.0 (x86 de)) (Version: 24.3.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP3 Parser (KB2721691) (HKLM-x32\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB973685) (HKLM-x32\...\{859DFA95-E4A6-48CD-B88E-A3E483E89B44}) (Version: 4.30.2107.0 - Microsoft Corporation)
OpenOffice.org 3.3 (HKLM-x32\...\{4286716B-1287-48E7-9078-3DC8248DBA96}) (Version: 3.3.9567 - OpenOffice.org)
Pando Media Booster (HKLM-x32\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: 2.6.0.8 - Pando Networks Inc.)
PDF24 Creator 6.1.0 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org)
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9 - Google, Inc.)
Plants vs Zombies (HKLM-x32\...\Plants vs Zombies) (Version: - Oberon Media Inc.)
PrimoPDF -- brought to you by Nitro PDF Software (HKLM-x32\...\PrimoPDF) (Version: 5 - Nitro PDF Software)
Skype Click to Call (HKLM-x32\...\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 5.9.9216 - Skype Technologies S.A.)
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6FAA03BD-2B51-4029-9AD9-64A3B8E3C84C}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISE_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version: - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{EA54F104-79D2-48CC-9ABC-91A63C43D353}) (Version: - Microsoft)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2850085) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{128A5449-CF71-4DA4-A746-F49E3B5DB584}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
USB2.0 UVC VGA WebCam (HKLM\...\USB2.0 UVC VGA WebCam) (Version: 5.8.54000.207 - Sonix)
VLC media player 1.0.3 (HKLM-x32\...\VLC media player) (Version: 1.0.3 - VideoLAN Team)
Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3502.0922 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen (HKLM-x32\...\{C32CE55C-12BA-4951-8797-0967FDEF556F}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{C63A1E60-B6A4-440B-89A5-1FC6E4AC1C94}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 程式集 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
WinFlash (HKLM-x32\...\{8F21291E-0444-4B1D-B9F9-4370A73E346D}) (Version: 2.31.1 - ASUS)
Wireless Console 3 (HKLM-x32\...\{20FDF948-C8ED-4543-A539-F7F4AEF5AFA2}) (Version: 3.0.17 - ASUS)
You Don't Know Jack 4 1.00 (HKLM-x32\...\You Don't Know Jack 4) (Version: 1.00 - Take 2 Interactive)
Στοιχείο ελέγχου ActiveX του Windows Live Mesh για απομακρυσμένες συνδέσεις (HKLM-x32\...\{F665F3B8-01B4-46A9-8E47-FF8DC2208C9F}) (Version: 15.4.5722.2 - Microsoft Corporation)
פקד ActiveX של Windows Live Mesh עבור חיבורים מרוחקים (HKLM-x32\...\{9D4C7DFA-CBBB-4F06-BDAC-94D831406DF0}) (Version: 15.4.5722.2 - Microsoft Corporation)
適用遠端連線的 Windows Live Mesh ActiveX 控制項 (HKLM-x32\...\{622DE1BE-9EDE-49D3-B349-29D64760342A}) (Version: 15.4.5722.2 - Microsoft Corporation)
==================== Restore Points =========================
11-02-2014 10:46:04 Windows Update
17-02-2014 09:24:33 Windows Update
17-02-2014 14:57:19 Windows Update
21-02-2014 10:35:16 Windows Update
25-02-2014 13:18:12 Windows Update
25-02-2014 15:04:30 Windows Update
26-02-2014 12:02:22 Windows Update
04-03-2014 08:36:47 Windows Update
==================== Hosts content: ==========================
2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {2345756A-CBAE-4A12-9C67-0CE4CFF157CF} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2013-07-02] (Oracle Corporation)
Task: {26B8B905-6768-4470-AC5A-34D1BD6171E5} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-11-14] (Google Inc.)
Task: {4712B4BF-FFA2-4226-A4CE-C5036728E70C} - System32\Tasks\ASUSControlDeck => C:\Program Files (x86)\ASUS\ControlDeck\ControlDeck.exe [2010-06-09] (asus)
Task: {59B63D16-B87C-4E24-9ACF-2DC36A35DCB3} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-11-14] (Google Inc.)
Task: {843D32DF-3580-4846-A6BE-649A2E7C084D} - System32\Tasks\ASUS Live Update => C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe [2007-11-30] ()
Task: {A2F2A005-FADB-42EC-B47C-B7B9DCA1F5C3} - System32\Tasks\ATKOSD2 => C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [2010-08-17] (ASUS)
Task: {AA27C09A-3E22-49AA-8B1D-45B458BA7534} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-11-21] (Adobe Systems Incorporated)
Task: {BAA487FE-2799-4A66-AC1F-A8BD9F610E21} - System32\Tasks\ASUS SmartLogon Console Sensor => C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe [2009-07-31] (ASUS)
Task: {BAE09CC7-E746-43A1-B393-9DCBA044624B} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-02-21] (Adobe Systems Incorporated)
Task: {BB44E394-B793-4492-8F34-E7C10967010B} - System32\Tasks\ASUS P4G => C:\Program Files\P4G\BatteryLife.exe [2010-08-12] (ASUS)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2011-11-08 20:49 - 2011-02-28 23:37 - 00095008 _____ () C:\Windows\System32\Primomonnt.dll
2011-05-06 03:26 - 2007-11-30 19:20 - 00051768 _____ () C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe
2010-07-15 00:11 - 2010-07-15 00:11 - 00031360 _____ () C:\Program Files\P4G\DevMng.dll
2010-07-02 21:36 - 2010-07-02 21:36 - 01597440 _____ () C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
2014-03-05 14:40 - 2014-03-05 14:40 - 00050477 _____ () C:\Users\Sandra\Downloads\Defogger.exe
2013-07-29 19:47 - 2013-07-29 14:05 - 00394824 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2011-03-04 11:49 - 2011-03-04 11:49 - 00202752 _____ () C:\Program Files (x86)\Cisco Systems\VPN Client\vpnapi.dll
2009-11-02 23:20 - 2009-11-02 23:20 - 00619816 _____ () C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll
2009-11-02 23:23 - 2009-11-02 23:23 - 00013096 _____ () C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll
2013-10-19 00:55 - 2013-10-19 00:55 - 25100288 _____ () C:\Users\Sandra\AppData\Roaming\Dropbox\bin\libcef.dll
2011-01-17 16:19 - 2012-02-24 12:14 - 00985088 _____ () C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll
2010-02-23 23:14 - 2010-02-23 23:14 - 00041472 _____ () C:\Program Files (x86)\ASUS\ControlDeck\HelpFunc.dll
2010-02-23 23:14 - 2010-02-23 23:14 - 00071680 _____ () C:\Program Files (x86)\ASUS\ControlDeck\Brightness.dll
2010-02-23 23:11 - 2010-02-23 23:11 - 00076288 _____ () C:\Program Files (x86)\ASUS\ControlDeck\Volume.dll
2010-02-23 23:12 - 2010-02-23 23:12 - 00186880 _____ () C:\Program Files (x86)\ASUS\ControlDeck\Resolution.dll
2010-02-23 23:14 - 2010-02-23 23:14 - 00050688 _____ () C:\Program Files (x86)\ASUS\ControlDeck\P4GControl.dll
2014-02-17 12:33 - 2014-02-17 12:33 - 03578992 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\ProgramData\Temp:5D458568
AlternateDataStreams: C:\ProgramData\Temp:D20FFA63
==================== Safe Mode (whitelisted) ===================
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service"
==================== Disabled items from MSCONFIG ==============
MSCONFIG\startupreg: ADSMTray => C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMTray.exe
MSCONFIG\startupreg: ASUS Screen Saver Protector => C:\Windows\AsScrPro.exe
MSCONFIG\startupreg: CLMLServer => "C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe"
==================== Faulty Device Manager Devices =============
Name: Cisco Systems VPN Adapter for 64-bit Windows
Description: Cisco Systems VPN Adapter for 64-bit Windows
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: CVirtA
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (02/25/2014 04:10:24 PM) (Source: .NET Runtime Optimization Service) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_64) - 1>Failed to compile: mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 . Error code = 0x80070003
Error: (02/19/2014 05:35:52 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: spoolsv.exe, Version: 6.1.7601.17777, Zeitstempel: 0x4f35fc1d
Name des fehlerhaften Moduls: msvcrt.dll, Version: 7.0.7601.17744, Zeitstempel: 0x4eeb033f
Ausnahmecode: 0x40000015
Fehleroffset: 0x000000000002a84e
ID des fehlerhaften Prozesses: 0x630
Startzeit der fehlerhaften Anwendung: 0xspoolsv.exe0
Pfad der fehlerhaften Anwendung: spoolsv.exe1
Pfad des fehlerhaften Moduls: spoolsv.exe2
Berichtskennung: spoolsv.exe3
Error: (02/19/2014 05:35:42 PM) (Source: ATIeRecord) (User: )
Description: ATI EEU Client has failed to start
Error: (02/19/2014 05:33:08 PM) (Source: ATIeRecord) (User: )
Description: ATI EEU Client has failed to start
Error: (02/13/2014 05:14:52 PM) (Source: Application Hang) (User: )
Description: Programm mbam.exe, Version 1.75.0.1 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: b1c
Startzeit: 01cf28d56923b22f
Endzeit: 0
Anwendungspfad: C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
Berichts-ID: e068c669-94c9-11e3-a1d2-f46d04896e2e
Error: (02/13/2014 01:16:38 PM) (Source: CVHSVC) (User: )
Description: Nur zur Information.
Error: The parameter is incorrect.
ErrorCode: 14007(0x36b7).
Error: (02/13/2014 00:16:42 PM) (Source: CVHSVC) (User: )
Description: Nur zur Information.
Error: The parameter is incorrect.
ErrorCode: 14007(0x36b7).
Error: (02/11/2014 08:03:35 PM) (Source: CVHSVC) (User: )
Description: Nur zur Information.
(Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed:
Error: (02/09/2014 05:34:20 PM) (Source: Microsoft Office 12) (User: )
Description: Accepted Safe Mode action : Microsoft Office Word.
Error: (01/20/2014 08:23:56 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: firefox.exe, Version: 26.0.0.5087, Zeitstempel: 0x52a0d273
Name des fehlerhaften Moduls: xul.dll, Version: 26.0.0.5087, Zeitstempel: 0x52a0d20a
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0014e1a8
ID des fehlerhaften Prozesses: 0x9a0
Startzeit der fehlerhaften Anwendung: 0xfirefox.exe0
Pfad der fehlerhaften Anwendung: firefox.exe1
Pfad des fehlerhaften Moduls: firefox.exe2
Berichtskennung: firefox.exe3
System errors:
=============
Error: (03/03/2014 11:13:59 AM) (Source: DCOM) (User: )
Description: {AD3EDBCA-0901-415B-82E9-C16D3B65E38C}
Error: (02/28/2014 06:10:53 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "LogMeIn Hamachi Tunneling Engine" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
Error: (02/26/2014 02:01:33 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Installer" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (02/26/2014 02:01:32 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Installer erreicht.
Error: (02/26/2014 02:01:33 PM) (Source: DCOM) (User: )
Description: 1053MSIServer{000C101C-0000-0000-C000-000000000046}
Error: (02/19/2014 05:35:54 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Druckwarteschlange" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (02/19/2014 05:34:51 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1070
Error: (02/19/2014 05:34:51 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Server" wurde nicht richtig gestartet.
Error: (02/19/2014 05:32:53 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Server" wurde nicht richtig gestartet.
Error: (02/17/2014 03:56:31 PM) (Source: DCOM) (User: )
Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}
Microsoft Office Sessions:
=========================
==================== Memory info ===========================
Percentage of memory in use: 63%
Total physical RAM: 3948.54 MB
Available physical RAM: 1455.56 MB
Total Pagefile: 7895.27 MB
Available Pagefile: 5189.01 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB
==================== Drives ================================
Drive c: (OS) (Fixed) (Total:273.09 GB) (Free:122.78 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: B33D55E5)
Partition: GPT Partition Type.
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-03-05 16:13:58
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST932032 rev.0003 298,09GB
Running: Gmer-19357.exe; Driver: C:\Users\Sandra\AppData\Local\Temp\kwtiykoc.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff800031f2000 45 bytes [00, 00, 00, 00, 00, 00, 00, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 575 fffff800031f202f 16 bytes [00, 00, 00, 00, 00, 00, 00, ...]
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe[2040] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075d01465 2 bytes [D0, 75]
.text C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe[2040] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075d014bb 2 bytes [D0, 75]
.text ... * 2
? C:\Windows\system32\mssprxy.dll [2632] entry point in ".rdata" section 000000006fd171e6
.text C:\Windows\AsScrPro.exe[2184] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075d01465 2 bytes [D0, 75]
.text C:\Windows\AsScrPro.exe[2184] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075d014bb 2 bytes [D0, 75]
.text ... * 2
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[4264] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 0000000075998769 5 bytes [33, C0, C2, 04, 00]
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[4264] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075d01465 2 bytes [D0, 75]
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[4264] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075d014bb 2 bytes [D0, 75]
.text ... * 2
.text C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe[4436] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075d01465 2 bytes [D0, 75]
.text C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe[4436] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075d014bb 2 bytes [D0, 75]
.text ... * 2
.text C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe[4504] C:\Windows\syswow64\PsApi.dll!GetModuleInformation + 69 0000000075d01465 2 bytes [D0, 75]
.text C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe[4504] C:\Windows\syswow64\PsApi.dll!GetModuleInformation + 155 0000000075d014bb 2 bytes [D0, 75]
.text ... * 2
.text C:\Users\Sandra\AppData\Roaming\Dropbox\bin\Dropbox.exe[4816] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 69 0000000075d01465 2 bytes [D0, 75]
.text C:\Users\Sandra\AppData\Roaming\Dropbox\bin\Dropbox.exe[4816] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 155 0000000075d014bb 2 bytes [D0, 75]
.text ... * 2
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4720] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075d01465 2 bytes [D0, 75]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4720] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075d014bb 2 bytes [D0, 75]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5532] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075d01465 2 bytes [D0, 75]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5532] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075d014bb 2 bytes [D0, 75]
.text ... * 2
---- Threads - GMER 2.1 ----
Thread C:\Windows\System32\svchost.exe [4092:4724] 000007feeee89688
---- Processes - GMER 2.1 ----
Library C:\Users\Sandra\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll (*** suspicious ***) @ C:\Users\Sandra\AppData\Roaming\Dropbox\bin\Dropbox.exe [4816](2014-01-03 00:45:04) 0000000003c00000
Library C:\Users\Sandra\AppData\Roaming\Dropbox\bin\libcef.dll (*** suspicious ***) @ C:\Users\Sandra\AppData\Roaming\Dropbox\bin\Dropbox.exe [4816](2013-10-18 23:55:02) 0000000068150000
Library C:\Users\Sandra\AppData\Roaming\Dropbox\bin\icudt.dll (*** suspicious ***) @ C:\Users\Sandra\AppData\Roaming\Dropbox\bin\Dropbox.exe [4816] (ICU Data DLL/The ICU Project)(2013-10-18 23:55:00) 00000000660c0000
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0015007a2bc2
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0015007a2bc2 (not active ControlSet)
---- EOF - GMER 2.1 ----
Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2014.03.05.06 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 11.0.9600.16518 Sandra :: SANDRAS-LAPTOP [Administrator] 05.03.2014 13:42:20 mbam-log-2014-03-05 (13-42-20).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|Q:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 439489 Laufzeit: 1 Stunde(n), 50 Minute(n), 30 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 2 C:\Program Files (x86)\ICQ7.5\upgrade\2dcd1d63cb45e6613582211c3d5f4b23 (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Sandra\Desktop\Danis Ordner\minecraft\caly soldier\iLividSetup (1).exe (PUP.Optional.Bandoo) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) Code:
ATTFilter
Avira Free Antivirus
Erstellungsdatum der Reportdatei: Mittwoch, 5. März 2014 14:11
Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.
Lizenznehmer : Avira Antivirus Free
Seriennummer : 0000149996-AVHOE-0000001
Plattform : Windows 7 Home Premium
Windowsversion : (Service Pack 1) [6.1.7601]
Boot Modus : Normal gebootet
Benutzername : SYSTEM
Computername : SANDRAS-LAPTOP
Versionsinformationen:
BUILD.DAT : 14.0.3.338 56624 Bytes 14.02.2014 11:00:00
AVSCAN.EXE : 14.0.3.332 1058384 Bytes 18.02.2014 10:45:30
AVSCANRC.DLL : 14.0.2.180 62008 Bytes 17.12.2013 13:01:02
LUKE.DLL : 14.0.3.336 65616 Bytes 18.02.2014 10:45:43
AVSCPLR.DLL : 14.0.3.336 124496 Bytes 18.02.2014 10:45:30
AVREG.DLL : 14.0.3.336 250448 Bytes 18.02.2014 10:45:28
avlode.dll : 14.0.3.336 544848 Bytes 18.02.2014 10:45:28
avlode.rdf : 14.0.3.26 58589 Bytes 11.02.2014 10:43:49
VBASE000.VDF : 7.11.70.0 66736640 Bytes 04.04.2013 09:53:17
VBASE001.VDF : 7.11.74.226 2201600 Bytes 30.04.2013 18:31:21
VBASE002.VDF : 7.11.80.60 2751488 Bytes 28.05.2013 11:39:51
VBASE003.VDF : 7.11.85.214 2162688 Bytes 21.06.2013 15:31:19
VBASE004.VDF : 7.11.91.176 3903488 Bytes 23.07.2013 06:49:21
VBASE005.VDF : 7.11.98.186 6822912 Bytes 29.08.2013 13:12:34
VBASE006.VDF : 7.11.103.230 2293248 Bytes 24.09.2013 19:13:34
VBASE007.VDF : 7.11.116.38 5485568 Bytes 28.11.2013 13:54:14
VBASE008.VDF : 7.11.126.50 3615744 Bytes 22.01.2014 17:09:15
VBASE009.VDF : 7.11.128.174 2030080 Bytes 03.02.2014 14:59:49
VBASE010.VDF : 7.11.134.72 3034112 Bytes 03.03.2014 21:52:42
VBASE011.VDF : 7.11.134.73 2048 Bytes 03.03.2014 21:52:42
VBASE012.VDF : 7.11.134.74 2048 Bytes 03.03.2014 21:52:42
VBASE013.VDF : 7.11.134.75 2048 Bytes 03.03.2014 21:52:42
VBASE014.VDF : 7.11.134.76 2048 Bytes 03.03.2014 21:52:42
VBASE015.VDF : 7.11.134.77 2048 Bytes 03.03.2014 21:52:42
VBASE016.VDF : 7.11.134.78 2048 Bytes 03.03.2014 21:52:42
VBASE017.VDF : 7.11.134.79 2048 Bytes 03.03.2014 21:52:42
VBASE018.VDF : 7.11.134.80 2048 Bytes 03.03.2014 21:52:42
VBASE019.VDF : 7.11.134.81 2048 Bytes 03.03.2014 21:52:42
VBASE020.VDF : 7.11.134.82 2048 Bytes 03.03.2014 21:52:42
VBASE021.VDF : 7.11.134.83 2048 Bytes 03.03.2014 21:52:42
VBASE022.VDF : 7.11.134.84 2048 Bytes 03.03.2014 21:52:42
VBASE023.VDF : 7.11.134.85 2048 Bytes 03.03.2014 21:52:42
VBASE024.VDF : 7.11.134.86 2048 Bytes 03.03.2014 21:52:42
VBASE025.VDF : 7.11.134.87 2048 Bytes 03.03.2014 21:52:42
VBASE026.VDF : 7.11.134.88 2048 Bytes 03.03.2014 21:52:42
VBASE027.VDF : 7.11.134.89 2048 Bytes 03.03.2014 21:52:42
VBASE028.VDF : 7.11.134.90 2048 Bytes 03.03.2014 21:52:42
VBASE029.VDF : 7.11.134.91 2048 Bytes 03.03.2014 21:52:42
VBASE030.VDF : 7.11.134.92 2048 Bytes 03.03.2014 21:52:42
VBASE031.VDF : 7.11.134.198 319488 Bytes 05.03.2014 07:21:59
Engineversion : 8.2.14.18
AEVDF.DLL : 8.1.3.4 102774 Bytes 13.06.2013 15:49:57
AESCRIPT.DLL : 8.1.4.194 524670 Bytes 28.02.2014 10:46:04
AESCN.DLL : 8.1.10.6 131447 Bytes 11.12.2013 14:58:55
AESBX.DLL : 8.2.20.6 1331575 Bytes 13.01.2014 13:53:46
AERDL.DLL : 8.2.0.138 704888 Bytes 02.12.2013 14:31:28
AEPACK.DLL : 8.4.0.4 774520 Bytes 28.02.2014 10:46:04
AEOFFICE.DLL : 8.1.2.82 205181 Bytes 19.02.2014 10:42:20
AEHEUR.DLL : 8.1.4.938 6521210 Bytes 28.02.2014 10:46:03
AEHELP.DLL : 8.1.27.10 266618 Bytes 22.11.2013 14:31:34
AEGEN.DLL : 8.1.7.22 446839 Bytes 15.01.2014 15:17:35
AEEXP.DLL : 8.4.1.238 483704 Bytes 28.02.2014 10:46:04
AEEMU.DLL : 8.1.3.2 393587 Bytes 10.07.2012 15:50:02
AECORE.DLL : 8.1.35.0 229753 Bytes 11.02.2014 17:14:56
AEBB.DLL : 8.1.1.4 53619 Bytes 05.11.2012 20:31:17
AVWINLL.DLL : 14.0.3.252 23608 Bytes 18.02.2014 10:45:23
AVPREF.DLL : 14.0.3.252 48696 Bytes 18.02.2014 10:45:28
AVREP.DLL : 14.0.3.252 175672 Bytes 18.02.2014 10:45:28
AVARKT.DLL : 14.0.3.336 256080 Bytes 18.02.2014 10:45:24
AVEVTLOG.DLL : 14.0.3.336 165968 Bytes 18.02.2014 10:45:26
SQLITE3.DLL : 3.7.0.1 394824 Bytes 29.07.2013 13:05:46
AVSMTP.DLL : 14.0.3.252 60472 Bytes 18.02.2014 10:45:30
NETNT.DLL : 14.0.3.252 13368 Bytes 18.02.2014 10:45:44
RCIMAGE.DLL : 14.0.3.260 4979256 Bytes 18.02.2014 10:45:23
RCTEXT.DLL : 14.0.3.282 72760 Bytes 18.02.2014 10:45:23
Konfiguration für den aktuellen Suchlauf:
Job Name..............................: AVGuardAsyncScan
Konfigurationsdatei...................: C:\ProgramData\Avira\AntiVir Desktop\TEMP\AVGUARD_531713a8\guard_slideup.avp
Protokollierung.......................: standard
Primäre Aktion........................: Reparieren
Sekundäre Aktion......................: Quarantäne
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: aus
Durchsuche aktive Programme...........: ein
Durchsuche Registrierung..............: aus
Suche nach Rootkits...................: aus
Integritätsprüfung von Systemdateien..: aus
Prüfe alle Dateien....................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: Vollständig
Beginn des Suchlaufs: Mittwoch, 5. März 2014 14:11
Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'svchost.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'atiesrxx.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '99' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '111' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '83' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '151' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '73' Modul(e) wurden durchsucht
Durchsuche Prozess 'atieclxx.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'FBAgent.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'ASLDRSrv.exe' - '24' Modul(e) wurden durchsucht
Durchsuche Prozess 'GFNEXSrv.exe' - '14' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '91' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '59' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '61' Modul(e) wurden durchsucht
Durchsuche Prozess 'armsvc.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '110' Modul(e) wurden durchsucht
Durchsuche Prozess 'apnmcp.exe' - '43' Modul(e) wurden durchsucht
Durchsuche Prozess 'cvpnd.exe' - '63' Modul(e) wurden durchsucht
Durchsuche Prozess 'LMIGuardianSvc.exe' - '45' Modul(e) wurden durchsucht
Durchsuche Prozess 'LMS.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'lxczcoms.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'sftvsa.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLIDSVC.EXE' - '76' Modul(e) wurden durchsucht
Durchsuche Prozess 'hamachi-2.exe' - '74' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLIDSvcM.exe' - '17' Modul(e) wurden durchsucht
Durchsuche Prozess 'sftlist.exe' - '85' Modul(e) wurden durchsucht
Durchsuche Prozess 'CVHSVC.EXE' - '82' Modul(e) wurden durchsucht
Durchsuche Prozess 'avshadow.exe' - '20' Modul(e) wurden durchsucht
Durchsuche Prozess 'AVWEBGRD.EXE' - '72' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchIndexer.exe' - '57' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskhost.exe' - '68' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '178' Modul(e) wurden durchsucht
Durchsuche Prozess 'ALU.exe' - '60' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'ATKOSD2.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'sensorsrv.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'BatteryLife.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'AsScrPro.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'CLMLSvc.exe' - '40' Modul(e) wurden durchsucht
Durchsuche Prozess 'ETDCtrl.exe' - '46' Modul(e) wurden durchsucht
Durchsuche Prozess 'LXCZbmgr.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'sidebar.exe' - '83' Modul(e) wurden durchsucht
Durchsuche Prozess 'GoogleToolbarNotifier.exe' - '63' Modul(e) wurden durchsucht
Durchsuche Prozess 'lxczbmon.exe' - '22' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'SRSPremiumPanel_64.exe' - '40' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dropbox.exe' - '96' Modul(e) wurden durchsucht
Durchsuche Prozess 'ONENOTEM.EXE' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'ETDCtrlHelper.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'soffice.exe' - '24' Modul(e) wurden durchsucht
Durchsuche Prozess 'soffice.bin' - '97' Modul(e) wurden durchsucht
Durchsuche Prozess 'DMedia.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'HControlUser.exe' - '22' Modul(e) wurden durchsucht
Durchsuche Prozess 'wcourier.exe' - '43' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '98' Modul(e) wurden durchsucht
Durchsuche Prozess 'TBNotifier.exe' - '84' Modul(e) wurden durchsucht
Durchsuche Prozess 'pdf24.exe' - '51' Modul(e) wurden durchsucht
Durchsuche Prozess 'jusched.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'hamachi-2-ui.exe' - '61' Modul(e) wurden durchsucht
Durchsuche Prozess 'MOM.exe' - '70' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '60' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '60' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmpnetwk.exe' - '117' Modul(e) wurden durchsucht
Durchsuche Prozess 'DllHost.exe' - '45' Modul(e) wurden durchsucht
Durchsuche Prozess 'CCC.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'UNS.exe' - '61' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '69' Modul(e) wurden durchsucht
Durchsuche Prozess 'ControlDeck.exe' - '99' Modul(e) wurden durchsucht
Durchsuche Prozess 'PresentationFontCache.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'mbam.exe' - '110' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '135' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '123' Modul(e) wurden durchsucht
Durchsuche Prozess 'smss.exe' - '2' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'services.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '73' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsm.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '31' Modul(e) wurden durchsucht
Der Suchlauf über die ausgewählten Dateien wird begonnen:
Beginne mit der Suche in 'C:\Users\Sandra\AppData\Local\Temp\Patch1'
C:\Users\Sandra\AppData\Local\Temp\Patch1
[FUND] Ist das Trojanische Pferd TR/Dropper.MSIL.43179
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5440b25b.qua' verschoben!
Ende des Suchlaufs: Mittwoch, 5. März 2014 14:11
Benötigte Zeit: 00:14 Minute(n)
Der Suchlauf wurde vollständig durchgeführt.
0 Verzeichnisse wurden überprüft
1990 Dateien wurden geprüft
1 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
0 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
1 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
0 Dateien konnten nicht durchsucht werden
1989 Dateien ohne Befall
6 Archive wurden durchsucht
0 Warnungen
1 Hinweise
Code:
ATTFilter
Avira Free Antivirus
Erstellungsdatum der Reportdatei: Mittwoch, 5. März 2014 14:06
Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.
Lizenznehmer : Avira Antivirus Free
Seriennummer : 0000149996-AVHOE-0000001
Plattform : Windows 7 Home Premium
Windowsversion : (Service Pack 1) [6.1.7601]
Boot Modus : Normal gebootet
Benutzername : SYSTEM
Computername : SANDRAS-LAPTOP
Versionsinformationen:
BUILD.DAT : 14.0.3.338 56624 Bytes 14.02.2014 11:00:00
AVSCAN.EXE : 14.0.3.332 1058384 Bytes 18.02.2014 10:45:30
AVSCANRC.DLL : 14.0.2.180 62008 Bytes 17.12.2013 13:01:02
LUKE.DLL : 14.0.3.336 65616 Bytes 18.02.2014 10:45:43
AVSCPLR.DLL : 14.0.3.336 124496 Bytes 18.02.2014 10:45:30
AVREG.DLL : 14.0.3.336 250448 Bytes 18.02.2014 10:45:28
avlode.dll : 14.0.3.336 544848 Bytes 18.02.2014 10:45:28
avlode.rdf : 14.0.3.26 58589 Bytes 11.02.2014 10:43:49
VBASE000.VDF : 7.11.70.0 66736640 Bytes 04.04.2013 09:53:17
VBASE001.VDF : 7.11.74.226 2201600 Bytes 30.04.2013 18:31:21
VBASE002.VDF : 7.11.80.60 2751488 Bytes 28.05.2013 11:39:51
VBASE003.VDF : 7.11.85.214 2162688 Bytes 21.06.2013 15:31:19
VBASE004.VDF : 7.11.91.176 3903488 Bytes 23.07.2013 06:49:21
VBASE005.VDF : 7.11.98.186 6822912 Bytes 29.08.2013 13:12:34
VBASE006.VDF : 7.11.103.230 2293248 Bytes 24.09.2013 19:13:34
VBASE007.VDF : 7.11.116.38 5485568 Bytes 28.11.2013 13:54:14
VBASE008.VDF : 7.11.126.50 3615744 Bytes 22.01.2014 17:09:15
VBASE009.VDF : 7.11.128.174 2030080 Bytes 03.02.2014 14:59:49
VBASE010.VDF : 7.11.134.72 3034112 Bytes 03.03.2014 21:52:42
VBASE011.VDF : 7.11.134.73 2048 Bytes 03.03.2014 21:52:42
VBASE012.VDF : 7.11.134.74 2048 Bytes 03.03.2014 21:52:42
VBASE013.VDF : 7.11.134.75 2048 Bytes 03.03.2014 21:52:42
VBASE014.VDF : 7.11.134.76 2048 Bytes 03.03.2014 21:52:42
VBASE015.VDF : 7.11.134.77 2048 Bytes 03.03.2014 21:52:42
VBASE016.VDF : 7.11.134.78 2048 Bytes 03.03.2014 21:52:42
VBASE017.VDF : 7.11.134.79 2048 Bytes 03.03.2014 21:52:42
VBASE018.VDF : 7.11.134.80 2048 Bytes 03.03.2014 21:52:42
VBASE019.VDF : 7.11.134.81 2048 Bytes 03.03.2014 21:52:42
VBASE020.VDF : 7.11.134.82 2048 Bytes 03.03.2014 21:52:42
VBASE021.VDF : 7.11.134.83 2048 Bytes 03.03.2014 21:52:42
VBASE022.VDF : 7.11.134.84 2048 Bytes 03.03.2014 21:52:42
VBASE023.VDF : 7.11.134.85 2048 Bytes 03.03.2014 21:52:42
VBASE024.VDF : 7.11.134.86 2048 Bytes 03.03.2014 21:52:42
VBASE025.VDF : 7.11.134.87 2048 Bytes 03.03.2014 21:52:42
VBASE026.VDF : 7.11.134.88 2048 Bytes 03.03.2014 21:52:42
VBASE027.VDF : 7.11.134.89 2048 Bytes 03.03.2014 21:52:42
VBASE028.VDF : 7.11.134.90 2048 Bytes 03.03.2014 21:52:42
VBASE029.VDF : 7.11.134.91 2048 Bytes 03.03.2014 21:52:42
VBASE030.VDF : 7.11.134.92 2048 Bytes 03.03.2014 21:52:42
VBASE031.VDF : 7.11.134.198 319488 Bytes 05.03.2014 07:21:59
Engineversion : 8.2.14.18
AEVDF.DLL : 8.1.3.4 102774 Bytes 13.06.2013 15:49:57
AESCRIPT.DLL : 8.1.4.194 524670 Bytes 28.02.2014 10:46:04
AESCN.DLL : 8.1.10.6 131447 Bytes 11.12.2013 14:58:55
AESBX.DLL : 8.2.20.6 1331575 Bytes 13.01.2014 13:53:46
AERDL.DLL : 8.2.0.138 704888 Bytes 02.12.2013 14:31:28
AEPACK.DLL : 8.4.0.4 774520 Bytes 28.02.2014 10:46:04
AEOFFICE.DLL : 8.1.2.82 205181 Bytes 19.02.2014 10:42:20
AEHEUR.DLL : 8.1.4.938 6521210 Bytes 28.02.2014 10:46:03
AEHELP.DLL : 8.1.27.10 266618 Bytes 22.11.2013 14:31:34
AEGEN.DLL : 8.1.7.22 446839 Bytes 15.01.2014 15:17:35
AEEXP.DLL : 8.4.1.238 483704 Bytes 28.02.2014 10:46:04
AEEMU.DLL : 8.1.3.2 393587 Bytes 10.07.2012 15:50:02
AECORE.DLL : 8.1.35.0 229753 Bytes 11.02.2014 17:14:56
AEBB.DLL : 8.1.1.4 53619 Bytes 05.11.2012 20:31:17
AVWINLL.DLL : 14.0.3.252 23608 Bytes 18.02.2014 10:45:23
AVPREF.DLL : 14.0.3.252 48696 Bytes 18.02.2014 10:45:28
AVREP.DLL : 14.0.3.252 175672 Bytes 18.02.2014 10:45:28
AVARKT.DLL : 14.0.3.336 256080 Bytes 18.02.2014 10:45:24
AVEVTLOG.DLL : 14.0.3.336 165968 Bytes 18.02.2014 10:45:26
SQLITE3.DLL : 3.7.0.1 394824 Bytes 29.07.2013 13:05:46
AVSMTP.DLL : 14.0.3.252 60472 Bytes 18.02.2014 10:45:30
NETNT.DLL : 14.0.3.252 13368 Bytes 18.02.2014 10:45:44
RCIMAGE.DLL : 14.0.3.260 4979256 Bytes 18.02.2014 10:45:23
RCTEXT.DLL : 14.0.3.282 72760 Bytes 18.02.2014 10:45:23
Konfiguration für den aktuellen Suchlauf:
Job Name..............................: AVGuardAsyncScan
Konfigurationsdatei...................: C:\ProgramData\Avira\AntiVir Desktop\TEMP\AVGUARD_531713a8\guard_slideup.avp
Protokollierung.......................: standard
Primäre Aktion........................: Reparieren
Sekundäre Aktion......................: Quarantäne
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: aus
Durchsuche aktive Programme...........: ein
Durchsuche Registrierung..............: aus
Suche nach Rootkits...................: aus
Integritätsprüfung von Systemdateien..: aus
Prüfe alle Dateien....................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: Vollständig
Beginn des Suchlaufs: Mittwoch, 5. März 2014 14:06
Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'svchost.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'atiesrxx.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '99' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '111' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '83' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '151' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '73' Modul(e) wurden durchsucht
Durchsuche Prozess 'atieclxx.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'FBAgent.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'ASLDRSrv.exe' - '24' Modul(e) wurden durchsucht
Durchsuche Prozess 'GFNEXSrv.exe' - '14' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '91' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '59' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '61' Modul(e) wurden durchsucht
Durchsuche Prozess 'armsvc.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '110' Modul(e) wurden durchsucht
Durchsuche Prozess 'apnmcp.exe' - '43' Modul(e) wurden durchsucht
Durchsuche Prozess 'cvpnd.exe' - '63' Modul(e) wurden durchsucht
Durchsuche Prozess 'LMIGuardianSvc.exe' - '45' Modul(e) wurden durchsucht
Durchsuche Prozess 'LMS.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'lxczcoms.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'sftvsa.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLIDSVC.EXE' - '76' Modul(e) wurden durchsucht
Durchsuche Prozess 'hamachi-2.exe' - '74' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLIDSvcM.exe' - '17' Modul(e) wurden durchsucht
Durchsuche Prozess 'sftlist.exe' - '85' Modul(e) wurden durchsucht
Durchsuche Prozess 'CVHSVC.EXE' - '82' Modul(e) wurden durchsucht
Durchsuche Prozess 'avshadow.exe' - '20' Modul(e) wurden durchsucht
Durchsuche Prozess 'AVWEBGRD.EXE' - '72' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchIndexer.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskhost.exe' - '68' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '178' Modul(e) wurden durchsucht
Durchsuche Prozess 'ALU.exe' - '60' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'ATKOSD2.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'sensorsrv.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'BatteryLife.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'AsScrPro.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'CLMLSvc.exe' - '40' Modul(e) wurden durchsucht
Durchsuche Prozess 'ETDCtrl.exe' - '46' Modul(e) wurden durchsucht
Durchsuche Prozess 'LXCZbmgr.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'sidebar.exe' - '83' Modul(e) wurden durchsucht
Durchsuche Prozess 'GoogleToolbarNotifier.exe' - '63' Modul(e) wurden durchsucht
Durchsuche Prozess 'lxczbmon.exe' - '22' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'SRSPremiumPanel_64.exe' - '40' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dropbox.exe' - '96' Modul(e) wurden durchsucht
Durchsuche Prozess 'ONENOTEM.EXE' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'ETDCtrlHelper.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'soffice.exe' - '24' Modul(e) wurden durchsucht
Durchsuche Prozess 'soffice.bin' - '97' Modul(e) wurden durchsucht
Durchsuche Prozess 'DMedia.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'HControlUser.exe' - '22' Modul(e) wurden durchsucht
Durchsuche Prozess 'wcourier.exe' - '43' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '98' Modul(e) wurden durchsucht
Durchsuche Prozess 'TBNotifier.exe' - '84' Modul(e) wurden durchsucht
Durchsuche Prozess 'pdf24.exe' - '51' Modul(e) wurden durchsucht
Durchsuche Prozess 'jusched.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'hamachi-2-ui.exe' - '61' Modul(e) wurden durchsucht
Durchsuche Prozess 'MOM.exe' - '70' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '60' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '60' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmpnetwk.exe' - '117' Modul(e) wurden durchsucht
Durchsuche Prozess 'DllHost.exe' - '45' Modul(e) wurden durchsucht
Durchsuche Prozess 'CCC.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'UNS.exe' - '61' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '69' Modul(e) wurden durchsucht
Durchsuche Prozess 'ControlDeck.exe' - '99' Modul(e) wurden durchsucht
Durchsuche Prozess 'PresentationFontCache.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'mbam.exe' - '110' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '123' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '123' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '9' Modul(e) wurden durchsucht
Durchsuche Prozess 'smss.exe' - '2' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'services.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '73' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsm.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '31' Modul(e) wurden durchsucht
Der Suchlauf über die ausgewählten Dateien wird begonnen:
Beginne mit der Suche in 'C:\Users\Sandra\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Q2G9LJR\Patch1[1].exe'
C:\Users\Sandra\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Q2G9LJR\Patch1[1].exe
[FUND] Ist das Trojanische Pferd TR/Dropper.MSIL.43179
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '55bab129.qua' verschoben!
Ende des Suchlaufs: Mittwoch, 5. März 2014 14:07
Benötigte Zeit: 01:34 Minute(n)
Der Suchlauf wurde vollständig durchgeführt.
0 Verzeichnisse wurden überprüft
1992 Dateien wurden geprüft
1 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
0 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
1 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
0 Dateien konnten nicht durchsucht werden
1991 Dateien ohne Befall
6 Archive wurden durchsucht
0 Warnungen
1 Hinweise
MFG Sandra |
|
05.03.2014, 17:18
| #2 |
| /// the machine /// TB-Ausbilder    | Windows 7: Virenbefall durch AntiVir entdeckt TR/Dropper.MSIL.43179 hi,
__________________Stick anklemmen und nicht mehr abklemmen. Scan mit Combofix
__________________ |
|
05.03.2014, 19:11
| #3 |
| | Windows 7: Virenbefall durch AntiVir entdeckt TR/Dropper.MSIL.43179 Vielen Dank für die schnelle Antwort!
__________________hier die Combofix: Code:
ATTFilter ComboFix 14-03-04.03 - Sandra 05.03.2014 18:53:18.3.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.3949.2394 [GMT 1:00]
ausgeführt von:: c:\users\Sandra\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-02-05 bis 2014-03-05 ))))))))))))))))))))))))))))))
.
.
2014-03-05 17:59 . 2014-03-05 17:59 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-03-05 14:07 . 2014-03-05 14:47 -------- d-----w- C:\FRST
2014-03-04 08:37 . 2014-02-06 09:01 10536864 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{B1E69EF2-CC57-4762-B082-44E016FBBF7B}\mpengine.dll
2014-02-28 17:10 . 2014-02-28 17:10 -------- d-----w- c:\program files (x86)\LogMeIn Hamachi
2014-02-25 15:07 . 2014-02-25 15:07 -------- d-----w- c:\windows\Migration
2014-02-25 15:05 . 2014-02-25 15:05 -------- d-----w- c:\program files (x86)\Common Files\Skype
2014-02-21 11:34 . 2014-02-21 11:34 17858952 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe
2014-02-17 14:59 . 2013-12-21 09:53 548864 ----a-w- c:\windows\system32\vbscript.dll
2014-02-17 14:59 . 2013-12-21 08:56 454656 ----a-w- c:\windows\SysWow64\vbscript.dll
2014-02-17 14:58 . 2014-02-06 11:30 2724864 ----a-w- c:\windows\system32\mshtml.tlb
2014-02-17 14:58 . 2014-02-06 10:20 2724864 ----a-w- c:\windows\SysWow64\mshtml.tlb
2014-02-17 14:58 . 2014-02-06 10:17 195584 ----a-w- c:\windows\system32\msrating.dll
2014-02-13 16:05 . 2014-02-13 16:05 -------- d-----w- c:\users\Sandra\AppData\Roaming\Malwarebytes
2014-02-13 16:03 . 2014-02-13 16:03 -------- d-----w- c:\programdata\Malwarebytes
2014-02-07 13:53 . 2014-02-08 09:53 -------- d-----w- c:\program files (x86)\Mozilla Thunderbird
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-02-21 11:34 . 2012-11-18 12:10 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-02-21 11:34 . 2011-09-24 12:19 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-02-17 15:08 . 2011-07-21 20:11 88567024 ----a-w- c:\windows\system32\MRT.exe
2014-01-22 06:32 . 2014-01-22 06:32 1002728 ----a-w- c:\windows\system32\WinUSBCoInstaller2.dll
2014-01-22 06:32 . 2014-01-22 06:32 1721576 ----a-w- c:\windows\system32\WdfCoInstaller01009.dll
2014-01-06 19:23 . 2014-01-06 19:23 4558848 ----a-w- c:\windows\SysWow64\GPhotos.scr
2013-12-18 20:09 . 2014-01-21 08:02 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-12-18 05:13 . 2011-07-22 16:06 270496 ------w- c:\windows\system32\MpSigStub.exe
2013-12-17 13:02 . 2013-07-29 18:51 84720 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2013-12-17 13:02 . 2013-07-29 18:47 131576 ----a-w- c:\windows\system32\drivers\avipbb.sys
2013-12-17 13:02 . 2013-07-29 18:47 108440 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2013-12-14 13:49 . 2013-12-14 13:49 940032 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-12-14 13:49 . 2013-12-14 13:49 194048 ----a-w- c:\windows\SysWow64\elshyph.dll
2013-12-14 13:48 . 2013-12-14 13:48 71680 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2013-12-14 13:48 . 2013-12-14 13:48 645120 ----a-w- c:\windows\SysWow64\jsIntl.dll
2013-12-14 13:48 . 2013-12-14 13:48 62464 ----a-w- c:\windows\SysWow64\tdc.ocx
2013-12-14 13:48 . 2013-12-14 13:48 34816 ----a-w- c:\windows\SysWow64\JavaScriptCollectionAgent.dll
2013-12-14 13:48 . 2013-12-14 13:48 337408 ----a-w- c:\windows\SysWow64\html.iec
2013-12-14 13:48 . 2013-12-14 13:48 235008 ----a-w- c:\windows\system32\elshyph.dll
2013-12-14 13:48 . 2013-12-14 13:48 182272 ----a-w- c:\windows\SysWow64\msls31.dll
2013-12-14 13:48 . 2013-12-14 13:48 86016 ----a-w- c:\windows\SysWow64\iesysprep.dll
2013-12-14 13:48 . 2013-12-14 13:48 74240 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-12-14 13:48 . 2013-12-14 13:48 61952 ----a-w- c:\windows\SysWow64\MshtmlDac.dll
2013-12-14 13:48 . 2013-12-14 13:48 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2013-12-14 13:48 . 2013-12-14 13:48 36352 ----a-w- c:\windows\SysWow64\imgutil.dll
2013-12-14 13:48 . 2013-12-14 13:48 24576 ----a-w- c:\windows\SysWow64\licmgr10.dll
2013-12-14 13:48 . 2013-12-14 13:48 151552 ----a-w- c:\windows\SysWow64\iexpress.exe
2013-12-14 13:48 . 2013-12-14 13:48 139264 ----a-w- c:\windows\SysWow64\wextract.exe
2013-12-14 13:48 . 2013-12-14 13:48 13312 ----a-w- c:\windows\SysWow64\mshta.exe
2013-12-14 13:48 . 2013-12-14 13:48 111616 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-12-14 13:48 . 2013-12-14 13:48 1051136 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-12-14 13:48 . 2013-12-14 13:48 942592 ----a-w- c:\windows\system32\jsIntl.dll
2013-12-14 13:48 . 2013-12-14 13:48 90112 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-12-14 13:48 . 2013-12-14 13:48 86016 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2013-12-14 13:48 . 2013-12-14 13:48 77312 ----a-w- c:\windows\system32\tdc.ocx
2013-12-14 13:48 . 2013-12-14 13:48 616104 ----a-w- c:\windows\system32\ieapfltr.dat
2013-12-14 13:48 . 2013-12-14 13:48 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2013-12-14 13:48 . 2013-12-14 13:48 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-12-14 13:48 . 2013-12-14 13:48 453120 ----a-w- c:\windows\system32\dxtmsft.dll
2013-12-14 13:48 . 2013-12-14 13:48 413696 ----a-w- c:\windows\system32\html.iec
2013-12-14 13:48 . 2013-12-14 13:48 40448 ----a-w- c:\windows\system32\JavaScriptCollectionAgent.dll
2013-12-14 13:48 . 2013-12-14 13:48 296960 ----a-w- c:\windows\system32\dxtrans.dll
2013-12-14 13:48 . 2013-12-14 13:48 247808 ----a-w- c:\windows\system32\msls31.dll
2013-12-14 13:48 . 2013-12-14 13:48 13312 ----a-w- c:\windows\system32\msfeedssync.exe
2013-12-14 13:48 . 2013-12-14 13:48 131072 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-12-14 13:48 . 2013-12-14 13:48 105984 ----a-w- c:\windows\system32\iesysprep.dll
2013-12-14 13:48 . 2013-12-14 13:48 84992 ----a-w- c:\windows\system32\mshtmled.dll
2013-12-14 13:48 . 2013-12-14 13:48 81408 ----a-w- c:\windows\system32\icardie.dll
2013-12-14 13:48 . 2013-12-14 13:48 62464 ----a-w- c:\windows\system32\pngfilt.dll
2013-12-14 13:48 . 2013-12-14 13:48 30208 ----a-w- c:\windows\system32\licmgr10.dll
2013-12-14 13:48 . 2013-12-14 13:48 263376 ----a-w- c:\windows\system32\iedkcs32.dll
2013-12-14 13:48 . 2013-12-14 13:48 243200 ----a-w- c:\windows\system32\webcheck.dll
2013-12-14 13:48 . 2013-12-14 13:48 235520 ----a-w- c:\windows\system32\url.dll
2013-12-14 13:48 . 2013-12-14 13:48 167424 ----a-w- c:\windows\system32\iexpress.exe
2013-12-14 13:48 . 2013-12-14 13:48 147968 ----a-w- c:\windows\system32\occache.dll
2013-12-14 13:48 . 2013-12-14 13:48 143872 ----a-w- c:\windows\system32\wextract.exe
2013-12-14 13:48 . 2013-12-14 13:48 13824 ----a-w- c:\windows\system32\mshta.exe
2013-12-14 13:48 . 2013-12-14 13:48 1228800 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-12-14 13:48 . 2013-12-14 13:48 101376 ----a-w- c:\windows\system32\inseng.dll
2013-12-14 13:48 . 2013-12-14 13:48 83968 ----a-w- c:\windows\system32\MshtmlDac.dll
2013-12-14 13:48 . 2013-12-14 13:48 774144 ----a-w- c:\windows\system32\jscript.dll
2013-12-14 13:48 . 2013-12-14 13:48 48128 ----a-w- c:\windows\system32\imgutil.dll
2013-12-14 13:48 . 2013-12-14 13:48 135680 ----a-w- c:\windows\system32\iepeers.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{41564952-412D-5637-00A7-7A786E7484D7}]
2014-02-13 05:22 12240 ----a-w- c:\program files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{41564952-412D-5637-00A7-7A786E7484D7}"= "c:\program files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll" [2014-02-13 12240]
.
[HKEY_CLASSES_ROOT\clsid\{41564952-412d-5637-00a7-7a786e7484d7}]
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 131248 ----a-w- c:\users\Sandra\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 131248 ----a-w- c:\users\Sandra\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 131248 ----a-w- c:\users\Sandra\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-01-12 39408]
"Pando Media Booster"="c:\program files (x86)\Pando Networks\Media Booster\PMB.exe" [2012-12-18 3093624]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"UpdateLBPShortCut"="c:\program files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]
"UpdateP2GoShortCut"="c:\program files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-08-12 98304]
"ATKMEDIA"="c:\program files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe" [2010-05-03 170624]
"HControlUser"="c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe" [2009-06-19 105016]
"Wireless Console 3"="c:\program files (x86)\ASUS\Wireless Console 3\wcourier.exe" [2010-07-02 1597440]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2014-02-18 689744]
"ApnTBMon"="c:\program files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe" [2014-02-13 1758160]
"PDFPrint"="c:\program files (x86)\PDF24\pdf24.exe" [2013-12-06 186408]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"LogMeIn Hamachi Ui"="c:\program files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" [2014-02-26 3814736]
.
c:\users\Sandra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Sandra\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2014-1-3 30714328]
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files (x86)\Microsoft Office\Office12\ONENOTEM.EXE /tsr [2009-2-26 97680]
OpenOffice.org 3.3.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys;c:\windows\SYSNATIVE\DRIVERS\SiSG664.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S2 AFBAgent;AFBAgent;c:\windows\system32\FBAgent.exe;c:\windows\SYSNATIVE\FBAgent.exe [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [x]
S2 APNMCP;Ask Aktualisierungsdienst;c:\program files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe;c:\program files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [x]
S2 ASMMAP64;ASMMAP64;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [x]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x]
S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [x]
S2 LMIGuardianSvc;LMIGuardianSvc;c:\program files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe;c:\program files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [x]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [x]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys;c:\windows\SYSNATIVE\DRIVERS\ETD.sys [x]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys;c:\windows\SYSNATIVE\DRIVERS\HECIx64.sys [x]
S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys;c:\windows\SYSNATIVE\DRIVERS\jmcr.sys [x]
S3 JME;JMicron Ethernet Adapter NDIS6.20 Driver (Amd64 Bits);c:\windows\system32\DRIVERS\JME.sys;c:\windows\SYSNATIVE\DRIVERS\JME.sys [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
Inhalt des "geplante Tasks" Ordners
.
2014-03-05 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-11-18 11:34]
.
2014-03-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-11-14 11:13]
.
2014-03-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-11-14 11:13]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{41564952-412D-5637-00A7-7A786E7484D7}]
2014-02-13 05:22 13776 ----a-w- c:\program files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{41564952-412D-5637-00A7-7A786E7484D7}"= "c:\program files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll" [2014-02-13 13776]
.
[HKEY_CLASSES_ROOT\CLSID\{41564952-412D-5637-00A7-7A786E7484D7}]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 164016 ----a-w- c:\users\Sandra\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 164016 ----a-w- c:\users\Sandra\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 164016 ----a-w- c:\users\Sandra\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 164016 ----a-w- c:\users\Sandra\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SmartAudio"="c:\program files\CONEXANT\SAII\SAIICpl.exe" [2010-12-14 316032]
"ETDWare"="c:\program files (x86)\Elantech\ETDCtrl.exe" [BU]
"lxczbmgr.exe"="c:\program files (x86)\Lexmark 1200 Series\lxczbmgr.exe" [2007-04-19 74672]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://asus.msn.com
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files (x86)\ICQ7.5\ICQ.exe
LSP: c:\program files (x86)\Avira\AntiVir Desktop\avsda.dll
TCP: Interfaces\{E6BE1AF5-1BF7-46CD-9F7A-907DF6743805}: NameServer = 212.123.96.110,141.82.16.200
FF - ProfilePath - c:\users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\qk2a4lxz.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.ecosia.org/?ref=fb-409730502
FF - user.js: general.useragent.extra.brc -
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
AddRemove-K_Series_ScreenSaver_EN - c:\windows\system32\K_Series_ScreenSaver_EN.scr
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_70_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_70_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_70_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_70_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_70.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.12"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_70.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_70.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_70.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-03-05 19:02:03
ComboFix-quarantined-files.txt 2014-03-05 18:02
ComboFix2.txt 2014-03-05 17:05
.
Vor Suchlauf: 16 Verzeichnis(se), 131.940.610.048 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 131.865.894.912 Bytes frei
.
- - End Of File - - 5F90C32B963AD39A6BC51B810338A416
|
|
06.03.2014, 19:35
| #4 |
| /// the machine /// TB-Ausbilder | Windows 7: Virenbefall durch AntiVir entdeckt TR/Dropper.MSIL.43179 Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
07.03.2014, 11:01
| #5 |
| | Windows 7: Virenbefall durch AntiVir entdeckt TR/Dropper.MSIL.43179 Hallo Schrauber, hier die Logdateien von AdwCleaner, JRT und ein neues FRST log. Zuerst das AdwCleaner Log: Code:
ATTFilter # AdwCleaner v3.020 - Bericht erstellt am 07/03/2014 um 10:37:12
# Aktualisiert 27/02/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Sandra - SANDRAS-LAPTOP
# Gestartet von : C:\Users\Sandra\Desktop\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\Partner
Datei Gelöscht : C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\qk2a4lxz.default\user.js
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\APN PIP
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\PIP
Schlüssel Gelöscht : HKLM\Software\PIP
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.16518
-\\ Mozilla Firefox v27.0.1 (de)
[ Datei : C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\qk2a4lxz.default\prefs.js ]
*************************
AdwCleaner[R0].txt - [1943 octets] - [07/03/2014 10:36:02]
AdwCleaner[S0].txt - [1724 octets] - [07/03/2014 10:37:12]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1784 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.2 (02.20.2014:1)
OS: Windows 7 Home Premium x64
Ran by Sandra on 07.03.2014 at 10:46:42,09
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\apntbmon
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{41564952-412D-5637-00A7-7A786E7484D7}
~~~ Files
Successfully deleted: [File] C:\Windows\syswow64\sho3764.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho3BD7.tmp
~~~ Folders
Successfully deleted: [Folder] "C:\ProgramData\apn"
Successfully deleted: [Empty Folder] C:\Users\Sandra\appdata\local\{48330773-5CE7-4183-8915-1A6690EA1F7E}
~~~ FireFox
Successfully deleted: [File] C:\Users\Sandra\AppData\Roaming\mozilla\firefox\profiles\qk2a4lxz.default\extensions\toolbar_avira-v7@apn.ask.com.xpi
Emptied folder: C:\Users\Sandra\AppData\Roaming\mozilla\firefox\profiles\qk2a4lxz.default\minidumps [631 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 07.03.2014 at 10:53:21,34
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 05-03-2014
Ran by Sandra (administrator) on SANDRAS-LAPTOP on 07-03-2014 10:55:31
Running from C:\Users\Sandra\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(ASUSTeK Computer Inc.) C:\Windows\system32\FBAgent.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
( ) C:\Windows\system32\lxczcoms.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(ELAN Microelectronic Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Lexmark International, Inc.) C:\Program Files (x86)\Lexmark 1200 Series\LXCZbmgr.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
() C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
(Lexmark International, Inc.) C:\Program Files (x86)\Lexmark 1200 Series\lxczbmon.exe
(ASUS) C:\Windows\AsScrPro.exe
(Dropbox, Inc.) C:\Users\Sandra\AppData\Roaming\Dropbox\bin\Dropbox.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
() C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(ASUS) C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe
(ASUS) C:\Program Files\P4G\BatteryLife.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
() C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(APN) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(ELAN Microelectronic Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(asus) C:\Program Files (x86)\ASUS\ControlDeck\ControlDeck.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Thisisu) C:\Users\Sandra\Desktop\JRT.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [SmartAudio] - C:\Program Files\CONEXANT\SAII\SAIICpl.exe [316032 2010-12-14] (Conexant systems, Inc.)
HKLM\...\Run: [ETDWare] - C:\Program Files\Elantech\ETDCtrl.exe [649608 2010-04-13] (ELAN Microelectronic Corp.)
HKLM\...\Run: [lxczbmgr.exe] - C:\Program Files (x86)\Lexmark 1200 Series\lxczbmgr.exe [74672 2007-04-19] (Lexmark International, Inc.)
HKLM-x32\...\Run: [UpdateLBPShortCut] - C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [222504 2009-05-20] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdateP2GoShortCut] - C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-20] (CyberLink Corp.)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-08-12] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [ATKMEDIA] - C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [170624 2010-05-03] (ASUS)
HKLM-x32\...\Run: [HControlUser] - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
HKLM-x32\...\Run: [Wireless Console 3] - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe [1597440 2010-07-02] ()
HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-18] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [186408 2013-12-06] (Geek Software GmbH)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [3814736 2014-02-26] (LogMeIn Inc.)
HKU\S-1-5-21-248383319-906549810-607593882-1000\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2011-01-12] (Google Inc.)
HKU\S-1-5-21-248383319-906549810-607593882-1000\...\Run: [Pando Media Booster] - C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe [3093624 2012-12-18] ()
Startup: C:\Users\Sandra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Sandra\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Sandra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Sandra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://asus.msn.com
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT
BHO: Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO-x32: No Name - {41564952-412D-5637-00A7-7A786E7484D7} - No File
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - No Name - {41564952-412D-5637-00A7-7A786E7484D7} - No File
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Handler: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\system32\urlmon.dll (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\..\Interfaces\{E6BE1AF5-1BF7-46CD-9F7A-907DF6743805}: [NameServer]212.123.96.110,141.82.16.200
FireFox:
========
FF ProfilePath: C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\qk2a4lxz.default
FF Homepage: hxxp://www.ecosia.org/?ref=fb-409730502
FF NetworkProxy: "http", "174.129.135.239 "
FF NetworkProxy: "http_port", 5555
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_70.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_70.dll ()
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: WOT - C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\qk2a4lxz.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2014-03-05]
FF Extension: Ecosia - The search engine that plants trees - C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\qk2a4lxz.default\Extensions\{d04b0b40-3dab-4f0b-97a6-04ec3eddbfb0}.xpi [2013-11-26]
FF Extension: Adblock Plus - C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\qk2a4lxz.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-10-02]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-02-17]
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1017424 2014-02-18] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2014-02-13] (APN LLC.)
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [377616 2014-02-26] (LogMeIn, Inc.)
R2 lxcz_device; C:\Windows\system32\lxczcoms.exe [566192 2007-04-19] ( )
R2 lxcz_device; C:\Windows\SysWOW64\lxczcoms.exe [537520 2007-04-19] ( )
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-07] (Avira Operations GmbH & Co. KG)
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1800192 2009-08-20] ()
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-03-07 10:55 - 2014-03-07 10:55 - 00016442 _____ () C:\Users\Sandra\Desktop\FRST.txt
2014-03-07 10:53 - 2014-03-07 10:53 - 00001416 _____ () C:\Users\Sandra\Desktop\JRT.txt
2014-03-07 10:46 - 2014-03-07 10:46 - 00000000 ____D () C:\Windows\ERUNT
2014-03-07 10:43 - 2014-03-07 10:43 - 01037734 _____ (Thisisu) C:\Users\Sandra\Desktop\JRT.exe
2014-03-07 10:40 - 2014-03-07 10:40 - 00001864 _____ () C:\Users\Sandra\Desktop\AdwCleaner[S0].txt
2014-03-07 10:35 - 2014-03-07 10:37 - 00000000 ____D () C:\AdwCleaner
2014-03-07 10:32 - 2014-03-07 10:32 - 01244192 _____ () C:\Users\Sandra\Desktop\adwcleaner.exe
2014-03-05 19:02 - 2014-03-05 19:02 - 00024851 _____ () C:\Users\Sandra\Desktop\combofix.txt
2014-03-05 19:02 - 2014-03-05 19:02 - 00024851 _____ () C:\ComboFix.txt
2014-03-05 17:35 - 2014-03-05 19:02 - 00000000 ____D () C:\Qoobox
2014-03-05 17:35 - 2014-03-05 18:00 - 00000000 ____D () C:\Windows\erdnt
2014-03-05 17:35 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-03-05 17:35 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-03-05 17:35 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-03-05 17:35 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-03-05 17:35 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-03-05 17:35 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2014-03-05 17:35 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2014-03-05 17:35 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2014-03-05 17:26 - 2014-03-05 17:26 - 05186850 ____R (Swearware) C:\Users\Sandra\Desktop\ComboFix.exe
2014-03-05 16:13 - 2014-03-05 16:13 - 00008264 _____ () C:\Users\Sandra\Downloads\gmer.txt
2014-03-05 16:08 - 2014-03-05 16:08 - 00025478 _____ () C:\Users\Sandra\Desktop\AVSCAN-20140305-141112-36802DE4.LOG
2014-03-05 15:11 - 2014-03-05 15:11 - 00380416 _____ () C:\Users\Sandra\Downloads\Gmer-19357.exe
2014-03-05 15:08 - 2014-03-05 15:10 - 00032493 _____ () C:\Users\Sandra\Downloads\Addition.txt
2014-03-05 15:07 - 2014-03-07 10:55 - 00000000 ____D () C:\FRST
2014-03-05 15:07 - 2014-03-05 15:47 - 00039381 _____ () C:\Users\Sandra\Downloads\FRST.txt
2014-03-05 15:05 - 2014-03-05 15:05 - 02157056 _____ (Farbar) C:\Users\Sandra\Desktop\FRST64.exe
2014-03-05 15:04 - 2014-03-05 15:45 - 00000474 _____ () C:\Users\Sandra\Downloads\defogger_disable.log
2014-03-05 15:04 - 2014-03-05 15:04 - 00000000 _____ () C:\Users\Sandra\defogger_reenable
2014-03-05 14:40 - 2014-03-05 14:40 - 00050477 _____ () C:\Users\Sandra\Downloads\Defogger.exe
2014-03-05 13:59 - 2014-03-05 14:00 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Sandra\Downloads\mbam-setup-1.75.0.1300.exe
2014-03-05 13:55 - 2014-03-05 13:55 - 04051872 _____ (Avira Operations GmbH & Co. KG) C:\Users\Sandra\Downloads\avira_de_av___ws.exe
2014-03-05 13:38 - 2014-03-05 13:38 - 10345466 _____ () C:\Users\Sandra\Downloads\sophos-win.exe
2014-02-28 18:10 - 2014-02-28 18:10 - 00000000 ____D () C:\Program Files (x86)\LogMeIn Hamachi
2014-02-26 09:16 - 2014-02-26 09:22 - 00000000 ____D () C:\Users\Sandra\Desktop\Musik für Fairphone
2014-02-21 12:34 - 2014-02-21 12:34 - 17858952 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-02-17 15:59 - 2013-12-21 10:53 - 00548864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-02-17 15:59 - 2013-12-21 09:56 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-02-17 15:58 - 2014-02-06 12:30 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-17 15:58 - 2014-02-06 11:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-02-17 15:58 - 2014-02-06 11:17 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-02-17 15:58 - 2014-02-06 10:25 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-02-17 15:57 - 2014-02-06 13:16 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-17 15:57 - 2014-02-06 12:30 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-02-17 15:57 - 2014-02-06 12:12 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-17 15:57 - 2014-02-06 12:07 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-02-17 15:57 - 2014-02-06 12:06 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-02-17 15:57 - 2014-02-06 11:57 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-17 15:57 - 2014-02-06 11:56 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-02-17 15:57 - 2014-02-06 11:52 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-17 15:57 - 2014-02-06 11:49 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-17 15:57 - 2014-02-06 11:48 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-02-17 15:57 - 2014-02-06 11:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-02-17 15:57 - 2014-02-06 11:38 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-02-17 15:57 - 2014-02-06 11:32 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-02-17 15:57 - 2014-02-06 11:11 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-17 15:57 - 2014-02-06 11:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-02-17 15:57 - 2014-02-06 11:00 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-02-17 15:57 - 2014-02-06 10:57 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-02-17 15:57 - 2014-02-06 10:57 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-17 15:57 - 2014-02-06 10:52 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-02-17 15:57 - 2014-02-06 10:52 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-02-17 15:57 - 2014-02-06 10:50 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-17 15:57 - 2014-02-06 10:49 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-02-17 15:57 - 2014-02-06 10:47 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-02-17 15:57 - 2014-02-06 10:46 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-02-17 15:57 - 2014-02-06 10:25 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-02-17 15:57 - 2014-02-06 10:24 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-17 15:57 - 2014-02-06 10:22 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-17 15:57 - 2014-02-06 10:13 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-02-17 15:57 - 2014-02-06 10:09 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-02-17 15:57 - 2014-02-06 10:03 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-02-17 15:57 - 2014-02-06 09:55 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-17 15:57 - 2014-02-06 09:41 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-02-17 15:57 - 2014-02-06 09:40 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-02-17 15:57 - 2014-02-06 09:36 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-02-17 15:57 - 2014-02-06 09:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-02-17 14:24 - 2014-02-17 14:24 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_WinUsb_01009.Wdf
2014-02-17 12:33 - 2014-02-17 12:33 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-02-17 10:25 - 2014-01-01 00:05 - 00420008 _____ () C:\Windows\SysWOW64\locale.nls
2014-02-17 10:25 - 2014-01-01 00:04 - 00420008 _____ () C:\Windows\system32\locale.nls
2014-02-17 10:25 - 2013-12-25 00:09 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-02-17 10:25 - 2013-12-24 23:48 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-02-17 10:25 - 2013-12-06 03:30 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-02-17 10:25 - 2013-12-06 03:30 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-02-17 10:25 - 2013-12-06 03:02 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-02-17 10:25 - 2013-12-06 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-02-17 10:25 - 2013-12-04 03:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll
2014-02-17 10:25 - 2013-12-04 03:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll
2014-02-17 10:25 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll
2014-02-17 10:25 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll
2014-02-17 10:25 - 2013-12-04 03:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll
2014-02-17 10:25 - 2013-12-04 03:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe
2014-02-17 10:25 - 2013-12-04 03:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe
2014-02-17 10:25 - 2013-12-04 03:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe
2014-02-17 10:25 - 2013-12-04 03:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe
2014-02-17 10:25 - 2013-12-04 03:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll
2014-02-17 10:25 - 2013-12-04 03:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll
2014-02-17 10:25 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll
2014-02-17 10:25 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll
2014-02-17 10:25 - 2013-12-04 03:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll
2014-02-17 10:25 - 2013-12-04 02:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe
2014-02-17 10:25 - 2013-12-04 02:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe
2014-02-17 10:25 - 2013-12-04 02:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe
2014-02-17 10:25 - 2013-12-04 02:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe
2014-02-17 10:25 - 2013-11-26 09:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2014-02-17 10:25 - 2013-11-22 23:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2014-02-13 17:05 - 2014-02-13 17:05 - 00000000 ____D () C:\Users\Sandra\AppData\Roaming\Malwarebytes
2014-02-13 17:03 - 2014-02-13 17:03 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-13 17:01 - 2014-02-13 17:01 - 00614792 _____ (Chip Digital GmbH) C:\Users\Sandra\Downloads\Malwarebytes Anti Malware - CHIP-Downloader.exe
2014-02-13 16:58 - 2014-02-13 16:58 - 00000000 ____D () C:\Users\Sandra\Desktop\Neuer Ordner
2014-02-13 16:53 - 2014-03-05 19:59 - 00033019 _____ () C:\Users\Sandra\Documents\Portfolio Bevc endgültige Fassung.odt
2014-02-07 14:53 - 2014-02-08 10:53 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
==================== One Month Modified Files and Folders =======
2014-03-07 10:55 - 2014-03-07 10:55 - 00016442 _____ () C:\Users\Sandra\Desktop\FRST.txt
2014-03-07 10:55 - 2014-03-05 15:07 - 00000000 ____D () C:\FRST
2014-03-07 10:55 - 2012-12-18 09:17 - 00000000 ____D () C:\Users\Sandra\AppData\Local\PMB Files
2014-03-07 10:53 - 2014-03-07 10:53 - 00001416 _____ () C:\Users\Sandra\Desktop\JRT.txt
2014-03-07 10:48 - 2009-07-14 05:45 - 00009920 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-03-07 10:48 - 2009-07-14 05:45 - 00009920 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-03-07 10:46 - 2014-03-07 10:46 - 00000000 ____D () C:\Windows\ERUNT
2014-03-07 10:43 - 2014-03-07 10:43 - 01037734 _____ (Thisisu) C:\Users\Sandra\Desktop\JRT.exe
2014-03-07 10:41 - 2013-12-16 19:31 - 00000000 ___RD () C:\Users\Sandra\Dropbox
2014-03-07 10:41 - 2013-12-16 19:29 - 00000000 ____D () C:\Users\Sandra\AppData\Roaming\Dropbox
2014-03-07 10:40 - 2014-03-07 10:40 - 00001864 _____ () C:\Users\Sandra\Desktop\AdwCleaner[S0].txt
2014-03-07 10:40 - 2012-12-09 20:28 - 00000000 ____D () C:\Users\Sandra\AppData\Local\LogMeIn Hamachi
2014-03-07 10:40 - 2012-11-14 12:13 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-03-07 10:40 - 2011-05-06 03:25 - 00000000 ____D () C:\Program Files\P4G
2014-03-07 10:40 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-03-07 10:40 - 2009-07-14 05:51 - 00250693 _____ () C:\Windows\setupact.log
2014-03-07 10:38 - 2011-05-06 03:13 - 01991013 _____ () C:\Windows\WindowsUpdate.log
2014-03-07 10:37 - 2014-03-07 10:35 - 00000000 ____D () C:\AdwCleaner
2014-03-07 10:32 - 2014-03-07 10:32 - 01244192 _____ () C:\Users\Sandra\Desktop\adwcleaner.exe
2014-03-07 10:32 - 2013-03-24 14:05 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-03-06 11:15 - 2013-01-08 13:48 - 00003958 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{01969AC8-B8F0-48C9-A737-500E9D388A8F}
2014-03-06 07:56 - 2012-11-14 12:13 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-03-05 21:27 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-03-05 19:59 - 2014-02-13 16:53 - 00033019 _____ () C:\Users\Sandra\Documents\Portfolio Bevc endgültige Fassung.odt
2014-03-05 19:03 - 2011-05-06 03:09 - 00721920 _____ () C:\Windows\PFRO.log
2014-03-05 19:02 - 2014-03-05 19:02 - 00024851 _____ () C:\Users\Sandra\Desktop\combofix.txt
2014-03-05 19:02 - 2014-03-05 19:02 - 00024851 _____ () C:\ComboFix.txt
2014-03-05 19:02 - 2014-03-05 17:35 - 00000000 ____D () C:\Qoobox
2014-03-05 18:59 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2014-03-05 18:42 - 2014-01-13 19:58 - 00047104 ___SH () C:\Users\Sandra\Thumbs.db
2014-03-05 18:00 - 2014-03-05 17:35 - 00000000 ____D () C:\Windows\erdnt
2014-03-05 17:26 - 2014-03-05 17:26 - 05186850 ____R (Swearware) C:\Users\Sandra\Desktop\ComboFix.exe
2014-03-05 16:13 - 2014-03-05 16:13 - 00008264 _____ () C:\Users\Sandra\Downloads\gmer.txt
2014-03-05 16:08 - 2014-03-05 16:08 - 00025478 _____ () C:\Users\Sandra\Desktop\AVSCAN-20140305-141112-36802DE4.LOG
2014-03-05 15:47 - 2014-03-05 15:07 - 00039381 _____ () C:\Users\Sandra\Downloads\FRST.txt
2014-03-05 15:45 - 2014-03-05 15:04 - 00000474 _____ () C:\Users\Sandra\Downloads\defogger_disable.log
2014-03-05 15:11 - 2014-03-05 15:11 - 00380416 _____ () C:\Users\Sandra\Downloads\Gmer-19357.exe
2014-03-05 15:10 - 2014-03-05 15:08 - 00032493 _____ () C:\Users\Sandra\Downloads\Addition.txt
2014-03-05 15:05 - 2014-03-05 15:05 - 02157056 _____ (Farbar) C:\Users\Sandra\Desktop\FRST64.exe
2014-03-05 15:04 - 2014-03-05 15:04 - 00000000 _____ () C:\Users\Sandra\defogger_reenable
2014-03-05 15:04 - 2011-07-21 14:45 - 00000000 ____D () C:\Users\Sandra
2014-03-05 14:40 - 2014-03-05 14:40 - 00050477 _____ () C:\Users\Sandra\Downloads\Defogger.exe
2014-03-05 14:00 - 2014-03-05 13:59 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Sandra\Downloads\mbam-setup-1.75.0.1300.exe
2014-03-05 13:55 - 2014-03-05 13:55 - 04051872 _____ (Avira Operations GmbH & Co. KG) C:\Users\Sandra\Downloads\avira_de_av___ws.exe
2014-03-05 13:38 - 2014-03-05 13:38 - 10345466 _____ () C:\Users\Sandra\Downloads\sophos-win.exe
2014-03-04 22:46 - 2009-08-04 11:34 - 00610996 _____ () C:\Windows\system32\perfh008.dat
2014-03-04 22:46 - 2009-08-04 11:34 - 00115282 _____ () C:\Windows\system32\perfc008.dat
2014-03-04 22:46 - 2009-08-04 10:51 - 00711546 _____ () C:\Windows\system32\perfh007.dat
2014-03-04 22:46 - 2009-08-04 10:51 - 00153736 _____ () C:\Windows\system32\perfc007.dat
2014-03-04 22:46 - 2009-07-14 06:13 - 02376808 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-28 18:10 - 2014-02-28 18:10 - 00000000 ____D () C:\Program Files (x86)\LogMeIn Hamachi
2014-02-28 18:10 - 2014-01-27 14:41 - 00000928 _____ () C:\Users\Public\Desktop\LogMeIn Hamachi.lnk
2014-02-26 13:05 - 2011-08-03 22:50 - 02328674 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-02-26 09:22 - 2014-02-26 09:16 - 00000000 ____D () C:\Users\Sandra\Desktop\Musik für Fairphone
2014-02-25 16:05 - 2011-09-01 10:37 - 00002699 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-02-25 16:05 - 2011-09-01 10:37 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-02-25 16:05 - 2011-09-01 10:37 - 00000000 ____D () C:\ProgramData\Skype
2014-02-21 12:34 - 2014-02-21 12:34 - 17858952 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-02-21 12:34 - 2013-03-24 14:05 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-02-21 12:34 - 2012-11-18 13:10 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-02-21 12:34 - 2011-09-24 13:19 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-02-18 11:46 - 2013-08-06 17:00 - 00000000 ____D () C:\Windows\system32\MRT
2014-02-17 16:08 - 2011-07-21 21:11 - 88567024 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-02-17 14:24 - 2014-02-17 14:24 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_WinUsb_01009.Wdf
2014-02-17 12:33 - 2014-02-17 12:33 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-02-17 12:33 - 2012-04-25 12:04 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-02-13 17:24 - 2013-08-11 10:39 - 00000000 ____D () C:\Users\Sandra\AppData\Roaming\DVDVideoSoft
2014-02-13 17:05 - 2014-02-13 17:05 - 00000000 ____D () C:\Users\Sandra\AppData\Roaming\Malwarebytes
2014-02-13 17:03 - 2014-02-13 17:03 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-13 17:01 - 2014-02-13 17:01 - 00614792 _____ (Chip Digital GmbH) C:\Users\Sandra\Downloads\Malwarebytes Anti Malware - CHIP-Downloader.exe
2014-02-13 16:58 - 2014-02-13 16:58 - 00000000 ____D () C:\Users\Sandra\Desktop\Neuer Ordner
2014-02-13 16:52 - 2014-01-27 15:09 - 00031030 _____ () C:\Users\Sandra\Documents\Portfolio Bevc.odt
2014-02-13 13:51 - 2012-11-14 12:13 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-02-13 13:51 - 2012-11-14 12:13 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-02-12 11:04 - 2014-01-07 14:07 - 00023671 _____ () C:\Users\Sandra\Documents\Buchführung 2014.xlsx
2014-02-08 10:53 - 2014-02-07 14:53 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-02-07 22:24 - 2011-09-01 10:37 - 00000000 ____D () C:\Users\Sandra\AppData\Roaming\Skype
2014-02-06 13:16 - 2014-02-17 15:57 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-06 12:30 - 2014-02-17 15:58 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-06 12:30 - 2014-02-17 15:57 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-02-06 12:12 - 2014-02-17 15:57 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-06 12:07 - 2014-02-17 15:57 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-02-06 12:06 - 2014-02-17 15:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-02-06 11:57 - 2014-02-17 15:57 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-06 11:56 - 2014-02-17 15:57 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-02-06 11:52 - 2014-02-17 15:57 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-06 11:49 - 2014-02-17 15:57 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-06 11:48 - 2014-02-17 15:57 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-02-06 11:48 - 2014-02-17 15:57 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-02-06 11:38 - 2014-02-17 15:57 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-02-06 11:32 - 2014-02-17 15:57 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-02-06 11:20 - 2014-02-17 15:58 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-02-06 11:17 - 2014-02-17 15:58 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-02-06 11:11 - 2014-02-17 15:57 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-06 11:01 - 2014-02-17 15:57 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-02-06 11:00 - 2014-02-17 15:57 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-02-06 10:57 - 2014-02-17 15:57 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-02-06 10:57 - 2014-02-17 15:57 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-06 10:52 - 2014-02-17 15:57 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-02-06 10:52 - 2014-02-17 15:57 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-02-06 10:50 - 2014-02-17 15:57 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-06 10:49 - 2014-02-17 15:57 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-02-06 10:47 - 2014-02-17 15:57 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-02-06 10:46 - 2014-02-17 15:57 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-02-06 10:25 - 2014-02-17 15:58 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-02-06 10:25 - 2014-02-17 15:57 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-02-06 10:24 - 2014-02-17 15:57 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-06 10:22 - 2014-02-17 15:57 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-06 10:13 - 2014-02-17 15:57 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-02-06 10:09 - 2014-02-17 15:57 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-02-06 10:03 - 2014-02-17 15:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-02-06 09:55 - 2014-02-17 15:57 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-06 09:41 - 2014-02-17 15:57 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-02-06 09:40 - 2014-02-17 15:57 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-02-06 09:36 - 2014-02-17 15:57 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-02-06 09:34 - 2014-02-17 15:57 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
Some content of TEMP:
====================
C:\Users\Sandra\AppData\Local\Temp\avgnt.exe
C:\Users\Sandra\AppData\Local\Temp\Quarantine.exe
C:\Users\Sandra\AppData\Local\Temp\rtdrvmon.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-03-05 20:53
==================== End Of Log ============================
--- --- --- MFG, Sandra |
|
08.03.2014, 12:39
| #6 |
| /// the machine /// TB-Ausbilder | Windows 7: Virenbefall durch AntiVir entdeckt TR/Dropper.MSIL.43179ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ --> Windows 7: Virenbefall durch AntiVir entdeckt TR/Dropper.MSIL.43179 |
|
10.03.2014, 16:08
| #7 |
| | Windows 7: Virenbefall durch AntiVir entdeckt TR/Dropper.MSIL.43179 So, hier die Ergebnisse der neuen Scans: zuerst ESET: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=2f308b3eda33df4c8f50580431d278db
# engine=17376
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-03-10 09:52:56
# local_time=2014-03-10 10:52:56 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 94 9785 165116481 2549 0
# compatibility_mode=5893 16776573 100 94 259345 146075026 0 0
# scanned=229838
# found=6
# cleaned=0
# scan_time=5703
sh=E4B7F0BB18817D0E780CD46E9AD09AC069FF245B ft=0 fh=0000000000000000 vn="LNK/Agent.AK trojan" ac=I fn="C:\Users\Sandra\Desktop\Neuer Ordner\scan__2014-02-12_14-15-04.lnk"
sh=AB39167B4BF8B31A5D8BBA4AD8AA4E67CAF932FF ft=0 fh=0000000000000000 vn="LNK/Agent.AK trojan" ac=I fn="C:\Users\Sandra\Desktop\Neuer Ordner\scan__2014-02-12_14-18-29.lnk"
sh=EADF862C731360F6F898A268870A4AAB56621478 ft=0 fh=0000000000000000 vn="LNK/Agent.AK trojan" ac=I fn="C:\Users\Sandra\Desktop\Neuer Ordner\scan__2014-02-12_14-21-18.lnk"
sh=BD75CB72D6FF2016AE69609D4F14CD1FED66E0BE ft=0 fh=0000000000000000 vn="LNK/Agent.AK trojan" ac=I fn="C:\Users\Sandra\Desktop\Neuer Ordner\scan__2014-02-12_14-39-25.lnk"
sh=80D2D70D054027590EBF77E8BAA8EC7D46841660 ft=0 fh=0000000000000000 vn="LNK/Agent.AK trojan" ac=I fn="C:\Users\Sandra\Desktop\Neuer Ordner\scan__2014-02-12_14-47-19.lnk"
sh=7451DA98D4A12969838279A0A01B628878234B8D ft=0 fh=0000000000000000 vn="LNK/Agent.AK trojan" ac=I fn="C:\Users\Sandra\Desktop\Neuer Ordner\scan__2014-02-12_15-14-26.lnk"
Code:
ATTFilter Results of screen317's Security Check version 0.99.80
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
WMI entry may not exist for antivirus; attempting automatic update.
Avira successfully updated!
`````````Anti-malware/Other Utilities Check:`````````
Java 7 Update 51
Adobe Flash Player 12.0.0.70
Adobe Reader XI
Mozilla Firefox (27.0.1)
Mozilla Thunderbird (24.3.0)
````````Process Check: objlist.exe by Laurent````````
Avira Antivir avgnt.exe
Avira Antivir avguard.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 05-03-2014
Ran by Sandra (administrator) on SANDRAS-LAPTOP on 10-03-2014 16:01:30
Running from C:\Users\Sandra\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\system32\atiesrxx.exe
(ASUSTeK Computer Inc.) C:\Windows\system32\FBAgent.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
(AMD) C:\Windows\system32\atieclxx.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
( ) C:\Windows\system32\lxczcoms.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
() C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(ASUS) C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe
(ASUS) C:\Program Files\P4G\BatteryLife.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
(ASUS) C:\Windows\AsScrPro.exe
(ELAN Microelectronic Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Lexmark International, Inc.) C:\Program Files (x86)\Lexmark 1200 Series\LXCZbmgr.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Google Inc.) C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
() C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
(Lexmark International, Inc.) C:\Program Files (x86)\Lexmark 1200 Series\lxczbmon.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(Dropbox, Inc.) C:\Users\Sandra\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
() C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(ELAN Microelectronic Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(asus) C:\Program Files (x86)\ASUS\ControlDeck\ControlDeck.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
() C:\Users\Sandra\Desktop\SecurityCheck.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [SmartAudio] - C:\Program Files\CONEXANT\SAII\SAIICpl.exe [316032 2010-12-14] (Conexant systems, Inc.)
HKLM\...\Run: [ETDWare] - C:\Program Files\Elantech\ETDCtrl.exe [649608 2010-04-13] (ELAN Microelectronic Corp.)
HKLM\...\Run: [lxczbmgr.exe] - C:\Program Files (x86)\Lexmark 1200 Series\lxczbmgr.exe [74672 2007-04-19] (Lexmark International, Inc.)
HKLM-x32\...\Run: [UpdateLBPShortCut] - C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [222504 2009-05-20] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdateP2GoShortCut] - C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-20] (CyberLink Corp.)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-08-12] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [ATKMEDIA] - C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [170624 2010-05-03] (ASUS)
HKLM-x32\...\Run: [HControlUser] - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
HKLM-x32\...\Run: [Wireless Console 3] - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe [1597440 2010-07-02] ()
HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-18] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [186408 2013-12-06] (Geek Software GmbH)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [3814736 2014-02-26] (LogMeIn Inc.)
HKU\S-1-5-21-248383319-906549810-607593882-1000\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2011-01-12] (Google Inc.)
HKU\S-1-5-21-248383319-906549810-607593882-1000\...\Run: [Pando Media Booster] - C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe [3093624 2012-12-18] ()
Startup: C:\Users\Sandra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Sandra\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Sandra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Sandra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://asus.msn.com
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT
BHO: Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO-x32: No Name - {41564952-412D-5637-00A7-7A786E7484D7} - No File
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - No Name - {41564952-412D-5637-00A7-7A786E7484D7} - No File
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Handler: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\system32\urlmon.dll (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{E6BE1AF5-1BF7-46CD-9F7A-907DF6743805}: [NameServer]212.123.96.110,141.82.16.200
FireFox:
========
FF ProfilePath: C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\qk2a4lxz.default
FF Homepage: hxxp://www.ecosia.org/?ref=fb-409730502
FF NetworkProxy: "http", "174.129.135.239 "
FF NetworkProxy: "http_port", 5555
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_70.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_70.dll ()
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: WOT - C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\qk2a4lxz.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2014-03-05]
FF Extension: Ecosia - The search engine that plants trees - C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\qk2a4lxz.default\Extensions\{d04b0b40-3dab-4f0b-97a6-04ec3eddbfb0}.xpi [2013-11-26]
FF Extension: Adblock Plus - C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\qk2a4lxz.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-10-02]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-02-17]
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1017424 2014-02-18] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2014-02-13] (APN LLC.)
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [377616 2014-02-26] (LogMeIn, Inc.)
R2 lxcz_device; C:\Windows\system32\lxczcoms.exe [566192 2007-04-19] ( )
R2 lxcz_device; C:\Windows\SysWOW64\lxczcoms.exe [537520 2007-04-19] ( )
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-07] (Avira Operations GmbH & Co. KG)
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1800192 2009-08-20] ()
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-03-10 09:14 - 2014-03-10 09:14 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-03-10 09:12 - 2014-03-10 09:12 - 00987442 _____ () C:\Users\Sandra\Desktop\SecurityCheck.exe
2014-03-10 09:11 - 2014-03-10 09:12 - 02347384 _____ (ESET) C:\Users\Sandra\Downloads\esetsmartinstaller_enu.exe
2014-03-07 10:55 - 2014-03-10 16:01 - 00016456 _____ () C:\Users\Sandra\Desktop\FRST.txt
2014-03-07 10:53 - 2014-03-07 10:53 - 00001416 _____ () C:\Users\Sandra\Desktop\JRT.txt
2014-03-07 10:46 - 2014-03-07 10:46 - 00000000 ____D () C:\Windows\ERUNT
2014-03-07 10:43 - 2014-03-07 10:43 - 01037734 _____ (Thisisu) C:\Users\Sandra\Desktop\JRT.exe
2014-03-07 10:40 - 2014-03-07 10:40 - 00001864 _____ () C:\Users\Sandra\Desktop\AdwCleaner[S0].txt
2014-03-07 10:35 - 2014-03-07 10:37 - 00000000 ____D () C:\AdwCleaner
2014-03-07 10:32 - 2014-03-07 10:32 - 01244192 _____ () C:\Users\Sandra\Desktop\adwcleaner.exe
2014-03-05 19:02 - 2014-03-05 19:02 - 00024851 _____ () C:\Users\Sandra\Desktop\combofix.txt
2014-03-05 19:02 - 2014-03-05 19:02 - 00024851 _____ () C:\ComboFix.txt
2014-03-05 17:35 - 2014-03-05 19:02 - 00000000 ____D () C:\Qoobox
2014-03-05 17:35 - 2014-03-05 18:00 - 00000000 ____D () C:\Windows\erdnt
2014-03-05 17:35 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-03-05 17:35 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-03-05 17:35 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-03-05 17:35 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-03-05 17:35 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-03-05 17:35 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2014-03-05 17:35 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2014-03-05 17:35 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2014-03-05 17:26 - 2014-03-05 17:26 - 05186850 ____R (Swearware) C:\Users\Sandra\Desktop\ComboFix.exe
2014-03-05 16:13 - 2014-03-05 16:13 - 00008264 _____ () C:\Users\Sandra\Downloads\gmer.txt
2014-03-05 16:08 - 2014-03-05 16:08 - 00025478 _____ () C:\Users\Sandra\Desktop\AVSCAN-20140305-141112-36802DE4.LOG
2014-03-05 15:11 - 2014-03-05 15:11 - 00380416 _____ () C:\Users\Sandra\Downloads\Gmer-19357.exe
2014-03-05 15:08 - 2014-03-05 15:10 - 00032493 _____ () C:\Users\Sandra\Downloads\Addition.txt
2014-03-05 15:07 - 2014-03-10 16:01 - 00000000 ____D () C:\FRST
2014-03-05 15:07 - 2014-03-05 15:47 - 00039381 _____ () C:\Users\Sandra\Downloads\FRST.txt
2014-03-05 15:05 - 2014-03-05 15:05 - 02157056 _____ (Farbar) C:\Users\Sandra\Desktop\FRST64.exe
2014-03-05 15:04 - 2014-03-05 15:45 - 00000474 _____ () C:\Users\Sandra\Downloads\defogger_disable.log
2014-03-05 15:04 - 2014-03-05 15:04 - 00000000 _____ () C:\Users\Sandra\defogger_reenable
2014-03-05 14:40 - 2014-03-05 14:40 - 00050477 _____ () C:\Users\Sandra\Downloads\Defogger.exe
2014-03-05 13:59 - 2014-03-05 14:00 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Sandra\Downloads\mbam-setup-1.75.0.1300.exe
2014-03-05 13:55 - 2014-03-05 13:55 - 04051872 _____ (Avira Operations GmbH & Co. KG) C:\Users\Sandra\Downloads\avira_de_av___ws.exe
2014-03-05 13:38 - 2014-03-05 13:38 - 10345466 _____ () C:\Users\Sandra\Downloads\sophos-win.exe
2014-02-28 18:10 - 2014-02-28 18:10 - 00000000 ____D () C:\Program Files (x86)\LogMeIn Hamachi
2014-02-26 09:16 - 2014-02-26 09:22 - 00000000 ____D () C:\Users\Sandra\Desktop\Musik für Fairphone
2014-02-21 12:34 - 2014-02-21 12:34 - 17858952 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-02-17 15:59 - 2013-12-21 10:53 - 00548864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-02-17 15:59 - 2013-12-21 09:56 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-02-17 15:58 - 2014-02-06 12:30 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-17 15:58 - 2014-02-06 11:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-02-17 15:58 - 2014-02-06 11:17 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-02-17 15:58 - 2014-02-06 10:25 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-02-17 15:57 - 2014-02-06 13:16 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-17 15:57 - 2014-02-06 12:30 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-02-17 15:57 - 2014-02-06 12:12 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-17 15:57 - 2014-02-06 12:07 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-02-17 15:57 - 2014-02-06 12:06 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-02-17 15:57 - 2014-02-06 11:57 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-17 15:57 - 2014-02-06 11:56 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-02-17 15:57 - 2014-02-06 11:52 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-17 15:57 - 2014-02-06 11:49 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-17 15:57 - 2014-02-06 11:48 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-02-17 15:57 - 2014-02-06 11:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-02-17 15:57 - 2014-02-06 11:38 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-02-17 15:57 - 2014-02-06 11:32 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-02-17 15:57 - 2014-02-06 11:11 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-17 15:57 - 2014-02-06 11:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-02-17 15:57 - 2014-02-06 11:00 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-02-17 15:57 - 2014-02-06 10:57 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-02-17 15:57 - 2014-02-06 10:57 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-17 15:57 - 2014-02-06 10:52 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-02-17 15:57 - 2014-02-06 10:52 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-02-17 15:57 - 2014-02-06 10:50 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-17 15:57 - 2014-02-06 10:49 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-02-17 15:57 - 2014-02-06 10:47 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-02-17 15:57 - 2014-02-06 10:46 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-02-17 15:57 - 2014-02-06 10:25 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-02-17 15:57 - 2014-02-06 10:24 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-17 15:57 - 2014-02-06 10:22 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-17 15:57 - 2014-02-06 10:13 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-02-17 15:57 - 2014-02-06 10:09 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-02-17 15:57 - 2014-02-06 10:03 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-02-17 15:57 - 2014-02-06 09:55 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-17 15:57 - 2014-02-06 09:41 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-02-17 15:57 - 2014-02-06 09:40 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-02-17 15:57 - 2014-02-06 09:36 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-02-17 15:57 - 2014-02-06 09:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-02-17 14:24 - 2014-02-17 14:24 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_WinUsb_01009.Wdf
2014-02-17 12:33 - 2014-02-17 12:33 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-02-17 10:25 - 2014-01-01 00:05 - 00420008 _____ () C:\Windows\SysWOW64\locale.nls
2014-02-17 10:25 - 2014-01-01 00:04 - 00420008 _____ () C:\Windows\system32\locale.nls
2014-02-17 10:25 - 2013-12-25 00:09 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-02-17 10:25 - 2013-12-24 23:48 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-02-17 10:25 - 2013-12-06 03:30 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-02-17 10:25 - 2013-12-06 03:30 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-02-17 10:25 - 2013-12-06 03:02 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-02-17 10:25 - 2013-12-06 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-02-17 10:25 - 2013-12-04 03:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll
2014-02-17 10:25 - 2013-12-04 03:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll
2014-02-17 10:25 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll
2014-02-17 10:25 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll
2014-02-17 10:25 - 2013-12-04 03:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll
2014-02-17 10:25 - 2013-12-04 03:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe
2014-02-17 10:25 - 2013-12-04 03:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe
2014-02-17 10:25 - 2013-12-04 03:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe
2014-02-17 10:25 - 2013-12-04 03:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe
2014-02-17 10:25 - 2013-12-04 03:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll
2014-02-17 10:25 - 2013-12-04 03:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll
2014-02-17 10:25 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll
2014-02-17 10:25 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll
2014-02-17 10:25 - 2013-12-04 03:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll
2014-02-17 10:25 - 2013-12-04 02:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe
2014-02-17 10:25 - 2013-12-04 02:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe
2014-02-17 10:25 - 2013-12-04 02:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe
2014-02-17 10:25 - 2013-12-04 02:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe
2014-02-17 10:25 - 2013-11-26 09:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2014-02-17 10:25 - 2013-11-22 23:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2014-02-13 17:05 - 2014-02-13 17:05 - 00000000 ____D () C:\Users\Sandra\AppData\Roaming\Malwarebytes
2014-02-13 17:03 - 2014-02-13 17:03 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-13 17:01 - 2014-02-13 17:01 - 00614792 _____ (Chip Digital GmbH) C:\Users\Sandra\Downloads\Malwarebytes Anti Malware - CHIP-Downloader.exe
2014-02-13 16:58 - 2014-02-13 16:58 - 00000000 ____D () C:\Users\Sandra\Desktop\Neuer Ordner
2014-02-13 16:53 - 2014-03-05 19:59 - 00033019 _____ () C:\Users\Sandra\Documents\Portfolio Bevc endgültige Fassung.odt
==================== One Month Modified Files and Folders =======
2014-03-10 16:01 - 2014-03-07 10:55 - 00016456 _____ () C:\Users\Sandra\Desktop\FRST.txt
2014-03-10 16:01 - 2014-03-05 15:07 - 00000000 ____D () C:\FRST
2014-03-10 16:01 - 2012-12-18 09:17 - 00000000 ____D () C:\Users\Sandra\AppData\Local\PMB Files
2014-03-10 15:56 - 2012-11-14 12:13 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-03-10 15:52 - 2009-07-14 05:45 - 00009920 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-03-10 15:52 - 2009-07-14 05:45 - 00009920 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-03-10 15:48 - 2011-05-06 03:13 - 02013042 _____ () C:\Windows\WindowsUpdate.log
2014-03-10 15:45 - 2013-12-16 19:31 - 00000000 ___RD () C:\Users\Sandra\Dropbox
2014-03-10 15:45 - 2013-12-16 19:29 - 00000000 ____D () C:\Users\Sandra\AppData\Roaming\Dropbox
2014-03-10 15:44 - 2012-12-09 20:28 - 00000000 ____D () C:\Users\Sandra\AppData\Local\LogMeIn Hamachi
2014-03-10 15:43 - 2012-11-14 12:13 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-03-10 15:43 - 2011-05-06 03:25 - 00000000 ____D () C:\Program Files\P4G
2014-03-10 15:43 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-03-10 15:43 - 2009-07-14 05:51 - 00250861 _____ () C:\Windows\setupact.log
2014-03-10 10:32 - 2013-03-24 14:05 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-03-10 09:14 - 2014-03-10 09:14 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-03-10 09:12 - 2014-03-10 09:12 - 00987442 _____ () C:\Users\Sandra\Desktop\SecurityCheck.exe
2014-03-10 09:12 - 2014-03-10 09:11 - 02347384 _____ (ESET) C:\Users\Sandra\Downloads\esetsmartinstaller_enu.exe
2014-03-10 09:12 - 2013-01-08 13:48 - 00003958 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{01969AC8-B8F0-48C9-A737-500E9D388A8F}
2014-03-07 10:53 - 2014-03-07 10:53 - 00001416 _____ () C:\Users\Sandra\Desktop\JRT.txt
2014-03-07 10:46 - 2014-03-07 10:46 - 00000000 ____D () C:\Windows\ERUNT
2014-03-07 10:43 - 2014-03-07 10:43 - 01037734 _____ (Thisisu) C:\Users\Sandra\Desktop\JRT.exe
2014-03-07 10:40 - 2014-03-07 10:40 - 00001864 _____ () C:\Users\Sandra\Desktop\AdwCleaner[S0].txt
2014-03-07 10:37 - 2014-03-07 10:35 - 00000000 ____D () C:\AdwCleaner
2014-03-07 10:32 - 2014-03-07 10:32 - 01244192 _____ () C:\Users\Sandra\Desktop\adwcleaner.exe
2014-03-05 21:27 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-03-05 19:59 - 2014-02-13 16:53 - 00033019 _____ () C:\Users\Sandra\Documents\Portfolio Bevc endgültige Fassung.odt
2014-03-05 19:03 - 2011-05-06 03:09 - 00721920 _____ () C:\Windows\PFRO.log
2014-03-05 19:02 - 2014-03-05 19:02 - 00024851 _____ () C:\Users\Sandra\Desktop\combofix.txt
2014-03-05 19:02 - 2014-03-05 19:02 - 00024851 _____ () C:\ComboFix.txt
2014-03-05 19:02 - 2014-03-05 17:35 - 00000000 ____D () C:\Qoobox
2014-03-05 18:59 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2014-03-05 18:42 - 2014-01-13 19:58 - 00047104 ___SH () C:\Users\Sandra\Thumbs.db
2014-03-05 18:00 - 2014-03-05 17:35 - 00000000 ____D () C:\Windows\erdnt
2014-03-05 17:26 - 2014-03-05 17:26 - 05186850 ____R (Swearware) C:\Users\Sandra\Desktop\ComboFix.exe
2014-03-05 16:13 - 2014-03-05 16:13 - 00008264 _____ () C:\Users\Sandra\Downloads\gmer.txt
2014-03-05 16:08 - 2014-03-05 16:08 - 00025478 _____ () C:\Users\Sandra\Desktop\AVSCAN-20140305-141112-36802DE4.LOG
2014-03-05 15:47 - 2014-03-05 15:07 - 00039381 _____ () C:\Users\Sandra\Downloads\FRST.txt
2014-03-05 15:45 - 2014-03-05 15:04 - 00000474 _____ () C:\Users\Sandra\Downloads\defogger_disable.log
2014-03-05 15:11 - 2014-03-05 15:11 - 00380416 _____ () C:\Users\Sandra\Downloads\Gmer-19357.exe
2014-03-05 15:10 - 2014-03-05 15:08 - 00032493 _____ () C:\Users\Sandra\Downloads\Addition.txt
2014-03-05 15:05 - 2014-03-05 15:05 - 02157056 _____ (Farbar) C:\Users\Sandra\Desktop\FRST64.exe
2014-03-05 15:04 - 2014-03-05 15:04 - 00000000 _____ () C:\Users\Sandra\defogger_reenable
2014-03-05 15:04 - 2011-07-21 14:45 - 00000000 ____D () C:\Users\Sandra
2014-03-05 14:40 - 2014-03-05 14:40 - 00050477 _____ () C:\Users\Sandra\Downloads\Defogger.exe
2014-03-05 14:00 - 2014-03-05 13:59 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Sandra\Downloads\mbam-setup-1.75.0.1300.exe
2014-03-05 13:55 - 2014-03-05 13:55 - 04051872 _____ (Avira Operations GmbH & Co. KG) C:\Users\Sandra\Downloads\avira_de_av___ws.exe
2014-03-05 13:38 - 2014-03-05 13:38 - 10345466 _____ () C:\Users\Sandra\Downloads\sophos-win.exe
2014-03-04 22:46 - 2009-08-04 11:34 - 00610996 _____ () C:\Windows\system32\perfh008.dat
2014-03-04 22:46 - 2009-08-04 11:34 - 00115282 _____ () C:\Windows\system32\perfc008.dat
2014-03-04 22:46 - 2009-08-04 10:51 - 00711546 _____ () C:\Windows\system32\perfh007.dat
2014-03-04 22:46 - 2009-08-04 10:51 - 00153736 _____ () C:\Windows\system32\perfc007.dat
2014-03-04 22:46 - 2009-07-14 06:13 - 02376808 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-28 18:10 - 2014-02-28 18:10 - 00000000 ____D () C:\Program Files (x86)\LogMeIn Hamachi
2014-02-28 18:10 - 2014-01-27 14:41 - 00000928 _____ () C:\Users\Public\Desktop\LogMeIn Hamachi.lnk
2014-02-26 13:05 - 2011-08-03 22:50 - 02328674 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-02-26 09:22 - 2014-02-26 09:16 - 00000000 ____D () C:\Users\Sandra\Desktop\Musik für Fairphone
2014-02-25 16:05 - 2011-09-01 10:37 - 00002699 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-02-25 16:05 - 2011-09-01 10:37 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-02-25 16:05 - 2011-09-01 10:37 - 00000000 ____D () C:\ProgramData\Skype
2014-02-21 12:34 - 2014-02-21 12:34 - 17858952 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-02-21 12:34 - 2013-03-24 14:05 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-02-21 12:34 - 2012-11-18 13:10 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-02-21 12:34 - 2011-09-24 13:19 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-02-18 11:46 - 2013-08-06 17:00 - 00000000 ____D () C:\Windows\system32\MRT
2014-02-17 16:08 - 2011-07-21 21:11 - 88567024 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-02-17 14:24 - 2014-02-17 14:24 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_WinUsb_01009.Wdf
2014-02-17 12:33 - 2014-02-17 12:33 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-02-17 12:33 - 2012-04-25 12:04 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-02-13 17:24 - 2013-08-11 10:39 - 00000000 ____D () C:\Users\Sandra\AppData\Roaming\DVDVideoSoft
2014-02-13 17:05 - 2014-02-13 17:05 - 00000000 ____D () C:\Users\Sandra\AppData\Roaming\Malwarebytes
2014-02-13 17:03 - 2014-02-13 17:03 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-13 17:01 - 2014-02-13 17:01 - 00614792 _____ (Chip Digital GmbH) C:\Users\Sandra\Downloads\Malwarebytes Anti Malware - CHIP-Downloader.exe
2014-02-13 16:58 - 2014-02-13 16:58 - 00000000 ____D () C:\Users\Sandra\Desktop\Neuer Ordner
2014-02-13 16:52 - 2014-01-27 15:09 - 00031030 _____ () C:\Users\Sandra\Documents\Portfolio Bevc.odt
2014-02-13 13:51 - 2012-11-14 12:13 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-02-13 13:51 - 2012-11-14 12:13 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-02-12 11:04 - 2014-01-07 14:07 - 00023671 _____ () C:\Users\Sandra\Documents\Buchführung 2014.xlsx
2014-02-08 10:53 - 2014-02-07 14:53 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
Some content of TEMP:
====================
C:\Users\Sandra\AppData\Local\Temp\avgnt.exe
C:\Users\Sandra\AppData\Local\Temp\Quarantine.exe
C:\Users\Sandra\AppData\Local\Temp\rtdrvmon.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-03-05 20:53
==================== End Of Log ============================
--- --- --- Liebe Grüße, Sandra |
|
11.03.2014, 12:22
| #8 |
| /// the machine /// TB-Ausbilder | Windows 7: Virenbefall durch AntiVir entdeckt TR/Dropper.MSIL.43179 Den Ordner den ESET anmeckert löschen. Fertig Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
11.03.2014, 14:45
| #9 |
| | Windows 7: Virenbefall durch AntiVir entdeckt TR/Dropper.MSIL.43179 Das heißt, wenn ich jetzt deine Schritte 1. - 4. befolgt habe, ist der Ordner den ESET angemeckert hat gelöscht und mein USB Stick und mein Laptop sind Viren-frei? Tausend Dank! Wahnsinn was Ihr per Ferndiagnose leistet!  Einige deiner Tipps kannte ich schon, die anderen werd ich jetzt der Reihe nach abarbeiten, danke Eine Frage hab ich noch: Das Antiviren-Programm Sophos hat den Virus den ich hatte ja sofort erkannt, mein Antivir nicht. Würdest du mir empfehlen zu Sophos zu wechseln? Oder welches Viren-Programm benutzen den Leute wie du, die sich mit der Sache auskennen? Liebe Grüße, Sandra PS: Sorry, das mit dem Ordner den ich löschen sollte hab ich eben erst gecheckt, hab ihn jetzt aber gelöscht. Ist jetzt die Reihenfolge die ich beachten sollte am Arsch, oder bezog sich das nur auf defogger, combofix und delfix? |
|
12.03.2014, 12:00
| #10 |
| /// the machine /// TB-Ausbilder | Windows 7: Virenbefall durch AntiVir entdeckt TR/Dropper.MSIL.43179 Das bezog sich nur darauf Avira is Müll. Ich empfehle immer Emsisoft.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Windows 7: Virenbefall durch AntiVir entdeckt TR/Dropper.MSIL.43179 |
| 4d36e972-e325-11ce-bfc1-08002be10318, antivir, avira, branding, browser, desktop, dllhost.exe, dvdvideosoft ltd., email, excel, failed, flash player, google, homepage, lnk/agent.ak, mozilla, pup.optional.bandoo, pup.optional.opencandy, registry, security, svchost.exe, system, taskhost.exe, tr/dropper.msil.43179, tr/dropper.msil.gen, tr/dropper.msil.gen!, usb stick, vista, windows |
WARNUNG an die MITLESER: 
Linear-Darstellung
