|
Plagegeister aller Art und deren Bekämpfung: Computer, windows 7, wurde langsammer, malwarebytes findet SchädlingeWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
23.03.2014, 18:22 | #1 |
| Computer, windows 7, wurde langsammer, malwarebytes findet Schädlinge Hallo an Alle. Ich hoffe, hier kann mir jemand weiter helfen. Mein Rechner bzw. der von meinem Vater (satellite C670, Toshiba) ist in letzter Zeit immer langsammer geworden. Bei mir läuft avast und das hatte nie etwas gefunden. Heute habe ich Malwarebytes durchlaufen lasse und der hat leider etwas gefunden und SUPERAntiSpyware auch. Kann mir bitte jemand sagen, was ich tun soll? Danke im voraus Biene Ich hoffe, das mit dem logfile klappt Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2014.03.23.08 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 11.0.9600.16521 Gert :: GERT-TOSH [Administrator] Schutz: Aktiviert 23.03.2014 17:40:53 MBAM-log-2014-03-23 (18-07-19).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 224028 Laufzeit: 14 Minute(n), 57 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 1 HKCR\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17} (PUP.Optional.Wajam.A) -> Keine Aktion durchgeführt. Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 17 C:\Program Files (x86)\SearchProtect (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\Main (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\Main\Logs (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\Main\rep (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\SearchProtect (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\SearchProtect\Logs (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\SearchProtect\rep (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\bubble (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\Images (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\libs (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\protection (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\protectionDS (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\settings (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\uninstall (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\rep (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. Infizierte Dateien: 62 C:\Program Files (x86)\SearchProtect\EULA.txt (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\Main\rep\SystemRepository.dat (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\settings.html (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\style.css (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\bubble\bubble.css (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\bubble\bubble.html (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\bubble\bubble.js (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\bubble\defaults.js (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\Apply-default.png (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\Apply-onclick.png (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\Apply-Rollover.png (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bg-with-logo.png (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bg.png (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bgNotif.png (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bgSettings.png (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bgUninstall.png (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\btnBlue.png (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\btnClose.png (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\btnSilver.png (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\checkbox.png (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\checkbox_checked.png (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\checkbox_def.png (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\close-win-def.png (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\close-win-over-click.png (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\gray-bg.png (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\hez-def.png (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\hez-selected.png (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\hez.png (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\icon-win.png (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\info-icon.png (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\menu-rollover.png (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\menu-selected.png (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\radio-button-def.png (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\radio-button-selected.png (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\radio-button.png (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\radio-button2.png (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\Settings-icon.png (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\text-field.png (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\v.png (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\x.png (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\defaults.js (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\dialogUtils.js (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\jquery.1.7.1.min.js (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\json2.min.js (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\main.js (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\SPDialogAPI.js (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\protection\defaults.js (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\protection\protection.css (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\protection\protection.html (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\protection\protection.js (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\protectionDS\defaults.js (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\protectionDS\protectionDS.css (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\protectionDS\protectionDS.html (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\protectionDS\protectionDS.js (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\settings\defaults.js (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\settings\settings.css (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\settings\settings.html (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\settings\settings.js (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\uninstall\defaults.js (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\uninstall\uninstall.css (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\uninstall\uninstall.html (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. C:\Program Files (x86)\SearchProtect\UI\dialogs\uninstall\uninstall.js (PUP.Optional.SearchProtect.A) -> Keine Aktion durchgeführt. Code:
ATTFilter SUPERAntiSpyware Scan Log hxxp://www.superantispyware.com Generated 03/23/2014 at 06:17 PM Application Version : 5.7.1018 Core Rules Database Version : 11117 Trace Rules Database Version: 8929 Scan type : Quick Scan Total Scan Time : 00:33:42 Operating System Information Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601) UAC Off - Administrator Memory items scanned : 751 Memory threats detected : 0 Registry items scanned : 59456 Registry threats detected : 0 File items scanned : 12257 File threats detected : 59 Adware.Tracking Cookie C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\AFD4PX8N.txt [ /www.usenext.de ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\KHXLWOBH.txt [ /www4.smartadserver.com ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\W65RTYEW.txt [ /ads.p161.net ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\RN8X92PG.txt [ /microsoftsto.112.2o7.net ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\XGLYIPR9.txt [ /adx.chip.de ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\N7YVF893.txt [ /ru4.com ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\4SW4UMB2.txt [ /apmebf.com ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\T2F2EDWI.txt [ /ad1.adfarm1.adition.com ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\1AFTQLOY.txt [ /adfarm1.adition.com ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\0VL2ZFXG.txt [ /ads.creative-serving.com ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\IOVQWLD8.txt [ /eas.apm.emediate.eu ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\WBOB75OW.txt [ /ad2.adfarm1.adition.com ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\LULY2TR6.txt [ /doubleclick.net ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\B74R0ZLB.txt [ /casalemedia.com ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\PKMX3OML.txt [ /legolas-media.com ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\VOHN35F2.txt [ /smartadserver.com ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\P33DSYN7.txt [ /server.adformdsp.net ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\LN7450GO.txt [ /server.adform.net ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\SP5TEX8Y.txt [ /lucidmedia.com ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\ZJ93LTR8.txt [ /uk.at.atwola.com ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\NR0DKPMF.txt [ /zanox.com ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\ARCAEMZ0.txt [ /zanox-affiliate.de ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\JKMCGJ14.txt [ /track.adform.net ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\ZCZNQJ8G.txt [ /statse.webtrendslive.com ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\9OH1G4B1.txt [ /fastclick.net ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\6M2UD37P.txt [ /adform.net ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\YOJMKQB0.txt [ /unitymedia.de ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\4C7MJHPF.txt [ /adtechus.com ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\2JAB6IPL.txt [ /marc-o-polo.media01.eu ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\X0IZOHV1.txt [ /c1.adform.net ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\MO7NOJ6T.txt [ /ww251.smartadserver.com ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\5MB35YVF.txt [ /ad.zanox.com ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\BD5QQJ12.txt [ /advertising.com ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\16EILDW8.txt [ /ad4.adfarm1.adition.com ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\8HC70P19.txt [ /tomtailor.dyntracker.com ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\JQ7KC8F9.txt [ /revsci.net ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\WCPXR3C7.txt [ /webmasterplan.com ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\QT4IONKT.txt [ /c1.atdmt.com ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\EXO4JLO3.txt [ /ads.pubmatic.com ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\R5H728NK.txt [ /ads.yahoo.com ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\SZ15ELX8.txt [ /track.zalando.de ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\2AAKDJ00.txt [ /serving-sys.com ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\93T6BYZ8.txt [ /ad.dyntracker.de ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\1R4TE2LO.txt [ /amazon-adsystem.com ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\1HZ6DKWX.txt [ /ad.ad-srv.net ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\3QVTJG7I.txt [ /track.effiliation.com ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\TL61TSMN.txt [ /www.googleadservices.com ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\XRN3X492.txt [ /www.googleadservices.com ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\4R1QDW6A.txt [ /www.googleadservices.com ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\DHK1O6MY.txt [ /www.googleadservices.com ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\C0KQLHOO.txt [ /www.googleadservices.com ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\YW3MJ1VD.txt [ /adtech.de ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\TOOLS6MT.txt [ /atdmt.com ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\G69B95TY.txt [ /vinsight.de ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\F2HWRNRE.txt [ /tradedoubler.com ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\SLRFBRT9.txt [ /ad.360yield.com ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\T9YQ1R3D.txt [ /ad-emea.doubleclick.net ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\P62E1UKY.txt [ /media6degrees.com ] C:\Users\Gert\AppData\Roaming\Microsoft\Windows\Cookies\6EW2KBR8.txt [ /adformdsp.net ] |
23.03.2014, 18:41 | #2 |
/// the machine /// TB-Ausbilder | Computer, windows 7, wurde langsammer, malwarebytes findet Schädlinge hi,
__________________Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit (Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ |
23.03.2014, 22:17 | #3 |
| Computer, windows 7, wurde langsammer, malwarebytes findet Schädlinge Hallo und danke für die schnelle Antwort. Ich fühle mich gerade etwas hilflos.
__________________Hier die frst.txt FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014 Ran by Gert (administrator) on GERT-TOSH on 23-03-2014 18:43:41 Running from C:\Users\Gert\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9RXJM10C Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (AMD) C:\Windows\system32\atiesrxx.exe (AMD) C:\Windows\system32\atieclxx.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe () C:\Windows\System32\GFNEXSrv.exe (AOL LLC) C:\Program Files (x86)\Common Files\AOL\ACS\AOLAcsd.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe (Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe () C:\Users\Gert\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Protexis Inc.) c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe (TOSHIBA Corporation) C:\Windows\system32\TODDSrv.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe (TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe (TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe (TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe (TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe (Nero AG) c:\Program Files (x86)\Nero\Update\NASvc.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\IEXPLORE.EXE (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe (SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE (SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (AOL, LLC.) C:\Program Files (x86)\AOL 9.0 VR\waol.exe (America Online, Inc.) C:\Program Files (x86)\Common Files\AOL\1339252113\ee\aolsoftware.exe (AOL, LLC.) C:\Program Files (x86)\AOL 9.0 VR\shellmon.exe (AOL LLC) C:\Program Files (x86)\Common Files\AOL\Topspeed\3.0\aoltpsd3.exe (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe (Microsoft Corporation) C:\Windows\splwow64.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [TosReelTimeMonitor] - C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe [38304 2010-12-14] (TOSHIBA Corporation) HKLM\...\Run: [Toshiba TEMPRO] - C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe [1546720 2011-02-10] (Toshiba Europe GmbH) HKLM\...\Run: [TPwrMain] - C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [566696 2011-03-02] (TOSHIBA Corporation) HKLM\...\Run: [TCrdMain] - C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [973176 2010-12-15] (TOSHIBA Corporation) HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2186856 2011-01-10] (Realtek Semiconductor) HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2679592 2011-02-03] (Synaptics Incorporated) HKLM\...\Run: [TosSENotify] - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [710040 2010-12-08] (TOSHIBA Corporation) HKLM\...\Run: [TosVolRegulator] - C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation) HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-06] (Apple Inc.) HKLM-x32\...\Run: [] - [X] HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3767096 2014-02-03] (AVAST Software) HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware ] - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation) HKU\.DEFAULT\...\Run: [TOPI.EXE] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe [846936 2011-05-16] (TOSHIBA) HKU\S-1-5-19\...\Run: [TOPI.EXE] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe [846936 2011-05-16] (TOSHIBA) HKU\S-1-5-20\...\Run: [TOPI.EXE] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe [846936 2011-05-16] (TOSHIBA) HKU\S-1-5-21-3987679619-3970140003-3041632213-1001\...\Run: [SUPERAntiSpyware] - C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [6563608 2014-01-06] (SUPERAntiSpyware) Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe) Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=TEUA&bmod=TEUA HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TEUA&bmod=TEUA URLSearchHook: HKCU - (No Name) - {1CFFA392-0898-4b1c-89D1-6E98F9D8EF78} - No File SearchScopes: HKLM - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) BHO-x32: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files (x86)\AOL\AOL Toolbar 4.0\aoltb.dll (AOL LLC) BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) BHO-x32: PAYBACK Toolbar Browserhilfsobjekt - {E141F5C3-2619-4996-8AF8-AA0A9439D986} - C:\Program Files (x86)\Payback\PAYBACK Toolbar\PaybackToolbar.dll (PAYBACK GmbH) Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) Toolbar: HKLM - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) Toolbar: HKLM-x32 - AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files (x86)\AOL\AOL Toolbar 4.0\aoltb.dll (AOL LLC) Toolbar: HKLM-x32 - PAYBACK Toolbar - {9613CB43-EA4C-48b5-878D-13DFE1818EFE} - C:\Program Files (x86)\Payback\PAYBACK Toolbar\PaybackToolbar.dll (PAYBACK GmbH) Toolbar: HKLM-x32 - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) Toolbar: HKCU - No Name - {9613CB43-EA4C-48B5-878D-13DFE1818EFE} - No File DPF: HKLM-x32 {1B00725B-C455-4DE6-BFB6-AD540AD427CD} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab DPF: HKLM-x32 {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} hxxp://quickscan.bitdefender.com/qsax/qsax.cab Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 Chrome: ======= CHR Extension: (Google Docs) - C:\Users\Gert\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-01-16] CHR Extension: (Google Drive) - C:\Users\Gert\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-01-16] CHR Extension: (YouTube) - C:\Users\Gert\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-01-16] CHR Extension: (Google-Suche) - C:\Users\Gert\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-01-16] CHR Extension: (Google Wallet) - C:\Users\Gert\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-01-16] CHR Extension: (Google Mail) - C:\Users\Gert\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-01-16] CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2013-12-26] ==================== Services (Whitelisted) ================= R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [144152 2013-10-10] (SUPERAntiSpyware.com) R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-02-03] (AVAST Software) S3 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [227904 2013-12-17] (WildTangent) R2 GFNEXSrv; C:\Windows\System32\GFNEXSrv.exe [162824 2010-09-09] () R2 KSS; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe [202328 2012-12-07] (Kaspersky Lab ZAO) R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation) S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [112080 2011-02-10] (Toshiba Europe GmbH) ==================== Drivers (Whitelisted) ==================== R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [78648 2014-02-03] (AVAST Software) R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [92544 2013-12-26] (AVAST Software) R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2013-12-26] () R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1038072 2014-02-03] (AVAST Software) R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [421704 2014-02-03] (AVAST Software) R3 aswStm; C:\Windows\system32\drivers\aswStm.sys [80184 2014-02-03] (AVAST Software) R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-12-19] (AVAST Software) R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [207904 2013-12-26] () R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) S3 PSKMAD; C:\Windows\System32\DRIVERS\PSKMAD.sys [47632 2013-04-29] (Panda Security, S.L.) R3 RTWlanE; C:\Windows\System32\DRIVERS\rtwlane.sys [1514568 2013-05-02] (Realtek Semiconductor Corporation ) R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com) R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com) R2 sp_rsdrv2; C:\Windows\System32\DRIVERS\stflt.sys [51496 2013-12-03] (Windows (R) Win 7 DDK provider) S3 TDEIO; \??\c:\Windows\SysWOW64\sysprep\Bootprio\tdeio64.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-03-23 18:43 - 2014-03-23 18:43 - 00000000 ____D () C:\FRST 2014-03-23 17:42 - 2014-03-23 17:42 - 00003586 _____ () C:\Windows\System32\Tasks\SUPERAntiSpyware Scheduled Task f21915d5-4c30-4158-a73b-ef0215cc7218 2014-03-23 17:42 - 2014-03-23 17:42 - 00003512 _____ () C:\Windows\System32\Tasks\SUPERAntiSpyware Scheduled Task ba20b5f7-3acf-438c-823c-47eb6eddc798 2014-03-23 17:42 - 2014-03-23 17:42 - 00000508 _____ () C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task f21915d5-4c30-4158-a73b-ef0215cc7218.job 2014-03-23 17:42 - 2014-03-23 17:42 - 00000508 _____ () C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task ba20b5f7-3acf-438c-823c-47eb6eddc798.job 2014-03-23 17:42 - 2014-03-23 17:42 - 00000000 ____D () C:\Users\Gert\AppData\Roaming\SUPERAntiSpyware.com 2014-03-23 17:41 - 2014-03-23 17:42 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware 2014-03-23 17:41 - 2014-03-23 17:41 - 00001815 _____ () C:\Users\Public\Desktop\SUPERAntiSpyware Professional.lnk 2014-03-23 17:41 - 2014-03-23 17:41 - 00000000 ____D () C:\ProgramData\SUPERAntiSpyware.com 2014-03-23 17:37 - 2014-03-23 17:37 - 00001120 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-03-23 17:37 - 2014-03-23 17:37 - 00000000 ____D () C:\Users\Gert\AppData\Roaming\Malwarebytes 2014-03-23 17:37 - 2014-03-23 17:37 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-03-23 17:37 - 2014-03-23 17:37 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware 2014-03-23 17:37 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-03-22 14:19 - 2014-03-22 14:19 - 00000000 ____D () C:\Windows\pss 2014-03-18 16:58 - 2014-03-18 17:29 - 00301498 _____ () C:\Users\Gert\Desktop\Chemie 2.odp 2014-03-18 16:10 - 2014-03-20 19:47 - 00018348 _____ () C:\Users\Gert\Desktop\chemie-essigsäure.odt 2014-03-17 19:42 - 2014-03-18 22:01 - 00012668 _____ () C:\Users\Gert\Desktop\Französisch Vokabelliste.odt 2014-03-13 16:36 - 2014-03-01 07:05 - 23133696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-03-13 16:36 - 2014-03-01 06:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-03-13 16:36 - 2014-03-01 06:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-03-13 16:36 - 2014-03-01 05:58 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-03-13 16:36 - 2014-03-01 05:52 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-03-13 16:36 - 2014-03-01 05:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-03-13 16:36 - 2014-03-01 05:42 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-03-13 16:36 - 2014-03-01 05:40 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-03-13 16:36 - 2014-03-01 05:37 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-03-13 16:36 - 2014-03-01 05:33 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-03-13 16:36 - 2014-03-01 05:33 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-03-13 16:36 - 2014-03-01 05:32 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-03-13 16:36 - 2014-03-01 05:30 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-03-13 16:36 - 2014-03-01 05:23 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-03-13 16:36 - 2014-03-01 05:17 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-03-13 16:36 - 2014-03-01 05:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-03-13 16:36 - 2014-03-01 05:02 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-03-13 16:36 - 2014-03-01 04:54 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-03-13 16:36 - 2014-03-01 04:52 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-03-13 16:36 - 2014-03-01 04:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-03-13 16:36 - 2014-03-01 04:47 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-03-13 16:36 - 2014-03-01 04:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-03-13 16:36 - 2014-03-01 04:43 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-03-13 16:36 - 2014-03-01 04:42 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-03-13 16:36 - 2014-03-01 04:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-03-13 16:36 - 2014-03-01 04:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-03-13 16:36 - 2014-03-01 04:37 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-03-13 16:36 - 2014-03-01 04:35 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-03-13 16:36 - 2014-03-01 04:18 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-03-13 16:36 - 2014-03-01 04:16 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-03-13 16:36 - 2014-03-01 04:14 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-03-13 16:36 - 2014-03-01 04:10 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-03-13 16:36 - 2014-03-01 04:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-03-13 16:36 - 2014-03-01 04:00 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-03-13 16:36 - 2014-03-01 03:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-03-13 16:36 - 2014-03-01 03:38 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-03-13 16:36 - 2014-03-01 03:32 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-03-13 16:36 - 2014-03-01 03:27 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-03-13 16:36 - 2014-03-01 03:25 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-03-13 16:36 - 2014-03-01 03:25 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-03-13 16:36 - 2014-02-07 02:23 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-03-13 16:36 - 2014-01-29 03:32 - 00484864 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll 2014-03-13 16:36 - 2014-01-29 03:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll 2014-03-13 16:36 - 2014-01-28 03:32 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll 2014-03-13 16:33 - 2014-02-04 03:32 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2014-03-13 16:33 - 2014-02-04 03:32 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll 2014-03-13 16:33 - 2014-02-04 03:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll 2014-03-13 16:33 - 2014-02-04 03:04 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll 2014-03-11 21:38 - 2014-03-11 21:43 - 00000000 ____D () C:\Users\Gert\Desktop\ingap 2014-03-11 21:37 - 2014-03-11 21:41 - 00000000 ____D () C:\Users\Gert\Desktop\ole 2014-02-26 23:56 - 2011-06-21 05:09 - 00200976 _____ (Trend Micro Inc.) C:\Windows\SysWOW64\Drivers\tmcomm.sys 2014-02-26 23:52 - 2014-02-26 23:52 - 00000036 _____ () C:\Users\Gert\AppData\Local\housecall.guid.cache 2014-02-26 22:39 - 2014-02-26 22:39 - 00005934 _____ () C:\Users\Gert\Desktop\startup.txt 2014-02-23 21:19 - 2014-02-23 21:48 - 00000000 ____D () C:\Users\Gert\Desktop\Bastille 2014-02-21 23:57 - 2014-02-21 23:57 - 00024724 _____ () C:\Users\Gert\Desktop\Inga Text Anfrage Canada.odt 2014-02-21 22:31 - 2014-02-21 22:31 - 00025753 _____ () C:\Users\Gert\Desktop\klima.odt ==================== One Month Modified Files and Folders ======= 2014-03-23 18:43 - 2014-03-23 18:43 - 00000000 ____D () C:\FRST 2014-03-23 18:41 - 2009-07-14 05:45 - 00025120 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-03-23 18:41 - 2009-07-14 05:45 - 00025120 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-03-23 17:54 - 2009-07-14 03:34 - 00000555 _____ () C:\Windows\win.ini 2014-03-23 17:48 - 2014-02-18 22:27 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-03-23 17:48 - 2014-02-18 22:27 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-03-23 17:42 - 2014-03-23 17:42 - 00003586 _____ () C:\Windows\System32\Tasks\SUPERAntiSpyware Scheduled Task f21915d5-4c30-4158-a73b-ef0215cc7218 2014-03-23 17:42 - 2014-03-23 17:42 - 00003512 _____ () C:\Windows\System32\Tasks\SUPERAntiSpyware Scheduled Task ba20b5f7-3acf-438c-823c-47eb6eddc798 2014-03-23 17:42 - 2014-03-23 17:42 - 00000508 _____ () C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task f21915d5-4c30-4158-a73b-ef0215cc7218.job 2014-03-23 17:42 - 2014-03-23 17:42 - 00000508 _____ () C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task ba20b5f7-3acf-438c-823c-47eb6eddc798.job 2014-03-23 17:42 - 2014-03-23 17:42 - 00000000 ____D () C:\Users\Gert\AppData\Roaming\SUPERAntiSpyware.com 2014-03-23 17:42 - 2014-03-23 17:41 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware 2014-03-23 17:41 - 2014-03-23 17:41 - 00001815 _____ () C:\Users\Public\Desktop\SUPERAntiSpyware Professional.lnk 2014-03-23 17:41 - 2014-03-23 17:41 - 00000000 ____D () C:\ProgramData\SUPERAntiSpyware.com 2014-03-23 17:37 - 2014-03-23 17:37 - 00001120 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-03-23 17:37 - 2014-03-23 17:37 - 00000000 ____D () C:\Users\Gert\AppData\Roaming\Malwarebytes 2014-03-23 17:37 - 2014-03-23 17:37 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-03-23 17:37 - 2014-03-23 17:37 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware 2014-03-23 16:30 - 2011-02-11 09:21 - 00699682 _____ () C:\Windows\system32\perfh007.dat 2014-03-23 16:30 - 2011-02-11 09:21 - 00149790 _____ () C:\Windows\system32\perfc007.dat 2014-03-23 16:30 - 2009-07-14 06:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-03-23 16:26 - 2013-03-04 23:26 - 00041558 _____ () C:\Windows\setupact.log 2014-03-23 16:12 - 2014-01-15 17:05 - 00003930 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{B1B18CB8-D77A-448C-A166-A9D9BB773F17} 2014-03-23 16:11 - 2012-12-18 19:46 - 00000000 ____D () C:\Users\Gert\Desktop\ebay 2014-03-23 16:07 - 2011-12-29 22:07 - 01645623 _____ () C:\Windows\WindowsUpdate.log 2014-03-23 16:05 - 2012-08-03 13:06 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update 2014-03-23 16:03 - 2014-02-14 19:58 - 00000514 _____ () C:\Windows\Tasks\SpeedyPC Update Version3 Startup Task.job 2014-03-23 16:03 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-03-22 14:19 - 2014-03-22 14:19 - 00000000 ____D () C:\Windows\pss 2014-03-20 19:47 - 2014-03-18 16:10 - 00018348 _____ () C:\Users\Gert\Desktop\chemie-essigsäure.odt 2014-03-20 16:57 - 2013-07-14 11:44 - 00000000 ____D () C:\Windows\system32\MRT 2014-03-20 16:53 - 2012-06-09 15:46 - 90015360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-03-18 22:01 - 2014-03-17 19:42 - 00012668 _____ () C:\Users\Gert\Desktop\Französisch Vokabelliste.odt 2014-03-18 19:54 - 2014-02-17 19:54 - 00000000 ____D () C:\Users\Gert\AppData\Roaming\FileAdvisor 2014-03-18 19:54 - 2014-02-14 19:54 - 00000000 ____D () C:\Program Files (x86)\File Type Advisor 2014-03-18 17:29 - 2014-03-18 16:58 - 00301498 _____ () C:\Users\Gert\Desktop\Chemie 2.odp 2014-03-17 21:21 - 2013-10-14 18:19 - 00000000 ____D () C:\Users\Gert\Documents\BStappen20October2013 2014-03-17 18:25 - 2013-03-04 23:26 - 00303496 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-03-17 18:23 - 2013-03-13 23:00 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2014-03-17 18:23 - 2013-03-13 23:00 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight 2014-03-12 15:28 - 2012-10-21 18:17 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-03-12 00:22 - 2012-09-25 21:01 - 00000998 _____ () C:\Users\Public\Desktop\CCleaner.lnk 2014-03-12 00:22 - 2012-04-03 23:00 - 00002231 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk 2014-03-11 21:43 - 2014-03-11 21:38 - 00000000 ____D () C:\Users\Gert\Desktop\ingap 2014-03-11 21:41 - 2014-03-11 21:37 - 00000000 ____D () C:\Users\Gert\Desktop\ole 2014-03-11 18:53 - 2012-06-09 19:30 - 00000000 ____D () C:\Program Files\CCleaner 2014-03-11 18:39 - 2012-10-21 18:17 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-03-11 18:39 - 2012-10-21 18:17 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-03-11 18:39 - 2012-10-21 18:17 - 00003824 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-03-10 17:41 - 2009-07-14 06:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-03-09 01:54 - 2014-02-16 19:17 - 00000569 _____ () C:\Windows\Tasks\SpeedyPC Pro_sch_A817E6FE-9736-11E3-A2BC-00038A000015.job 2014-03-07 16:29 - 2013-05-24 18:47 - 00000000 ___RD () C:\Program Files (x86)\Skype 2014-03-07 16:28 - 2011-08-08 10:06 - 00000000 ____D () C:\ProgramData\Skype 2014-03-03 20:21 - 2013-05-17 04:44 - 00336264 _____ () C:\Windows\PFRO.log 2014-03-01 07:05 - 2014-03-13 16:36 - 23133696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-03-01 06:17 - 2014-03-13 16:36 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-03-01 06:16 - 2014-03-13 16:36 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-03-01 05:58 - 2014-03-13 16:36 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-03-01 05:52 - 2014-03-13 16:36 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-03-01 05:51 - 2014-03-13 16:36 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-03-01 05:42 - 2014-03-13 16:36 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-03-01 05:40 - 2014-03-13 16:36 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-03-01 05:37 - 2014-03-13 16:36 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-03-01 05:33 - 2014-03-13 16:36 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-03-01 05:33 - 2014-03-13 16:36 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-03-01 05:32 - 2014-03-13 16:36 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-03-01 05:30 - 2014-03-13 16:36 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-03-01 05:23 - 2014-03-13 16:36 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-03-01 05:17 - 2014-03-13 16:36 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-03-01 05:11 - 2014-03-13 16:36 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-03-01 05:02 - 2014-03-13 16:36 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-03-01 04:54 - 2014-03-13 16:36 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-03-01 04:52 - 2014-03-13 16:36 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-03-01 04:51 - 2014-03-13 16:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-03-01 04:47 - 2014-03-13 16:36 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-03-01 04:43 - 2014-03-13 16:36 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-03-01 04:43 - 2014-03-13 16:36 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-03-01 04:42 - 2014-03-13 16:36 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-03-01 04:40 - 2014-03-13 16:36 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-03-01 04:38 - 2014-03-13 16:36 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-03-01 04:37 - 2014-03-13 16:36 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-03-01 04:35 - 2014-03-13 16:36 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-03-01 04:18 - 2014-03-13 16:36 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-03-01 04:16 - 2014-03-13 16:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-03-01 04:14 - 2014-03-13 16:36 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-03-01 04:10 - 2014-03-13 16:36 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-03-01 04:03 - 2014-03-13 16:36 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-03-01 04:00 - 2014-03-13 16:36 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-03-01 03:57 - 2014-03-13 16:36 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-03-01 03:38 - 2014-03-13 16:36 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-03-01 03:32 - 2014-03-13 16:36 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-03-01 03:27 - 2014-03-13 16:36 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-03-01 03:25 - 2014-03-13 16:36 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-03-01 03:25 - 2014-03-13 16:36 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-02-26 23:56 - 2012-08-10 12:13 - 00000000 ____D () C:\Users\Gert\AppData\Roaming\QuickScan 2014-02-26 23:52 - 2014-02-26 23:52 - 00000036 _____ () C:\Users\Gert\AppData\Local\housecall.guid.cache 2014-02-26 23:02 - 2012-09-23 22:29 - 00002026 _____ () C:\Users\Public\Desktop\Adobe Reader X.lnk 2014-02-26 22:59 - 2014-01-11 19:01 - 00001293 _____ () C:\Users\Public\Desktop\Panda Cloud Cleaner.lnk 2014-02-26 22:46 - 2012-04-03 22:26 - 00000000 ____D () C:\Users\Gert\AppData\Local\Adobe 2014-02-26 22:39 - 2014-02-26 22:39 - 00005934 _____ () C:\Users\Gert\Desktop\startup.txt 2014-02-23 21:48 - 2014-02-23 21:19 - 00000000 ____D () C:\Users\Gert\Desktop\Bastille 2014-02-23 21:39 - 2012-07-06 10:53 - 00000000 ____D () C:\Users\Gert\AppData\Roaming\Apple Computer 2014-02-21 23:57 - 2014-02-21 23:57 - 00024724 _____ () C:\Users\Gert\Desktop\Inga Text Anfrage Canada.odt 2014-02-21 22:31 - 2014-02-21 22:31 - 00025753 _____ () C:\Users\Gert\Desktop\klima.odt ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-11-20 07:42 ==================== End Of Log ============================ --- --- --- --- --- --- und Additon Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-03-2014 Ran by Gert at 2014-03-23 18:44:56 Running from C:\Users\Gert\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9RXJM10C Boot Mode: Normal ========================================================== ==================== Security Center ======================== AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B} AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736} ==================== Installed Programs ====================== Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 4.0.0.1390 - Adobe Systems Incorporated) Adobe AIR (x32 Version: 4.0.0.1390 - Adobe Systems Incorporated) Hidden Adobe Flash Player 11 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 11.9.900.170 - Adobe Systems Incorporated) Adobe Flash Player 12 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 12.0.0.77 - Adobe Systems Incorporated) Adobe Reader X (10.1.9) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.9 - Adobe Systems Incorporated) Amazon Cloud Player (HKCU\...\Amazon Amazon Cloud Player) (Version: 2.3.0.422 - Amazon Services LLC) Amazon Kindle (HKCU\...\Amazon Kindle) (Version: - Amazon) AMD Media Foundation Decoders (Version: 1.0.60607.2201 - ATI Technologies Inc.) Hidden AMD VISION Engine Control Center (x32 Version: 2011.0607.2212.38019 - ATI) Hidden AOL Deinstallation (HKLM-x32\...\AOL Deinstallation) (Version: - ) Apple Application Support (HKLM-x32\...\{21FC2093-6E43-460B-B9B0-5F5AA35BBB0F}) (Version: 3.0 - Apple Inc.) Apple Mobile Device Support (HKLM\...\{FE86CB0C-FCB3-4358-B4B0-B0A41E33B3DD}) (Version: 7.1.0.32 - Apple Inc.) Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.) ATI Catalyst Install Manager (HKLM\...\{4ACA5AE7-E68C-5A48-F8E6-D67946267506}) (Version: 3.0.829.0 - ATI Technologies, Inc.) avast! Free Antivirus (HKLM-x32\...\avast) (Version: 9.0.2013 - Avast Software) Bejeweled 2 Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden Bejeweled 3 (x32 Version: 2.2.0.97 - WildTangent) Hidden Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.) Catalyst Control Center - Branding (x32 Version: 1.00.0000 - ATI) Hidden Catalyst Control Center Graphics Previews Common (x32 Version: 2011.0607.2212.38019 - ATI) Hidden Catalyst Control Center InstallProxy (x32 Version: 2011.0607.2212.38019 - ATI Technologies, Inc.) Hidden Catalyst Control Center Localization All (x32 Version: 2011.0607.2212.38019 - ATI) Hidden CCC Help Chinese Standard (x32 Version: 2011.0607.2211.38019 - ATI) Hidden CCC Help Chinese Traditional (x32 Version: 2011.0607.2211.38019 - ATI) Hidden CCC Help Czech (x32 Version: 2011.0607.2211.38019 - ATI) Hidden CCC Help Danish (x32 Version: 2011.0607.2211.38019 - ATI) Hidden CCC Help Dutch (x32 Version: 2011.0607.2211.38019 - ATI) Hidden CCC Help English (x32 Version: 2011.0607.2211.38019 - ATI) Hidden CCC Help Finnish (x32 Version: 2011.0607.2211.38019 - ATI) Hidden CCC Help French (x32 Version: 2011.0607.2211.38019 - ATI) Hidden CCC Help German (x32 Version: 2011.0607.2211.38019 - ATI) Hidden CCC Help Greek (x32 Version: 2011.0607.2211.38019 - ATI) Hidden CCC Help Hungarian (x32 Version: 2011.0607.2211.38019 - ATI) Hidden CCC Help Italian (x32 Version: 2011.0607.2211.38019 - ATI) Hidden CCC Help Japanese (x32 Version: 2011.0607.2211.38019 - ATI) Hidden CCC Help Korean (x32 Version: 2011.0607.2211.38019 - ATI) Hidden CCC Help Norwegian (x32 Version: 2011.0607.2211.38019 - ATI) Hidden CCC Help Polish (x32 Version: 2011.0607.2211.38019 - ATI) Hidden CCC Help Portuguese (x32 Version: 2011.0607.2211.38019 - ATI) Hidden CCC Help Russian (x32 Version: 2011.0607.2211.38019 - ATI) Hidden CCC Help Spanish (x32 Version: 2011.0607.2211.38019 - ATI) Hidden CCC Help Swedish (x32 Version: 2011.0607.2211.38019 - ATI) Hidden CCC Help Thai (x32 Version: 2011.0607.2211.38019 - ATI) Hidden CCC Help Turkish (x32 Version: 2011.0607.2211.38019 - ATI) Hidden ccc-utility64 (Version: 2011.0607.2212.38019 - ATI) Hidden CCleaner (HKLM\...\CCleaner) (Version: 4.11 - Piriform) Chicken Invaders 3 - Revenge of the Yolk (x32 Version: 2.2.0.95 - WildTangent) Hidden Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden Contrôle ActiveX Windows Live Mesh pour connexions à distance (HKLM-x32\...\{55D003F4-9599-44BF-BA9E-95D060730DD3}) (Version: 15.4.5722.2 - Microsoft Corporation) Corel WinDVD (x32 Version: 11 - Corel Inc.) Hidden Corel WinDVD Pro 11 (HKLM-x32\...\_{991D8429-CFD9-48D9-BD85-6EDD3007B5A9}) (Version: 11.0.0.289 - Corel Inc.) D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden Die*Sims™*3 (HKLM-x32\...\{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}) (Version: 1.0.631 - Electronic Arts) Diner Dash 2 Restaurant Rescue (x32 Version: 2.2.0.95 - WildTangent) Hidden ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version: - ) FATE (x32 Version: 2.2.0.97 - WildTangent) Hidden File Type Advisor 1.4 (HKLM-x32\...\File Type Advisor_is1) (Version: - filetypeadvisor.com) Final Drive: Nitro (x32 Version: 2.2.0.95 - WildTangent) Hidden Free M4a to MP3 Converter 8.1 (HKLM-x32\...\Free M4a to MP3 Converter_is1) (Version: - ManiacTools.com) Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Google Chrome (HKLM-x32\...\Google Chrome) (Version: 33.0.1750.154 - Google Inc.) Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.4805.320 - Google Inc.) Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden Google Update Helper (x32 Version: 1.3.22.5 - Google Inc.) Hidden High-Definition Video Playback (x32 Version: 7.3.10900.8.0 - Nero AG) Hidden ICA (x32 Version: 1.0 - Corel Inc.) Hidden Insaniquarium Deluxe (x32 Version: 2.2.0.97 - WildTangent) Hidden IPM (x32 Version: 1.00.0000 - Corel Inc.) Hidden iTunes (HKLM\...\{96B53CA8-5ABB-49D8-96F1-F6C0D73A76C6}) (Version: 11.1.4.62 - Apple Inc.) Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Kaspersky Security Scan (HKLM-x32\...\InstallWIX_{56009CA3-423B-41F8-884A-E5B049534F15}) (Version: 12.0.1.340 - Kaspersky Lab) Kaspersky Security Scan (x32 Version: 12.0.1.340 - Kaspersky Lab) Hidden Malwarebytes Anti-Malware Version 1.75.0.1300 (HKLM-x32\...\Malwarebytes' Anti-Malware_is1) (Version: 1.75.0.1300 - Malwarebytes Corporation) Media Player Utilities 4.43 (HKLM-x32\...\{8B9852AF-B0B0-47B7-9BC5-89A95D77B6C9}) (Version: 4.43 - ) Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation) Microsoft Primary Interoperability Assemblies 2005 (HKLM-x32\...\{2C303EE0-A595-3543-A71A-931C7AC40EDE}) (Version: 9.0.21022 - Microsoft Corporation) Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation) Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 (HKLM-x32\...\{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}) (Version: 9.0.30411 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation) Microsoft WSE 3.0 Runtime (HKLM-x32\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.) MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation) MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation) Nero 10 Movie ThemePack Basic (x32 Version: 10.6.10000.1.0 - Nero AG) Hidden Nero BackItUp 10 (HKLM-x32\...\{68AB6930-5BFF-4FF6-923B-516A91984FE6}) (Version: 5.8.10900.8.100 - Nero AG) Nero BackItUp 10 Help (CHM) (x32 Version: 10.6.10700 - Nero AG) Hidden Nero BurnRights 10 (HKLM-x32\...\{943CFD7D-5336-47AF-9418-E02473A5A517}) (Version: 4.4.10400.2.100 - Nero AG) Nero BurnRights 10 Help (CHM) (x32 Version: 10.6.10700 - Nero AG) Hidden Nero Control Center 10 (x32 Version: 10.6.12700.0.7 - Nero AG) Hidden Nero ControlCenter 10 Help (CHM) (x32 Version: 10.6.10800 - Nero AG) Hidden Nero Core Components 10 (x32 Version: 2.0.20000.9.12 - Nero AG) Hidden Nero Express 10 (HKLM-x32\...\{70550193-1C22-445C-8FA4-564E155DB1A7}) (Version: 10.6.10700.5.100 - Nero AG) Nero Express 10 Help (CHM) (x32 Version: 10.6.10700 - Nero AG) Hidden Nero InfoTool 10 (HKLM-x32\...\{F412B4AF-388C-4FF5-9B2F-33DB1C536953}) (Version: 7.4.10300.1.100 - Nero AG) Nero InfoTool 10 Help (CHM) (x32 Version: 10.6.10700 - Nero AG) Hidden Nero Kwik Media (HKLM-x32\...\{1F7D9F37-C39C-486C-BDF8-8F440FFB3352}) (Version: 1.6.15100.59.100 - Nero AG) Nero Multimedia Suite 10 Essentials (HKLM-x32\...\{2063D199-D79F-471A-9019-9E647296394D}) (Version: 10.6.10300 - Nero AG) Nero RescueAgent 10 (HKLM-x32\...\{E337E787-CF61-4B7B-B84F-509202A54023}) (Version: 3.6.10500.3.100 - Nero AG) Nero RescueAgent 10 Help (CHM) (x32 Version: 10.6.10800 - Nero AG) Hidden Nero StartSmart 10 (HKLM-x32\...\{F61D489E-6C44-49AC-AD02-7DA8ACA73A65}) (Version: 10.6.10500.3.100 - Nero AG) Nero StartSmart 10 Help (CHM) (x32 Version: 10.6.10700 - Nero AG) Hidden Nero Update (HKLM-x32\...\{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}) (Version: 1.0.10900.31.0 - Nero AG) NeroKwikMedia Help (CHM) (x32 Version: 10.6.10900 - Nero AG) Hidden OpenOffice.org 3.4 (HKLM-x32\...\{4C552FD3-2CCD-4E00-AC64-0681DBB3F8B5}) (Version: 3.4.9590 - OpenOffice.org) Panda Cloud Cleaner (HKLM-x32\...\{92B2B132-C7F0-43DC-921A-4493C04F78A4}_is1) (Version: 1.0.97 - Panda Security) PAYBACK Toolbar 1.2 (HKLM-x32\...\PAYBACK Toolbar_is1) (Version: 1.2.0 - PAYBACK GmbH) PDF24 Creator 6.0.1 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org) Penguins! (x32 Version: 2.2.0.95 - WildTangent) Hidden Personal Ancestral File (HKLM-x32\...\{09DE2F51-DF0A-11D3-9DBC-00C04F522588}) (Version: - ) Personal Ancestral File® Version 4.0 (HKLM-x32\...\Personal Ancestral File® Version 4.0) (Version: - ) Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.95 - WildTangent) Hidden PlayReady PC Runtime amd64 (HKLM\...\{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}) (Version: 1.3.0 - Microsoft Corporation) Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden Posterjack 8.6 (HKLM-x32\...\{E864D077-349F-47ED-A58E-95A2EEEE0804}) (Version: 8.6 - Posterjack) Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.38.113.2011 - Realtek) Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6289 - Realtek Semiconductor Corp.) Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30126 - Realtek Semiconductor Corp.) Realtek WLAN Driver (HKLM-x32\...\{9D3D8C60-A55F-4fed-B2B9-173001290E16}) (Version: 2.00.0013 - REALTEK Semiconductor Corp.) Saal Design Software (HKLM-x32\...\SaalDesignSoftware) (Version: 3.2.26 - SSW Software GmbH) Saal Design Software (x32 Version: 3.2.26 - SSW Software GmbH) Hidden Sesam Découvertes 2 deinstallieren (HKLM-x32\...\Sesam Decouvertes 2 - vTB90) (Version: - ) Sesam Découvertes 3 deinstallieren (HKLM-x32\...\Sesam Decouvertes 3 (TB9)) (Version: - ) Sesam Découvertes 4 deinstallieren (HKLM-x32\...\Sesam Decouvertes 4 - vTB90) (Version: - ) Setup (x32 Version: 11.0 - Corel Inc.) Hidden Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.) Slingo Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden SpeedyPC Pro (HKLM-x32\...\{604CD5A1-4520-4844-B064-A3D884B77E91}) (Version: 3.2.0.0 - SpeedyPC Software) <==== ATTENTION SUPERAntiSpyware (HKLM\...\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 5.7.1018 - SUPERAntiSpyware.com) Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.2.11.1 - Synaptics Incorporated) TOSHIBA Assist (HKLM-x32\...\{C2A276E3-154E-44DC-AAF1-FFDD7FD30E35}) (Version: 4.02.02 - TOSHIBA CORPORATION) TOSHIBA Bulletin Board (HKLM-x32\...\InstallShield_{43DBC64B-3DD1-47E2-8788-D3C3B110C574}) (Version: 2.1.10.64 - TOSHIBA Corporation) TOSHIBA Bulletin Board (Version: 2.1.10.64 - TOSHIBA Corporation) Hidden TOSHIBA ConfigFree (HKLM-x32\...\{D5AEEAA2-184E-4A2A-BAA3-6225EA4B9516}) (Version: 8.0.37 - TOSHIBA CORPORATION) TOSHIBA Disc Creator (HKLM\...\{5DA0E02F-970B-424B-BF41-513A5018E4C0}) (Version: 2.1.0.6 for x64 - TOSHIBA Corporation) TOSHIBA Face Recognition (HKLM-x32\...\InstallShield_{F67FA545-D8E5-4209-86B1-AEE045D1003F}) (Version: 3.1.8.64 - TOSHIBA Corporation) TOSHIBA Face Recognition (Version: 3.1.8.64 - TOSHIBA Corporation) Hidden TOSHIBA Hardware Setup (HKLM-x32\...\{2FD5D2C5-A7A1-4065-89BA-90542BF7CCD3}) (Version: 2.00.0013 - TOSHIBA) TOSHIBA HDD/SSD Alert (HKLM-x32\...\InstallShield_{D4322448-B6AF-4316-B859-D8A0E84DCB38}) (Version: 3.1.64.7 - TOSHIBA Corporation) TOSHIBA HDD/SSD Alert (Version: 3.1.64.7 - TOSHIBA Corporation) Hidden TOSHIBA HDD/SSD Alert (x32 Version: 3.1.64.7 - TOSHIBA Corporation) Hidden Toshiba Manuals (HKLM-x32\...\{90FF4432-21B7-4AF6-BA6E-FB8C1FED9173}) (Version: 10.02 - TOSHIBA) TOSHIBA Media Controller (HKLM-x32\...\{C7A4F26F-F9B0-41B2-8659-99181108CDE3}) (Version: 1.0.86.2 - TOSHIBA CORPORATION) TOSHIBA Online Product Information (HKLM-x32\...\{2290A680-4083-410A-ADCC-7092C67FC052}) (Version: 4.01.0000 - TOSHIBA) TOSHIBA Places Icon Utility (HKLM-x32\...\{461F6F0D-7173-4902-9604-AB1A29108AF2}) (Version: 1.1.0.12 - TOSHIBA Corporation) TOSHIBA Recovery Media Creator (HKLM-x32\...\{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}) (Version: 2.1.3.10010 - TOSHIBA CORPORATION) TOSHIBA Recovery Media Creator Reminder (HKLM-x32\...\InstallShield_{773970F1-5EBA-4474-ADEE-1EA3B0A59492}) (Version: 1.1.0.0 - TOSHIBA) TOSHIBA Recovery Media Creator Reminder (x32 Version: 1.1.0.0 - TOSHIBA) Hidden TOSHIBA ReelTime (HKLM-x32\...\InstallShield_{24811C12-F4A9-4D0F-8494-A7B8FE46123C}) (Version: 1.7.17.64 - TOSHIBA Corporation) TOSHIBA ReelTime (Version: 1.7.17.64 - TOSHIBA Corporation) Hidden TOSHIBA Service Station (HKLM-x32\...\{AC6569FA-6919-442A-8552-073BE69E247A}) (Version: 2.1.52 - TOSHIBA) TOSHIBA Supervisor Password (HKLM-x32\...\{119826A8-4EF6-4BE5-A88B-D2D81FA7CEE2}) (Version: 2.00.0008 - TOSHIBA) TOSHIBA TEMPRO (HKLM-x32\...\{F082CB11-4794-4259-99A1-D91BA762AD15}) (Version: 3.35 - Toshiba Europe GmbH) TOSHIBA Value Added Package (HKLM-x32\...\InstallShield_{066CFFF8-12BF-4390-A673-75F95EFF188E}) (Version: 1.5.4.64 - TOSHIBA Corporation) TOSHIBA Value Added Package (Version: 1.5.4.64 - TOSHIBA Corporation) Hidden TOSHIBA Value Added Package (x32 Version: 1.5.4.64 - TOSHIBA Corporation) Hidden TOSHIBA Web Camera Application (HKLM-x32\...\InstallShield_{6F3C8901-EBD3-470D-87F8-AC210F6E5E02}) (Version: 2.0.0.13 - TOSHIBA Corporation) TOSHIBA Web Camera Application (x32 Version: 2.0.0.13 - TOSHIBA Corporation) Hidden TOSHIBA Wireless LAN Indicator (HKLM-x32\...\{5BA99779-6E12-49EF-BE49-F35B1EDB4DF9}) (Version: 1.0.4 - TOSHIBA CORPORATION) TRORMCLauncher (HKLM-x32\...\InstallShield_{E65C7D8E-186D-484B-BEA8-DEF0331CE600}) (Version: - ) TRORMCLauncher (Version: 1.0.0.10 - TOSHIBA) Hidden Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden Wedding Dash 2 - Rings Around the World (x32 Version: 2.2.0.95 - WildTangent) Hidden WildTangent Games (HKLM-x32\...\WildTangent toshiba Master Uninstall) (Version: 1.0.2.5 - WildTangent) WildTangent Games App (Toshiba Games) (x32 Version: 4.0.11.2 - WildTangent) Hidden Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation) Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live ID Sign-in Assistant (Version: 7.250.4232.0 - Microsoft Corporation) Hidden Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Language Selector (Version: 15.4.3538.0513 - Microsoft Corporation) Hidden Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen (HKLM-x32\...\{C32CE55C-12BA-4951-8797-0967FDEF556F}) (Version: 15.4.5722.2 - Microsoft Corporation) Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation) Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation) Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{C63A1E60-B6A4-440B-89A5-1FC6E4AC1C94}) (Version: 15.4.5722.2 - Microsoft Corporation) Windows Live Messenger (x32 Version: 15.4.3538.0513 - Microsoft Corporation) Hidden Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Phone app for desktop (HKLM-x32\...\{9C4D79B6-238E-49D8-AEBC-26384EBDE6B3}) (Version: 1.0.1720.1 - Microsoft Corporation) Zuma Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden ==================== Restore Points ========================= 17-02-2014 06:55:43 Windows Update 18-02-2014 21:40:49 Removed Java 7 Update 45 21-02-2014 15:07:48 Windows Update 25-02-2014 13:23:08 Windows Update 03-03-2014 19:30:33 Windows Update 07-03-2014 15:27:10 Windows Update 13-03-2014 15:33:33 Windows Update 16-03-2014 15:00:24 Windows Update 20-03-2014 15:52:11 Windows Update 23-03-2014 16:23:42 Installed Microsoft Fix it 50471 ==================== Hosts content: ========================== 2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: {14B4F8CC-2FA4-4863-8150-FC0EA45A5AA2} - System32\Tasks\SpeedyPC Update Version3 Startup Task => C:\Program Files (x86)\Common Files\SpeedyPC Software\UUS3\SpeedyPC_Update3.exe [2013-10-15] (SpeedyPC Software) Task: {19CEC8BE-D1A2-4D83-BA33-0820465099E9} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-02-18] (Google Inc.) Task: {1DBB45EA-F4B9-43FB-850A-718EFA5ADB23} - System32\Tasks\ConfigFree Startup Programs => C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe [2010-12-03] (TOSHIBA CORPORATION) Task: {31B73690-E80C-4FCE-9BFD-49051B7C8BD4} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-02-20] (Piriform Ltd) Task: {58504340-3702-4280-99D2-03E12B329C47} - System32\Tasks\SUPERAntiSpyware Scheduled Task f21915d5-4c30-4158-a73b-ef0215cc7218 => C:\Program Files\SUPERAntiSpyware\SASTask.exe [2013-11-07] (SUPERAdBlocker.com) Task: {76E6E559-CC3D-49DD-BA3D-31E1EBC7FAC3} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-02-03] (AVAST Software) Task: {7FB21698-27FF-413A-B8AC-25787BEFF8FC} - System32\Tasks\FileAdvisorCheck => C:\Program Files (x86)\File Type Advisor\file-type-advisor.exe [2013-09-04] (filetypeadvisor.com ) Task: {84CBA976-B52E-484C-B564-FC1C202BC761} - System32\Tasks\Amazon Music Helper => C:\Users\Gert\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [2014-01-14] () Task: {9482A1BB-5387-45FA-9EAF-3D7A962711F9} - System32\Tasks\SpeedyPC Pro_sch_A817E6FE-9736-11E3-A2BC-00038A000015 => C:\Program Files (x86)\SpeedyPC Software\SpeedyPC\SpeedyPC.exe [2014-01-09] (SpeedyPC Software, Inc.) Task: {9CB3984B-5EDC-4C0D-9899-916DC2527C7E} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-03-11] (Adobe Systems Incorporated) Task: {A2A41B22-CF21-4D64-A7B3-20BA2B2E2320} - System32\Tasks\SUPERAntiSpyware Scheduled Task ba20b5f7-3acf-438c-823c-47eb6eddc798 => C:\Program Files\SUPERAntiSpyware\SASTask.exe [2013-11-07] (SUPERAdBlocker.com) Task: {BDE579FA-6926-4326-88BA-B354EF1523F6} - \Scheduled Update for Ask Toolbar No Task File Task: {C4B06AC0-AB42-4706-950A-E55551C427E0} - System32\Tasks\FileAdvisorUpdate => C:\Program Files (x86)\File Type Advisor\fileadvisor.exe [2013-09-04] (File Type Advisor) Task: {C5232A71-B2ED-4850-9B87-F6FD39486CD1} - System32\Tasks\SpeedyPC Update Version3 => C:\Program Files (x86)\Common Files\SpeedyPC Software\UUS3\SpeedyPC_Update3.exe [2013-10-15] (SpeedyPC Software) Task: {FE7C4A67-8865-433C-9E12-9E67D4C58251} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-02-18] (Google Inc.) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\SpeedyPC Pro_sch_A817E6FE-9736-11E3-A2BC-00038A000015.job => C:\Program Files (x86)\SpeedyPC Software\SpeedyPC\SpeedyPC.exe Task: C:\Windows\Tasks\SpeedyPC Update Version3 Startup Task.job => C:\Program Files (x86)\Common Files\SpeedyPC Software\UUS3\SpeedyPC_Update3.exe Task: C:\Windows\Tasks\SpeedyPC Update Version3.job => C:\Program Files (x86)\Common Files\SpeedyPC Software\UUS3\SpeedyPC_Update3.exe Task: C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task ba20b5f7-3acf-438c-823c-47eb6eddc798.job => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe Task: C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task f21915d5-4c30-4158-a73b-ef0215cc7218.job => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe ==================== Loaded Modules (whitelisted) ============= 2011-12-29 22:12 - 2010-09-09 17:26 - 00162824 _____ () C:\Windows\System32\GFNEXSrv.exe 2014-02-14 18:30 - 2014-01-14 20:46 - 03140608 _____ () C:\Users\Gert\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe 2010-11-18 17:18 - 2010-11-18 17:18 - 11190784 _____ () C:\Program Files\TOSHIBA\FlashCards\BlackPng.dll 2010-12-08 15:42 - 2010-12-08 15:42 - 00079264 _____ () C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosIPCWraper.dll 2014-03-22 12:43 - 2014-03-22 10:27 - 02189312 _____ () C:\Program Files\AVAST Software\Avast\defs\14032200\algo.dll 2014-03-23 16:04 - 2014-03-23 09:37 - 02189312 _____ () C:\Program Files\AVAST Software\Avast\defs\14032300\algo.dll 2014-02-06 00:52 - 2014-02-06 00:52 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll 2014-02-06 00:52 - 2014-02-06 00:52 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll 2012-12-07 15:15 - 2012-12-07 15:15 - 02126264 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\QtCore4.dll 2012-12-07 15:15 - 2012-12-07 15:15 - 07422392 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\QtGui4.dll 2012-12-07 15:15 - 2012-12-07 15:15 - 02453944 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\QtDeclarative4.dll 2012-12-07 15:15 - 2012-12-07 15:15 - 01270200 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\QtScript4.dll 2012-12-07 15:15 - 2012-12-07 15:15 - 00192952 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\QtSql4.dll 2012-12-07 15:15 - 2012-12-07 15:15 - 00795064 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\QtNetwork4.dll 2013-12-26 10:40 - 2013-12-26 10:40 - 19336120 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll 2011-09-05 19:36 - 2011-09-05 19:36 - 00025088 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\imageformats\qgif4.dll 2011-09-05 19:36 - 2011-09-05 19:36 - 00180224 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\imageformats\qjpeg4.dll 2004-01-09 21:02 - 2004-01-09 21:02 - 00045056 _____ () C:\Program Files (x86)\AOL 9.0 VR\zlib.dll 2002-04-22 22:08 - 2002-04-22 22:08 - 00053248 _____ () C:\Program Files (x86)\AOL 9.0 VR\xmlparse.dll 2002-04-22 22:08 - 2002-04-22 22:08 - 00081920 _____ () C:\Program Files (x86)\AOL 9.0 VR\xmltok.dll 2007-05-24 09:01 - 2007-05-24 09:01 - 00090112 _____ () C:\Program Files (x86)\AOL 9.0 VR\Components\Tier2Svc.dll 2007-05-24 09:01 - 2007-05-24 09:01 - 00061440 _____ () C:\Program Files (x86)\AOL 9.0 VR\Components\DataSvcs.dll 2012-06-09 15:32 - 2007-05-24 02:49 - 00131072 _____ () c:\program files (x86)\common files\aol\1339252113\ee\services\proxyprovider\ver1_0_0_1\proxyprovider.dll ==================== Alternate Data Streams (whitelisted) ========= ==================== Safe Mode (whitelisted) =================== ==================== Disabled items from MSCONFIG ============== MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Toshiba Places Icon Utility.lnk => C:\Windows\pss\Toshiba Places Icon Utility.lnk.CommonStartup MSCONFIG\startupreg: (default) => MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" MSCONFIG\startupreg: AOL Fast Start => "C:\Program Files (x86)\AOL 9.0 VR\AOL.EXE" -b MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" MSCONFIG\startupreg: EA Core => "C:\Program Files (x86)\Electronic Arts\EADM\Core.exe" -silent MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe" MSCONFIG\startupreg: NBAgent => "c:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe" /WinStart MSCONFIG\startupreg: PDFPrint => C:\Program Files (x86)\PDF24\pdf24.exe MSCONFIG\startupreg: RtHDVCpl => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun MSCONFIG\startupreg: SpywareTerminatorShield => C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe MSCONFIG\startupreg: Toshiba Registration => C:\Program Files\TOSHIBA\Registration\ToshibaReminder.exe MSCONFIG\startupreg: TosNC => %ProgramFiles%\Toshiba\BulletinBoard\TosNcCore.exe ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (03/23/2014 04:03:44 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (03/22/2014 02:38:25 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (03/22/2014 02:34:30 PM) (Source: Windows Search Service) (User: ) Description: Windows Search wird aufgrund eines Problems bei der Indizierung The catalog is corrupt beendet. Details: Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801) Error: (03/22/2014 02:34:30 PM) (Source: Windows Search Service) (User: ) Description: Der Index kann nicht initialisiert werden. Details: Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801) Error: (03/22/2014 02:34:30 PM) (Source: Windows Search Service) (User: ) Description: Die Anwendung kann nicht initialisiert werden. Kontext: Windows Anwendung Details: Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801) Error: (03/22/2014 02:34:30 PM) (Source: Windows Search Service) (User: ) Description: Das Gatherer-Objekt kann nicht initialisiert werden. Kontext: Windows Anwendung, SystemIndex Katalog Details: Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801) Error: (03/22/2014 02:34:30 PM) (Source: Windows Search Service) (User: ) Description: Plug-In in <Search.TripoliIndexer> kann nicht initialisiert werden. Kontext: Windows Anwendung, SystemIndex Katalog Details: Element nicht gefunden. (HRESULT : 0x80070490) (0x80070490) Error: (03/22/2014 02:33:57 PM) (Source: Windows Search Service) (User: ) Description: Plug-In in <Search.JetPropStore> kann nicht initialisiert werden. Kontext: Windows Anwendung, SystemIndex Katalog Details: Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801) Error: (03/22/2014 02:33:57 PM) (Source: Windows Search Service) (User: ) Description: Die Eigenschaftenspeicherdaten können von Windows Search nicht geladen werden. Kontext: Windows Anwendung, SystemIndex Katalog Details: Der Inhaltsindexserver kann wegen eines Datenbankfehlers keine Daten aktualisieren oder auf sie zugreifen. Beenden Sie den Suchdienst, und starten Sie ihn erneut. Wenn das Problem weiterhin besteht, setzen Sie den Inhaltsindex zurück, und crawlen Sie ihn erneut. In manchen Fällen muss der Inhaltsindex möglicherweise gelöscht und erneut erstellt werden. (HRESULT : 0x8004117f) (0x8004117f) Error: (03/22/2014 02:33:57 PM) (Source: Windows Search Service) (User: ) Description: Vom Suchdienst wurden beschädigte Datendateien im Index {id=1100} erkannt. Vom Dienst wird versucht, dieses Problem durch Neuerstellung des Indexes automatisch zu beheben. Details: Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801) System errors: ============= Error: (03/23/2014 05:13:16 PM) (Source: Schannel) (User: NT-AUTORITÄT) Description: Es wurde eine schwerwiegende Warnung generiert: 43. Der interne Fehlerstatus lautet: 252. Error: (03/23/2014 05:13:16 PM) (Source: Schannel) (User: NT-AUTORITÄT) Description: Es wurde eine schwerwiegende Warnung generiert: 43. Der interne Fehlerstatus lautet: 252. Error: (03/23/2014 04:45:24 PM) (Source: Schannel) (User: NT-AUTORITÄT) Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252. Error: (03/23/2014 04:45:24 PM) (Source: Schannel) (User: NT-AUTORITÄT) Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252. Error: (03/23/2014 04:45:24 PM) (Source: Schannel) (User: NT-AUTORITÄT) Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252. Error: (03/23/2014 04:45:24 PM) (Source: Schannel) (User: NT-AUTORITÄT) Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252. Error: (03/23/2014 04:44:40 PM) (Source: Schannel) (User: NT-AUTORITÄT) Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252. Error: (03/23/2014 04:25:36 PM) (Source: Schannel) (User: NT-AUTORITÄT) Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252. Error: (03/23/2014 04:25:36 PM) (Source: Schannel) (User: NT-AUTORITÄT) Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252. Error: (03/23/2014 04:03:10 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (User: NT-AUTORITÄT) Description: Das WLAN-Erweiterungsmodul konnte nicht gestartet werden. Modulpfad: C:\Windows\system32\Rtlihvs.dll Fehlercode: 126 Microsoft Office Sessions: ========================= Error: (03/23/2014 04:03:44 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (03/22/2014 02:38:25 PM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (03/22/2014 02:34:30 PM) (Source: Windows Search Service)(User: ) Description: Details: Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801) The catalog is corrupt Error: (03/22/2014 02:34:30 PM) (Source: Windows Search Service)(User: ) Description: Details: Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801) Error: (03/22/2014 02:34:30 PM) (Source: Windows Search Service)(User: ) Description: Kontext: Windows Anwendung Details: Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801) Error: (03/22/2014 02:34:30 PM) (Source: Windows Search Service)(User: ) Description: Kontext: Windows Anwendung, SystemIndex Katalog Details: Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801) Error: (03/22/2014 02:34:30 PM) (Source: Windows Search Service)(User: ) Description: Kontext: Windows Anwendung, SystemIndex Katalog Details: Element nicht gefunden. (HRESULT : 0x80070490) (0x80070490) Search.TripoliIndexer Error: (03/22/2014 02:33:57 PM) (Source: Windows Search Service)(User: ) Description: Kontext: Windows Anwendung, SystemIndex Katalog Details: Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801) Search.JetPropStore Error: (03/22/2014 02:33:57 PM) (Source: Windows Search Service)(User: ) Description: Kontext: Windows Anwendung, SystemIndex Katalog Details: Der Inhaltsindexserver kann wegen eines Datenbankfehlers keine Daten aktualisieren oder auf sie zugreifen. Beenden Sie den Suchdienst, und starten Sie ihn erneut. Wenn das Problem weiterhin besteht, setzen Sie den Inhaltsindex zurück, und crawlen Sie ihn erneut. In manchen Fällen muss der Inhaltsindex möglicherweise gelöscht und erneut erstellt werden. (HRESULT : 0x8004117f) (0x8004117f) Error: (03/22/2014 02:33:57 PM) (Source: Windows Search Service)(User: ) Description: Details: Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801) 1100 CodeIntegrity Errors: =================================== Date: 2013-04-10 18:21:37.218 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-04-10 18:21:36.908 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-04-10 18:21:36.476 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-04-10 18:21:36.004 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-04-10 18:21:35.621 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-04-10 18:21:35.079 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-04-10 18:21:34.672 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-04-10 18:21:34.099 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-04-10 18:21:33.564 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-04-10 18:21:33.094 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. ==================== Memory info =========================== Percentage of memory in use: 65% Total physical RAM: 3693.41 MB Available physical RAM: 1273.21 MB Total Pagefile: 7385.01 MB Available Pagefile: 4426.67 MB Total Virtual: 8192 MB Available Virtual: 8191.83 MB ==================== Drives ================================ Drive c: (WINDOWS) (Fixed) (Total:233.57 GB) (Free:132.76 GB) NTFS Drive d: (Data) (Fixed) (Total:231.8 GB) (Free:217.96 GB) NTFS Drive i: () (Removable) (Total:1.84 GB) (Free:1.16 GB) FAT ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 16A4AA25) Partition 1: (Active) - (Size=400 MB) - (Type=27) Partition 2: (Not Active) - (Size=234 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=232 GB) - (Type=07 NTFS) ======================================================== Disk: 4 (Size: 2 GB) (Disk ID: 00000000) Partition: GPT Partition Type. ==================== End Of Log ============================ |
24.03.2014, 12:45 | #4 |
/// the machine /// TB-Ausbilder | Computer, windows 7, wurde langsammer, malwarebytes findet Schädlinge Revo Uninstaller - Download - Filepony Damit alles deinstallieren was Du in der Additional.txt findest mit dem Zusatz <== ATTENTION Mit Revo auch Moderat die Reste entfernen lassen. Scan mit Combofix
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
27.03.2014, 19:46 | #5 |
| Computer, windows 7, wurde langsammer, malwarebytes findet Schädlinge Hallo Schrauber, ich habe mich erst mal nicht dran getraut, aber jetzt hoffe ich, ich habe alles richtig gemacht Code:
ATTFilter ComboFix 14-03-24.01 - Gert 27.03.2014 19:02:22.1.2 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.3693.1944 [GMT 1:00] ausgeführt von:: c:\users\Gert\Downloads\ComboFix.exe AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B} SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . (((((((((((((((((((((((((((((((((((( Weitere Löschungen )))))))))))))))))))))))))))))))))))))))))))))))) . . c:\windows\IsUn0407.exe D:\install.exe . . ((((((((((((((((((((((( Dateien erstellt von 2014-02-27 bis 2014-03-27 )))))))))))))))))))))))))))))) . . 2014-03-27 18:25 . 2014-03-27 18:25 -------- d-----w- c:\users\Default\AppData\Local\temp 2014-03-27 17:44 . 2014-03-27 17:44 75888 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{64E58256-546F-44D4-A221-6CC6EB53C0D4}\offreg.dll 2014-03-27 17:33 . 2014-03-27 17:33 -------- d-----w- c:\program files (x86)\VS Revo Group 2014-03-25 16:11 . 2014-03-07 04:43 10521840 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{64E58256-546F-44D4-A221-6CC6EB53C0D4}\mpengine.dll 2014-03-23 21:27 . 2014-03-23 21:27 -------- d-----w- c:\windows\SysWow64\DASBOOT 2014-03-23 17:43 . 2014-03-27 17:53 -------- d-----w- C:\FRST 2014-03-23 16:42 . 2014-03-23 16:42 -------- d-----w- c:\users\Gert\AppData\Roaming\SUPERAntiSpyware.com 2014-03-23 16:41 . 2014-03-23 16:42 -------- d-----w- c:\program files\SUPERAntiSpyware 2014-03-23 16:41 . 2014-03-23 16:41 -------- d-----w- c:\programdata\SUPERAntiSpyware.com 2014-03-23 16:37 . 2014-03-23 16:37 -------- d-----w- c:\users\Gert\AppData\Roaming\Malwarebytes 2014-03-23 16:37 . 2014-03-23 16:37 -------- d-----w- c:\programdata\Malwarebytes 2014-03-23 16:37 . 2014-03-23 16:37 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware 2014-03-23 16:37 . 2013-04-04 13:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys 2014-03-13 15:33 . 2014-02-04 02:32 624128 ----a-w- c:\windows\system32\qedit.dll 2014-03-13 15:33 . 2014-02-04 02:04 509440 ----a-w- c:\windows\SysWow64\qedit.dll 2014-03-13 15:33 . 2014-02-04 02:32 1424384 ----a-w- c:\windows\system32\WindowsCodecs.dll 2014-03-13 15:33 . 2014-02-04 02:04 1230336 ----a-w- c:\windows\SysWow64\WindowsCodecs.dll 2014-02-26 22:56 . 2011-06-21 04:09 200976 ----a-w- c:\windows\SysWow64\drivers\tmcomm.sys . . . (((((((((((((((((((((((((((((((((((( Find3M Bericht )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2014-03-20 15:53 . 2012-06-09 14:46 90015360 ----a-w- c:\windows\system32\MRT.exe 2014-03-11 17:39 . 2012-10-21 17:17 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2014-03-11 17:39 . 2012-10-21 17:17 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2014-02-03 10:54 . 2013-12-26 09:40 80184 ----a-w- c:\windows\system32\drivers\aswstm.sys 2014-02-03 10:54 . 2012-04-03 22:00 421704 ----a-w- c:\windows\system32\drivers\aswSP.sys 2014-02-03 10:54 . 2012-04-03 22:00 1038072 ----a-w- c:\windows\system32\drivers\aswSnx.sys 2014-02-03 10:54 . 2012-04-03 22:00 78648 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys 2014-02-03 10:54 . 2012-04-03 22:00 334136 ----a-w- c:\windows\system32\aswBoot.exe 2014-02-03 10:54 . 2012-04-03 21:59 43152 ----a-w- c:\windows\avastSS.scr . . (((((((((((((((((((((((((((( Autostartpunkte der Registrierung )))))))))))))))))))))))))))))))))))))))) . . *Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. REGEDIT4 . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{E141F5C3-2619-4996-8AF8-AA0A9439D986}] 2012-07-11 13:39 602168 ----a-w- c:\program files (x86)\Payback\PAYBACK Toolbar\PaybackToolbar.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar] "{9613CB43-EA4C-48b5-878D-13DFE1818EFE}"= "c:\program files (x86)\Payback\PAYBACK Toolbar\PaybackToolbar.dll" [2012-07-11 602168] . [HKEY_CLASSES_ROOT\clsid\{9613cb43-ea4c-48b5-878d-13dfe1818efe}] [HKEY_CLASSES_ROOT\PaybackToolbar.PaybackToolBand.1] [HKEY_CLASSES_ROOT\TypeLib\{158050A4-69D6-483e-B6B9-A60FE0C9E03A}] [HKEY_CLASSES_ROOT\PaybackToolbar.PaybackToolBand] . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2014-01-06 6563608] "AOL Fast Start"="c:\program files (x86)\AOL 9.0 VR\AOL.EXE" [2007-06-21 50480] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2014-02-05 43848] "AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2014-02-03 3767096] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] "20131224"="c:\program files\AVAST Software\Avast\setup\emupdate\f6b50f9e-b27f-4989-8967-ba440636813f.exe" [2014-03-27 181136] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "TOPI.EXE"="c:\program files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe" [2011-05-16 846936] . c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ TRDCReminder.lnk - c:\program files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe [2011-5-24 1875456] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) "EnableLinkedConnections"= 1 (0x1) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows] "LoadAppInit_DLLs"=1 (0x1) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0PCloudBroom64.exe \systemroot\system32\BroomData.bit . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE] @="" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x] R2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [x] R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x] R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x] R3 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x] R3 GamesAppIntegrationService;GamesAppIntegrationService;c:\program files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe;c:\program files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [x] R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [x] R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x] R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x] R3 PSKMAD;PSKMAD;c:\windows\system32\DRIVERS\PSKMAD.sys;c:\windows\SYSNATIVE\DRIVERS\PSKMAD.sys [x] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x] R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x] R3 RTL8192Ce;Realtek Wireless LAN 802.11n PCI-E NIC Driver;c:\windows\system32\DRIVERS\rtl8192Ce.sys;c:\windows\SYSNATIVE\DRIVERS\rtl8192Ce.sys [x] R3 TDEIO;TDEIO;c:\windows\SysWOW64\sysprep\Bootprio\tdeio64.sys;c:\windows\SysWOW64\sysprep\Bootprio\tdeio64.sys [x] R3 TemproMonitoringService;Notebook Performance Tuning Service (TEMPRO);c:\program files (x86)\Toshiba TEMPRO\TemproSvc.exe;c:\program files (x86)\Toshiba TEMPRO\TemproSvc.exe [x] R3 TMachInfo;TMachInfo;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x] R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x] R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x] S0 aswRvrt;avast! Revert; [x] S0 aswVmm;avast! VM Monitor; [x] S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x] S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x] S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [x] S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [x] S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [x] S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x] S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x] S2 cfWiMAXService;ConfigFree WiMAX Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe;c:\program files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe [x] S2 ConfigFree Service;ConfigFree Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe;c:\program files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe [x] S2 GFNEXSrv;GFNEX Service;c:\windows\System32\GFNEXSrv.exe;c:\windows\SYSNATIVE\GFNEXSrv.exe [x] S2 KSS;Kaspersky Security Scan Service;c:\program files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe;c:\program files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe [x] S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe;c:\program files (x86)\Nero\Update\NASvc.exe [x] S2 regi;regi;c:\windows\system32\drivers\regi.sys;c:\windows\SYSNATIVE\drivers\regi.sys [x] S2 sp_rsdrv2;Spyware Terminator Driver Filter;c:\windows\system32\DRIVERS\stflt.sys;c:\windows\SYSNATIVE\DRIVERS\stflt.sys [x] S3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys;c:\windows\SYSNATIVE\DRIVERS\pgeffect.sys [x] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x] S3 RTWlanE;Realtek Wireless LAN 802.11n PCI-E Network Adapter;c:\windows\system32\DRIVERS\rtwlane.sys;c:\windows\SYSNATIVE\DRIVERS\rtwlane.sys [x] S3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [x] . . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}] 2014-03-16 21:17 1150280 ----a-w- c:\program files (x86)\Google\Chrome\Application\33.0.1750.154\Installer\chrmstp.exe . Inhalt des "geplante Tasks" Ordners . 2014-03-12 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-21 17:39] . 2014-03-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-02-18 21:26] . 2014-03-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-02-18 21:26] . 2014-03-25 c:\windows\Tasks\SUPERAntiSpyware Scheduled Task ba20b5f7-3acf-438c-823c-47eb6eddc798.job - c:\program files\SUPERAntiSpyware\SASTask.exe [2013-11-07 20:08] . 2014-03-24 c:\windows\Tasks\SUPERAntiSpyware Scheduled Task f21915d5-4c30-4158-a73b-ef0215cc7218.job - c:\program files\SUPERAntiSpyware\SASTask.exe [2013-11-07 20:08] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast] @="{472083B0-C522-11CF-8763-00608CC02F24}" [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}] 2014-02-03 10:54 287280 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Toshiba TEMPRO"="c:\program files (x86)\Toshiba TEMPRO\TemproTray.exe" [2011-02-10 1546720] "RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-01-10 2186856] "TosSENotify"="c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [2010-12-08 710040] "TosVolRegulator"="c:\program files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe" [2009-11-11 24376] . ------- Zusätzlicher Suchlauf ------- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TEUA&bmod=TEUA mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local IE: &AOL Toolbar-Suche - c:\program files (x86)\aol\aol toolbar 4.0\resources\de-DE\local\search.html IE: Add to AMV/AVI Video Converter... - c:\program files (x86)\Media Player Utilities 4.43\AMVConverter\grab.html IE: Zu TOSHIBA Bulletin Board hinzufügen - c:\program files\TOSHIBA\BulletinBoard\TosBBCom.dll/1000 IE: {{4840E489-677C-4a08-A1B5-FFAF5196531E} - {9613CB43-EA4C-48b5-878D-13DFE1818EFE} - c:\program files (x86)\Payback\PAYBACK Toolbar\PaybackToolbar.dll TCP: DhcpNameServer = 192.168.2.1 . - - - - Entfernte verwaiste Registrierungseinträge - - - - . URLSearchHooks-{1CFFA392-0898-4b1c-89D1-6E98F9D8EF78} - (no file) Toolbar-Locked - (no file) Wow6432Node-HKLM-Run-<NO NAME> - (no file) HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start Toolbar-Locked - (no file) WebBrowser-{9613CB43-EA4C-48B5-878D-13DFE1818EFE} - (no file) HKLM-Run-TosReelTimeMonitor - c:\program files (x86)\TOSHIBA\ReelTime\TosReelTimeMonitor.exe HKLM-Run-TPwrMain - c:\program files (x86)\TOSHIBA\Power Saver\TPwrMain.EXE HKLM-Run-TCrdMain - c:\program files (x86)\TOSHIBA\FlashCards\TCrdMain.exe HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe AddRemove-Sesam Decouvertes 2 - vTB90 - c:\windows\IsUn0407.exe AddRemove-Sesam Decouvertes 3 (TB9) - c:\windows\IsUn0407.exe AddRemove-Sesam Decouvertes 4 - vTB90 - c:\windows\IsUn0407.exe . . . --------------------- Gesperrte Registrierungsschluessel --------------------- . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_77_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_77_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_77_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_77_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\McAfee] "SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79, 00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\ . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Zeit der Fertigstellung: 2014-03-27 19:29:51 ComboFix-quarantined-files.txt 2014-03-27 18:29 . Vor Suchlauf: 11 Verzeichnis(se), 142.990.082.048 Bytes frei Nach Suchlauf: 13 Verzeichnis(se), 142.220.722.176 Bytes frei . - - End Of File - - B6D90615DCFE58A24EB5F34B6307E776 A36C5E4F47E84449FF07ED3517B43A31 Muß ich noch was tun? Soll ich mit meinen ersten Funden von Malwarebytes noch was machen? Vielen Dank für die Hilfe Biene |
28.03.2014, 10:44 | #6 |
/// the machine /// TB-Ausbilder | Computer, windows 7, wurde langsammer, malwarebytes findet Schädlinge Machne wir jetzt: Downloade Dir bitte Malwarebytes Anti-Malware
Downloade Dir bitte AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ --> Computer, windows 7, wurde langsammer, malwarebytes findet Schädlinge |
31.03.2014, 06:46 | #7 |
| Computer, windows 7, wurde langsammer, malwarebytes findet Schädlinge Hallo Schrauber, hier schon mal die mbam.txt. Habe alles in Quarantäne verschoben. Mache mit dem Rest morgen weiter. Danke Biene Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 30.03.2014 Suchlauf-Zeit: 23:16:54 Logdatei: mbam.txt Administrator: Ja Version: 2.00.0.1000 Malware Datenbank: v2014.03.30.06 Rootkit Datenbank: v2014.03.27.01 Lizenz: Testversion Malware Schutz: Aktiviert Bösartiger Webseiten Schutz: Aktiviert Chameleon: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: Gert Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 268326 Verstrichene Zeit: 48 Min, 30 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Aktiviert Shuriken: Aktiviert PUP: Warnen PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 2 PUP.Optional.Wajam.A, HKLM\SOFTWARE\CLASSES\APPID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}, In Quarantäne, [629e01ff4db313ed29f6a09e996928d8], PUP.Optional.Wajam.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}, In Quarantäne, [629e01ff4db313ed29f6a09e996928d8], Registrierungswerte: 0 (No malicious items detected) Registrierungsdaten: 0 (No malicious items detected) Ordner: 17 PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\Logs, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\rep, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\Logs, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\SearchProtect\rep, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\bubble, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protection, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protectionDS, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\settings, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\uninstall, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\rep, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], Dateien: 62 PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\EULA.txt, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\Main\rep\SystemRepository.dat, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\settings.html, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\style.css, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\bubble\bubble.css, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\bubble\bubble.html, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\bubble\bubble.js, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\bubble\defaults.js, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\Apply-default.png, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\Apply-onclick.png, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\Apply-Rollover.png, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bg-with-logo.png, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bg.png, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bgNotif.png, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bgSettings.png, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\bgUninstall.png, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\btnBlue.png, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\btnClose.png, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\btnSilver.png, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\checkbox.png, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\checkbox_checked.png, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\checkbox_def.png, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\close-win-def.png, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\close-win-over-click.png, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\gray-bg.png, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\hez-def.png, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\hez-selected.png, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\hez.png, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\icon-win.png, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\info-icon.png, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\menu-rollover.png, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\menu-selected.png, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\radio-button-def.png, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\radio-button-selected.png, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\radio-button.png, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\radio-button2.png, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\Settings-icon.png, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\text-field.png, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\v.png, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\Images\x.png, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\defaults.js, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\dialogUtils.js, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\jquery.1.7.1.min.js, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\json2.min.js, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\main.js, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\libs\SPDialogAPI.js, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protection\defaults.js, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protection\protection.css, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protection\protection.html, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protection\protection.js, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protectionDS\defaults.js, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protectionDS\protectionDS.css, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protectionDS\protectionDS.html, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\protectionDS\protectionDS.js, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\settings\defaults.js, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\settings\settings.css, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\settings\settings.html, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\settings\settings.js, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\uninstall\defaults.js, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\uninstall\uninstall.css, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\uninstall\uninstall.html, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect\UI\dialogs\uninstall\uninstall.js, In Quarantäne, [c43c40c0fb05c63acdd9ff88e0235aa6], Physische Sektoren: 0 (No malicious items detected) (end) Beim AdwCleaner mache ich irgendwas falsch. Da steht jetzt: Warte ab. Bitte wählen Sie alle Elemente ab, die Sie nicht entfernen wollen Ich habe jetzt einfach auf Löschen geklickt. Hier die Logdatei: Code:
ATTFilter # AdwCleaner v3.022 - Bericht erstellt am 30/03/2014 um 23:45:40 # Aktualisiert 13/03/2014 von Xplode # Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits) # Benutzername : Gert - GERT-TOSH # Gestartet von : C:\Users\Gert\Downloads\adwcleaner (1).exe # Option : Löschen ***** [ Dienste ] ***** ***** [ Dateien / Ordner ] ***** Ordner Gelöscht : C:\Windows\SysWOW64\SearchProtect Ordner Gelöscht : C:\Users\Gert\AppData\Local\SearchProtect Ordner Gelöscht : C:\Users\Gert\AppData\Roaming\DriverCure ***** [ Verknüpfungen ] ***** ***** [ Registrierungsdatenbank ] ***** Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1 Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1B00725B-C455-4DE6-BFB6-AD540AD427CD} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2} Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} Schlüssel Gelöscht : HKLM\Software\SearchProtect ***** [ Browser ] ***** -\\ Internet Explorer v11.0.9600.16521 -\\ Google Chrome v33.0.1750.154 [ Datei : C:\Users\Gert\AppData\Local\Google\Chrome\User Data\Default\preferences ] ************************* AdwCleaner[R0].txt - [5959 octets] - [06/12/2013 09:43:32] AdwCleaner[R1].txt - [1623 octets] - [30/03/2014 23:38:51] AdwCleaner[S0].txt - [5590 octets] - [06/12/2013 09:46:49] AdwCleaner[S1].txt - [1542 octets] - [30/03/2014 23:45:40] ########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1602 octets] ########## Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 6.1.3 (03.23.2014:1) OS: Windows 7 Home Premium x64 Ran by Gert on 31.03.2014 at 0:00:20,15 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\speedypc software Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\speedypc software Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\installer\upgradecodes\f928123a039649549966d4c29d35b1c9 Successfully deleted: [Registry Key] "hkey_current_user\software\microsoft\internet explorer\low rights\elevationpolicy\{a5aa24ea-11b8-4113-95ae-9ed71deaf12a}" ~~~ Files ~~~ Folders Successfully deleted: [Folder] "C:\ProgramData\speedypc software" Successfully deleted: [Folder] "C:\Users\Gert\AppData\Roaming\speedypc software" Successfully deleted: [Empty Folder] C:\Users\Gert\appdata\local\{239F7330-9EDC-4E2D-B1FB-110AE2BD3814} Successfully deleted: [Empty Folder] C:\Users\Gert\appdata\local\{26335FF8-B042-449C-93D4-DC9627043D78} Successfully deleted: [Empty Folder] C:\Users\Gert\appdata\local\{33ACEC14-F7F4-4D6E-B2B9-4ABF86073FEE} Successfully deleted: [Empty Folder] C:\Users\Gert\appdata\local\{390F7D92-9870-4B44-A3DF-590914B42F54} Successfully deleted: [Empty Folder] C:\Users\Gert\appdata\local\{4C50CF02-1161-440C-A439-5BDD22999FEA} Successfully deleted: [Empty Folder] C:\Users\Gert\appdata\local\{4C6A319E-6C80-40F1-A110-C55BD091E59F} Successfully deleted: [Empty Folder] C:\Users\Gert\appdata\local\{53345428-904B-4881-B2CD-7F56A01E9DF0} Successfully deleted: [Empty Folder] C:\Users\Gert\appdata\local\{59B04E1E-A39B-4DBE-AC78-C2279F55ABDC} Successfully deleted: [Empty Folder] C:\Users\Gert\appdata\local\{5A0BDFBF-FAEB-4E6E-8162-EBF63165D7AF} Successfully deleted: [Empty Folder] C:\Users\Gert\appdata\local\{6C0C2E45-90E6-4E85-A213-89F8A1BB543C} Successfully deleted: [Empty Folder] C:\Users\Gert\appdata\local\{AFE3F5CE-8D96-4715-9DA4-36767999D7C9} Successfully deleted: [Empty Folder] C:\Users\Gert\appdata\local\{B200CF35-EBB7-4868-80AD-D99D48298FB8} Successfully deleted: [Empty Folder] C:\Users\Gert\appdata\local\{B3E0C790-62C6-42CC-B149-9B9123A8147E} Successfully deleted: [Empty Folder] C:\Users\Gert\appdata\local\{CE515C4B-C257-4FC4-9315-D99AAB6D413A} ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 31.03.2014 at 1:37:39,63 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014 Ran by Gert (administrator) on GERT-TOSH on 31-03-2014 07:48:15 Running from C:\Users\Gert\Downloads Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (AMD) C:\Windows\system32\atiesrxx.exe (AMD) C:\Windows\system32\atieclxx.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe () C:\Windows\System32\GFNEXSrv.exe (SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE (AOL LLC) C:\Program Files (x86)\Common Files\AOL\ACS\AOLAcsd.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe () C:\Users\Gert\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe (Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware2\mbamscheduler.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Protexis Inc.) c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe (TOSHIBA Corporation) C:\Windows\system32\TODDSrv.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe (TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe (TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe (TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe (TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe (Nero AG) c:\Program Files (x86)\Nero\Update\NASvc.exe (OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\swriter.exe (OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (Microsoft Corporation) C:\Windows\splwow64.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe (Microsoft Corporation) C:\Windows\system32\prevhost.exe (Farbar) C:\Users\Gert\Downloads\FRST64 (1).exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [TosReelTimeMonitor] - C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe [38304 2010-12-14] (TOSHIBA Corporation) HKLM\...\Run: [Toshiba TEMPRO] - C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe [1546720 2011-02-10] (Toshiba Europe GmbH) HKLM\...\Run: [TPwrMain] - C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [566696 2011-03-02] (TOSHIBA Corporation) HKLM\...\Run: [TCrdMain] - C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [973176 2010-12-15] (TOSHIBA Corporation) HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2186856 2011-01-10] (Realtek Semiconductor) HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2679592 2011-02-03] (Synaptics Incorporated) HKLM\...\Run: [TosSENotify] - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [710040 2010-12-08] (TOSHIBA Corporation) HKLM\...\Run: [TosVolRegulator] - C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation) HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-06] (Apple Inc.) HKLM-x32\...\Run: [] - [X] HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3854640 2014-03-30] (AVAST Software) HKU\.DEFAULT\...\Run: [TOPI.EXE] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe [846936 2011-05-16] (TOSHIBA) Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe) Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=TEUA&bmod=TEUA StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) BHO-x32: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files (x86)\AOL\AOL Toolbar 4.0\aoltb.dll (AOL LLC) BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) BHO-x32: PAYBACK Toolbar Browserhilfsobjekt - {E141F5C3-2619-4996-8AF8-AA0A9439D986} - C:\Program Files (x86)\Payback\PAYBACK Toolbar\PaybackToolbar.dll (PAYBACK GmbH) Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) Toolbar: HKLM-x32 - AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files (x86)\AOL\AOL Toolbar 4.0\aoltb.dll (AOL LLC) Toolbar: HKLM-x32 - PAYBACK Toolbar - {9613CB43-EA4C-48b5-878D-13DFE1818EFE} - C:\Program Files (x86)\Payback\PAYBACK Toolbar\PaybackToolbar.dll (PAYBACK GmbH) Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) Toolbar: HKCU - No Name - {9613CB43-EA4C-48B5-878D-13DFE1818EFE} - No File DPF: HKLM-x32 {1B00725B-C455-4DE6-BFB6-AD540AD427CD} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab DPF: HKLM-x32 {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} hxxp://quickscan.bitdefender.com/qsax/qsax.cab Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 Chrome: ======= CHR Extension: (Google Docs) - C:\Users\Gert\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-01-17] CHR Extension: (Google Drive) - C:\Users\Gert\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-01-17] CHR Extension: (YouTube) - C:\Users\Gert\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-01-17] CHR Extension: (Google-Suche) - C:\Users\Gert\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-01-17] CHR Extension: (Google Wallet) - C:\Users\Gert\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-01-17] CHR Extension: (Google Mail) - C:\Users\Gert\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-01-17] CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-03-30] ==================== Services (Whitelisted) ================= R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [144152 2013-10-11] (SUPERAntiSpyware.com) R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-03-30] (AVAST Software) S3 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [227904 2013-12-17] (WildTangent) R2 GFNEXSrv; C:\Windows\System32\GFNEXSrv.exe [162824 2010-09-09] () R2 KSS; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe [202328 2012-12-07] (Kaspersky Lab ZAO) R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware2\mbamscheduler.exe [1809720 2014-03-05] (Malwarebytes Corporation) S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware2\mbamservice.exe [857912 2014-03-05] (Malwarebytes Corporation) S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [112080 2011-02-10] (Toshiba Europe GmbH) ==================== Drivers (Whitelisted) ==================== U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-03-30] (AVAST Software) R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-03-30] (AVAST Software) R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-03-30] () R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-03-30] (AVAST Software) R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-03-30] (AVAST Software) R3 aswStm; C:\Windows\system32\drivers\aswStm.sys [84816 2014-03-30] (AVAST Software) R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-12-19] (AVAST Software) R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208928 2014-03-30] () R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-03-05] (Malwarebytes Corporation) S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63192 2014-03-05] (Malwarebytes Corporation) S3 PSKMAD; C:\Windows\System32\DRIVERS\PSKMAD.sys [47632 2013-04-29] (Panda Security, S.L.) R3 RTWlanE; C:\Windows\System32\DRIVERS\rtwlane.sys [1514568 2013-05-02] (Realtek Semiconductor Corporation ) R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com) R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com) R2 sp_rsdrv2; C:\Windows\System32\DRIVERS\stflt.sys [51496 2013-12-04] (Windows (R) Win 7 DDK provider) S3 catchme; \??\C:\ComboFix\catchme.sys [X] S3 TDEIO; \??\c:\Windows\SysWOW64\sysprep\Bootprio\tdeio64.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-03-31 07:47 - 2014-03-31 07:48 - 02157056 _____ (Farbar) C:\Users\Gert\Downloads\FRST64 (1).exe 2014-03-31 07:37 - 2014-03-31 07:37 - 00000098 ____H () C:\Users\Gert\Desktop\.~lock.JRT.txt# 2014-03-31 01:37 - 2014-03-31 01:37 - 00002705 _____ () C:\Users\Gert\Desktop\JRT.txt 2014-03-31 00:00 - 2014-03-31 00:00 - 00000000 ____D () C:\Windows\ERUNT 2014-03-30 23:56 - 2014-03-30 23:56 - 01038974 _____ (Thisisu) C:\Users\Gert\Desktop\JRT.exe 2014-03-30 23:55 - 2014-03-30 23:55 - 00016381 _____ () C:\Users\Gert\Desktop\download-junkware_removal_tool.htm 2014-03-30 23:37 - 2014-03-30 23:37 - 01950720 _____ () C:\Users\Gert\Downloads\adwcleaner (1).exe 2014-03-30 23:27 - 2014-03-30 23:27 - 00013168 _____ () C:\Users\Gert\Desktop\mbam.txt 2014-03-30 22:52 - 2014-03-30 22:52 - 01950720 _____ () C:\Users\Gert\Downloads\adwcleaner.exe 2014-03-30 22:24 - 2014-03-30 23:56 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-03-30 22:24 - 2014-03-30 22:24 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware2 2014-03-30 22:24 - 2014-03-05 09:26 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-03-30 22:24 - 2014-03-05 09:26 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-03-30 22:16 - 2014-03-30 22:16 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr 2014-03-27 20:29 - 2014-03-27 20:29 - 00019453 _____ () C:\ComboFix.txt 2014-03-27 19:59 - 2014-03-27 20:30 - 00000000 ____D () C:\ComboFix 2014-03-27 19:58 - 2014-03-27 19:58 - 00001156 _____ () C:\Users\Gert\Desktop\ComboFix - Verknüpfung.lnk 2014-03-27 19:57 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe 2014-03-27 19:57 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe 2014-03-27 19:57 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2014-03-27 19:57 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2014-03-27 19:57 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2014-03-27 19:57 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe 2014-03-27 19:57 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe 2014-03-27 19:57 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe 2014-03-27 19:56 - 2014-03-27 20:29 - 00000000 ____D () C:\Qoobox 2014-03-27 19:56 - 2014-03-27 20:26 - 00000000 ____D () C:\Windows\erdnt 2014-03-27 19:52 - 2014-03-27 19:53 - 00037542 _____ () C:\Users\Gert\Downloads\Addition.txt 2014-03-27 19:51 - 2014-03-31 07:48 - 00012812 _____ () C:\Users\Gert\Downloads\FRST.txt 2014-03-27 19:51 - 2014-03-27 19:51 - 02157056 _____ (Farbar) C:\Users\Gert\Downloads\FRST64.exe 2014-03-27 19:33 - 2014-03-27 19:33 - 00001275 _____ () C:\Users\Gert\Desktop\Revo Uninstaller.lnk 2014-03-27 19:33 - 2014-03-27 19:33 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group 2014-03-27 19:27 - 2014-03-27 19:27 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Gert\Downloads\revosetup95.exe 2014-03-27 19:23 - 2014-03-27 19:23 - 05192353 ____R (Swearware) C:\Users\Gert\Downloads\ComboFix.exe 2014-03-24 21:09 - 2014-03-25 08:15 - 00017604 _____ () C:\Users\Gert\Desktop\Theodor.odt 2014-03-23 19:43 - 2014-03-31 07:48 - 00000000 ____D () C:\FRST 2014-03-23 18:42 - 2014-03-23 18:42 - 00000000 ____D () C:\Users\Gert\AppData\Roaming\SUPERAntiSpyware.com 2014-03-23 18:41 - 2014-03-23 18:42 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware 2014-03-23 18:41 - 2014-03-23 18:41 - 00001815 _____ () C:\Users\Public\Desktop\SUPERAntiSpyware Professional.lnk 2014-03-23 18:41 - 2014-03-23 18:41 - 00000000 ____D () C:\ProgramData\SUPERAntiSpyware.com 2014-03-23 18:37 - 2014-03-30 22:24 - 00001120 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-03-23 18:37 - 2014-03-30 22:24 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-03-23 18:37 - 2014-03-23 18:37 - 00000000 ____D () C:\Users\Gert\AppData\Roaming\Malwarebytes 2014-03-23 18:37 - 2014-03-05 09:26 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-03-22 15:19 - 2014-03-22 15:19 - 00000000 ____D () C:\Windows\pss 2014-03-18 17:58 - 2014-03-18 18:29 - 00301498 _____ () C:\Users\Gert\Desktop\Chemie 2.odp 2014-03-18 17:10 - 2014-03-20 20:47 - 00018348 _____ () C:\Users\Gert\Desktop\chemie-essigsäure.odt 2014-03-17 20:42 - 2014-03-18 23:01 - 00012668 _____ () C:\Users\Gert\Desktop\Französisch Vokabelliste.odt 2014-03-13 17:36 - 2014-03-01 08:05 - 23133696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-03-13 17:36 - 2014-03-01 07:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-03-13 17:36 - 2014-03-01 07:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-03-13 17:36 - 2014-03-01 06:58 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-03-13 17:36 - 2014-03-01 06:52 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-03-13 17:36 - 2014-03-01 06:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-03-13 17:36 - 2014-03-01 06:42 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-03-13 17:36 - 2014-03-01 06:40 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-03-13 17:36 - 2014-03-01 06:37 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-03-13 17:36 - 2014-03-01 06:33 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-03-13 17:36 - 2014-03-01 06:33 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-03-13 17:36 - 2014-03-01 06:32 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-03-13 17:36 - 2014-03-01 06:30 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-03-13 17:36 - 2014-03-01 06:23 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-03-13 17:36 - 2014-03-01 06:17 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-03-13 17:36 - 2014-03-01 06:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-03-13 17:36 - 2014-03-01 06:02 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-03-13 17:36 - 2014-03-01 05:54 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-03-13 17:36 - 2014-03-01 05:52 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-03-13 17:36 - 2014-03-01 05:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-03-13 17:36 - 2014-03-01 05:47 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-03-13 17:36 - 2014-03-01 05:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-03-13 17:36 - 2014-03-01 05:43 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-03-13 17:36 - 2014-03-01 05:42 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-03-13 17:36 - 2014-03-01 05:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-03-13 17:36 - 2014-03-01 05:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-03-13 17:36 - 2014-03-01 05:37 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-03-13 17:36 - 2014-03-01 05:35 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-03-13 17:36 - 2014-03-01 05:18 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-03-13 17:36 - 2014-03-01 05:16 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-03-13 17:36 - 2014-03-01 05:14 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-03-13 17:36 - 2014-03-01 05:10 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-03-13 17:36 - 2014-03-01 05:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-03-13 17:36 - 2014-03-01 05:00 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-03-13 17:36 - 2014-03-01 04:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-03-13 17:36 - 2014-03-01 04:38 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-03-13 17:36 - 2014-03-01 04:32 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-03-13 17:36 - 2014-03-01 04:27 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-03-13 17:36 - 2014-03-01 04:25 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-03-13 17:36 - 2014-03-01 04:25 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-03-13 17:36 - 2014-02-07 03:23 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-03-13 17:36 - 2014-01-29 04:32 - 00484864 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll 2014-03-13 17:36 - 2014-01-29 04:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll 2014-03-13 17:36 - 2014-01-28 04:32 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll 2014-03-13 17:33 - 2014-02-04 04:32 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2014-03-13 17:33 - 2014-02-04 04:32 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll 2014-03-13 17:33 - 2014-02-04 04:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll 2014-03-13 17:33 - 2014-02-04 04:04 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll 2014-03-11 22:38 - 2014-03-11 22:43 - 00000000 ____D () C:\Users\Gert\Desktop\ingap 2014-03-11 22:37 - 2014-03-11 22:41 - 00000000 ____D () C:\Users\Gert\Desktop\ole ==================== One Month Modified Files and Folders ======= 2014-03-31 07:48 - 2014-03-31 07:47 - 02157056 _____ (Farbar) C:\Users\Gert\Downloads\FRST64 (1).exe 2014-03-31 07:48 - 2014-03-27 19:51 - 00012812 _____ () C:\Users\Gert\Downloads\FRST.txt 2014-03-31 07:48 - 2014-03-23 19:43 - 00000000 ____D () C:\FRST 2014-03-31 07:43 - 2013-12-06 09:43 - 00000000 ____D () C:\AdwCleaner 2014-03-31 07:37 - 2014-03-31 07:37 - 00000098 ____H () C:\Users\Gert\Desktop\.~lock.JRT.txt# 2014-03-31 07:17 - 2009-07-14 06:45 - 00025120 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-03-31 07:17 - 2009-07-14 06:45 - 00025120 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-03-31 07:14 - 2011-02-11 10:21 - 00699682 _____ () C:\Windows\system32\perfh007.dat 2014-03-31 07:14 - 2011-02-11 10:21 - 00149790 _____ () C:\Windows\system32\perfc007.dat 2014-03-31 07:14 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-03-31 07:13 - 2011-12-29 23:07 - 01810542 _____ () C:\Windows\WindowsUpdate.log 2014-03-31 07:10 - 2012-08-03 14:06 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update 2014-03-31 07:09 - 2014-02-18 23:27 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-03-31 07:09 - 2013-03-05 00:26 - 00042118 _____ () C:\Windows\setupact.log 2014-03-31 07:09 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-03-31 02:52 - 2014-02-18 23:27 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-03-31 02:52 - 2014-01-15 18:05 - 00003930 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{B1B18CB8-D77A-448C-A166-A9D9BB773F17} 2014-03-31 01:37 - 2014-03-31 01:37 - 00002705 _____ () C:\Users\Gert\Desktop\JRT.txt 2014-03-31 00:00 - 2014-03-31 00:00 - 00000000 ____D () C:\Windows\ERUNT 2014-03-30 23:56 - 2014-03-30 23:56 - 01038974 _____ (Thisisu) C:\Users\Gert\Desktop\JRT.exe 2014-03-30 23:56 - 2014-03-30 22:24 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-03-30 23:55 - 2014-03-30 23:55 - 00016381 _____ () C:\Users\Gert\Desktop\download-junkware_removal_tool.htm 2014-03-30 23:50 - 2009-07-14 04:34 - 00000555 _____ () C:\Windows\win.ini 2014-03-30 23:47 - 2013-05-17 05:44 - 00359374 _____ () C:\Windows\PFRO.log 2014-03-30 23:37 - 2014-03-30 23:37 - 01950720 _____ () C:\Users\Gert\Downloads\adwcleaner (1).exe 2014-03-30 23:27 - 2014-03-30 23:27 - 00013168 _____ () C:\Users\Gert\Desktop\mbam.txt 2014-03-30 22:52 - 2014-03-30 22:52 - 01950720 _____ () C:\Users\Gert\Downloads\adwcleaner.exe 2014-03-30 22:24 - 2014-03-30 22:24 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware2 2014-03-30 22:24 - 2014-03-23 18:37 - 00001120 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-03-30 22:24 - 2014-03-23 18:37 - 00000000 ____D () C:\Users\Gert\AppData\Roaming\Malwarebytes 2014-03-30 22:24 - 2014-03-23 18:37 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-03-30 22:16 - 2014-03-30 22:16 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr 2014-03-30 22:16 - 2013-12-26 11:40 - 00084816 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys 2014-03-30 22:16 - 2013-03-05 00:34 - 00208928 _____ () C:\Windows\system32\Drivers\aswVmm.sys 2014-03-30 22:16 - 2013-03-05 00:34 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys 2014-03-30 22:16 - 2012-04-04 00:00 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys 2014-03-30 22:16 - 2012-04-04 00:00 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys 2014-03-30 22:16 - 2012-04-04 00:00 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe 2014-03-30 22:16 - 2012-04-04 00:00 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys 2014-03-30 22:16 - 2012-04-04 00:00 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys 2014-03-30 22:16 - 2012-04-04 00:00 - 00001973 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk 2014-03-30 19:54 - 2014-02-17 20:54 - 00000000 ____D () C:\Users\Gert\AppData\Roaming\FileAdvisor 2014-03-30 19:54 - 2014-02-14 20:54 - 00000000 ____D () C:\Program Files (x86)\File Type Advisor 2014-03-30 16:47 - 2014-02-18 23:27 - 00004102 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2014-03-30 16:47 - 2014-02-18 23:27 - 00003850 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2014-03-28 07:25 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache 2014-03-27 20:30 - 2014-03-27 19:59 - 00000000 ____D () C:\ComboFix 2014-03-27 20:29 - 2014-03-27 20:29 - 00019453 _____ () C:\ComboFix.txt 2014-03-27 20:29 - 2014-03-27 19:56 - 00000000 ____D () C:\Qoobox 2014-03-27 20:29 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default 2014-03-27 20:26 - 2014-03-27 19:56 - 00000000 ____D () C:\Windows\erdnt 2014-03-27 20:25 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini 2014-03-27 19:58 - 2014-03-27 19:58 - 00001156 _____ () C:\Users\Gert\Desktop\ComboFix - Verknüpfung.lnk 2014-03-27 19:53 - 2014-03-27 19:52 - 00037542 _____ () C:\Users\Gert\Downloads\Addition.txt 2014-03-27 19:51 - 2014-03-27 19:51 - 02157056 _____ (Farbar) C:\Users\Gert\Downloads\FRST64.exe 2014-03-27 19:33 - 2014-03-27 19:33 - 00001275 _____ () C:\Users\Gert\Desktop\Revo Uninstaller.lnk 2014-03-27 19:33 - 2014-03-27 19:33 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group 2014-03-27 19:27 - 2014-03-27 19:27 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Gert\Downloads\revosetup95.exe 2014-03-27 19:23 - 2014-03-27 19:23 - 05192353 ____R (Swearware) C:\Users\Gert\Downloads\ComboFix.exe 2014-03-25 08:15 - 2014-03-24 21:09 - 00017604 _____ () C:\Users\Gert\Desktop\Theodor.odt 2014-03-23 23:27 - 2014-01-11 20:01 - 00001293 _____ () C:\Users\Public\Desktop\Panda Cloud Cleaner.lnk 2014-03-23 18:42 - 2014-03-23 18:42 - 00000000 ____D () C:\Users\Gert\AppData\Roaming\SUPERAntiSpyware.com 2014-03-23 18:42 - 2014-03-23 18:41 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware 2014-03-23 18:41 - 2014-03-23 18:41 - 00001815 _____ () C:\Users\Public\Desktop\SUPERAntiSpyware Professional.lnk 2014-03-23 18:41 - 2014-03-23 18:41 - 00000000 ____D () C:\ProgramData\SUPERAntiSpyware.com 2014-03-23 17:11 - 2012-12-18 20:46 - 00000000 ____D () C:\Users\Gert\Desktop\ebay 2014-03-22 15:19 - 2014-03-22 15:19 - 00000000 ____D () C:\Windows\pss 2014-03-20 20:47 - 2014-03-18 17:10 - 00018348 _____ () C:\Users\Gert\Desktop\chemie-essigsäure.odt 2014-03-20 17:57 - 2013-07-14 12:44 - 00000000 ____D () C:\Windows\system32\MRT 2014-03-20 17:53 - 2012-06-09 16:46 - 90015360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-03-18 23:01 - 2014-03-17 20:42 - 00012668 _____ () C:\Users\Gert\Desktop\Französisch Vokabelliste.odt 2014-03-18 18:29 - 2014-03-18 17:58 - 00301498 _____ () C:\Users\Gert\Desktop\Chemie 2.odp 2014-03-17 22:21 - 2013-10-14 19:19 - 00000000 ____D () C:\Users\Gert\Documents\BStappen20October2013 2014-03-17 19:25 - 2013-03-05 00:26 - 00303496 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-03-17 19:23 - 2013-03-14 00:00 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2014-03-17 19:23 - 2013-03-14 00:00 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight 2014-03-12 16:28 - 2012-10-21 19:17 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-03-12 01:22 - 2012-09-25 22:01 - 00000998 _____ () C:\Users\Public\Desktop\CCleaner.lnk 2014-03-11 22:43 - 2014-03-11 22:38 - 00000000 ____D () C:\Users\Gert\Desktop\ingap 2014-03-11 22:41 - 2014-03-11 22:37 - 00000000 ____D () C:\Users\Gert\Desktop\ole 2014-03-11 19:53 - 2012-06-09 20:30 - 00000000 ____D () C:\Program Files\CCleaner 2014-03-11 19:39 - 2012-10-21 19:17 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-03-11 19:39 - 2012-10-21 19:17 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-03-11 19:39 - 2012-10-21 19:17 - 00003824 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-03-10 18:41 - 2009-07-14 07:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-03-07 17:29 - 2013-05-24 19:47 - 00000000 ___RD () C:\Program Files (x86)\Skype 2014-03-07 17:28 - 2011-08-08 11:06 - 00000000 ____D () C:\ProgramData\Skype 2014-03-05 09:26 - 2014-03-30 22:24 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-03-05 09:26 - 2014-03-30 22:24 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-03-05 09:26 - 2014-03-23 18:37 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-03-01 08:05 - 2014-03-13 17:36 - 23133696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-03-01 07:17 - 2014-03-13 17:36 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-03-01 07:16 - 2014-03-13 17:36 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-03-01 06:58 - 2014-03-13 17:36 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-03-01 06:52 - 2014-03-13 17:36 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-03-01 06:51 - 2014-03-13 17:36 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-03-01 06:42 - 2014-03-13 17:36 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-03-01 06:40 - 2014-03-13 17:36 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-03-01 06:37 - 2014-03-13 17:36 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-03-01 06:33 - 2014-03-13 17:36 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-03-01 06:33 - 2014-03-13 17:36 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-03-01 06:32 - 2014-03-13 17:36 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-03-01 06:30 - 2014-03-13 17:36 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-03-01 06:23 - 2014-03-13 17:36 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-03-01 06:17 - 2014-03-13 17:36 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-03-01 06:11 - 2014-03-13 17:36 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-03-01 06:02 - 2014-03-13 17:36 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-03-01 05:54 - 2014-03-13 17:36 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-03-01 05:52 - 2014-03-13 17:36 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-03-01 05:51 - 2014-03-13 17:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-03-01 05:47 - 2014-03-13 17:36 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-03-01 05:43 - 2014-03-13 17:36 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-03-01 05:43 - 2014-03-13 17:36 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-03-01 05:42 - 2014-03-13 17:36 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-03-01 05:40 - 2014-03-13 17:36 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-03-01 05:38 - 2014-03-13 17:36 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-03-01 05:37 - 2014-03-13 17:36 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-03-01 05:35 - 2014-03-13 17:36 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-03-01 05:18 - 2014-03-13 17:36 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-03-01 05:16 - 2014-03-13 17:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-03-01 05:14 - 2014-03-13 17:36 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-03-01 05:10 - 2014-03-13 17:36 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-03-01 05:03 - 2014-03-13 17:36 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-03-01 05:00 - 2014-03-13 17:36 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-03-01 04:57 - 2014-03-13 17:36 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-03-01 04:38 - 2014-03-13 17:36 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-03-01 04:32 - 2014-03-13 17:36 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-03-01 04:27 - 2014-03-13 17:36 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-03-01 04:25 - 2014-03-13 17:36 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-03-01 04:25 - 2014-03-13 17:36 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll Some content of TEMP: ==================== C:\Users\Gert\AppData\Local\Temp\Quarantine.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-03-25 18:25 ==================== End Of Log ============================ Geändert von Biene66 (31.03.2014 um 06:52 Uhr) |
31.03.2014, 13:31 | #8 |
/// the machine /// TB-Ausbilder | Computer, windows 7, wurde langsammer, malwarebytes findet SchädlingeESET Online Scanner
Downloade Dir bitte SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
01.04.2014, 05:12 | #9 |
| Computer, windows 7, wurde langsammer, malwarebytes findet Schädlinge ESETS hat 3,5 Stunden gedauert. Code:
ATTFilter ESETSmartInstaller@High as downloader log: all ok ESETSmartInstaller@High as downloader log: all ok # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6920 # api_version=3.0.2 # EOSSerial=906af424be98cb45927ae5d0b5a56ff1 # engine=17694 # end=stopped # remove_checked=false # archives_checked=true # unwanted_checked=false # unsafe_checked=false # antistealth_checked=true # utc_time=2014-03-31 06:05:35 # local_time=2014-03-31 08:05:35 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=774 16777213 85 76 74805 78591 0 0 # compatibility_mode=5893 16776573 100 94 0 147918985 0 0 # scanned=26581 # found=0 # cleaned=0 # scan_time=1897 ESETSmartInstaller@High as downloader log: all ok # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6920 # api_version=3.0.2 # EOSSerial=906af424be98cb45927ae5d0b5a56ff1 # engine=17697 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=false # unsafe_checked=false # antistealth_checked=true # utc_time=2014-03-31 11:21:16 # local_time=2014-04-01 01:21:16 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=774 16777213 85 76 93746 97532 0 0 # compatibility_mode=5893 16776573 100 94 0 147937926 0 0 # scanned=261585 # found=0 # cleaned=0 # scan_time=13171 Code:
ATTFilter Results of screen317's Security Check version 0.99.80 Windows 7 Service Pack 1 x64 (UAC is disabled!) Internet Explorer 11 ``````````````Antivirus/Firewall Check:`````````````` avast! Antivirus Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` Panda Cloud Cleaner Adobe Flash Player 11.9.900.170 Flash Player out of Date! Adobe Reader 10.1.9 Adobe Reader out of Date! Google Chrome 33.0.1750.146 Google Chrome 33.0.1750.154 ````````Process Check: objlist.exe by Laurent```````` `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014 Ran by Gert (administrator) on GERT-TOSH on 01-04-2014 06:28:58 Running from C:\Users\Gert\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\438A5WQC Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (AMD) C:\Windows\system32\atiesrxx.exe (AMD) C:\Windows\system32\atieclxx.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe () C:\Windows\System32\GFNEXSrv.exe (SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE (AOL LLC) C:\Program Files (x86)\Common Files\AOL\ACS\AOLAcsd.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe (Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe () C:\Users\Gert\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Protexis Inc.) c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe (TOSHIBA Corporation) C:\Windows\system32\TODDSrv.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe (TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe (TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe (TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe (TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe (Nero AG) c:\Program Files (x86)\Nero\Update\NASvc.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [TosReelTimeMonitor] - C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe [38304 2010-12-14] (TOSHIBA Corporation) HKLM\...\Run: [Toshiba TEMPRO] - C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe [1546720 2011-02-10] (Toshiba Europe GmbH) HKLM\...\Run: [TPwrMain] - C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [566696 2011-03-02] (TOSHIBA Corporation) HKLM\...\Run: [TCrdMain] - C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [973176 2010-12-15] (TOSHIBA Corporation) HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2186856 2011-01-10] (Realtek Semiconductor) HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2679592 2011-02-03] (Synaptics Incorporated) HKLM\...\Run: [TosSENotify] - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [710040 2010-12-08] (TOSHIBA Corporation) HKLM\...\Run: [TosVolRegulator] - C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation) HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-06] (Apple Inc.) HKLM-x32\...\Run: [] - [X] HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3854640 2014-03-30] (AVAST Software) HKU\.DEFAULT\...\Run: [TOPI.EXE] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe [846936 2011-05-16] (TOSHIBA) Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe) Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=TEUA&bmod=TEUA StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) BHO-x32: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files (x86)\AOL\AOL Toolbar 4.0\aoltb.dll (AOL LLC) BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) BHO-x32: PAYBACK Toolbar Browserhilfsobjekt - {E141F5C3-2619-4996-8AF8-AA0A9439D986} - C:\Program Files (x86)\Payback\PAYBACK Toolbar\PaybackToolbar.dll (PAYBACK GmbH) Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) Toolbar: HKLM-x32 - AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files (x86)\AOL\AOL Toolbar 4.0\aoltb.dll (AOL LLC) Toolbar: HKLM-x32 - PAYBACK Toolbar - {9613CB43-EA4C-48b5-878D-13DFE1818EFE} - C:\Program Files (x86)\Payback\PAYBACK Toolbar\PaybackToolbar.dll (PAYBACK GmbH) Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) Toolbar: HKCU - No Name - {9613CB43-EA4C-48B5-878D-13DFE1818EFE} - No File DPF: HKLM-x32 {1B00725B-C455-4DE6-BFB6-AD540AD427CD} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab DPF: HKLM-x32 {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} hxxp://quickscan.bitdefender.com/qsax/qsax.cab Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 Chrome: ======= CHR Extension: (Google Docs) - C:\Users\Gert\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-01-17] CHR Extension: (Google Drive) - C:\Users\Gert\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-01-17] CHR Extension: (YouTube) - C:\Users\Gert\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-01-17] CHR Extension: (Google-Suche) - C:\Users\Gert\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-01-17] CHR Extension: (Google Wallet) - C:\Users\Gert\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-01-17] CHR Extension: (Google Mail) - C:\Users\Gert\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-01-17] CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-03-30] ==================== Services (Whitelisted) ================= R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [144152 2013-10-11] (SUPERAntiSpyware.com) R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-03-30] (AVAST Software) S3 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [227904 2013-12-17] (WildTangent) R2 GFNEXSrv; C:\Windows\System32\GFNEXSrv.exe [162824 2010-09-09] () R2 KSS; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe [202328 2012-12-07] (Kaspersky Lab ZAO) S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware2\mbamscheduler.exe [1809720 2014-03-05] (Malwarebytes Corporation) S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware2\mbamservice.exe [857912 2014-03-05] (Malwarebytes Corporation) S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [112080 2011-02-10] (Toshiba Europe GmbH) ==================== Drivers (Whitelisted) ==================== U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-03-30] (AVAST Software) R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-03-30] (AVAST Software) R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-03-30] () R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-03-30] (AVAST Software) R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-03-30] (AVAST Software) R3 aswStm; C:\Windows\system32\drivers\aswStm.sys [84816 2014-03-30] (AVAST Software) R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-12-19] (AVAST Software) R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208928 2014-03-30] () S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-03-05] (Malwarebytes Corporation) S3 PSKMAD; C:\Windows\System32\DRIVERS\PSKMAD.sys [47632 2013-04-29] (Panda Security, S.L.) R3 RTWlanE; C:\Windows\System32\DRIVERS\rtwlane.sys [1514568 2013-05-02] (Realtek Semiconductor Corporation ) R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com) R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com) R2 sp_rsdrv2; C:\Windows\System32\DRIVERS\stflt.sys [51496 2013-12-04] (Windows (R) Win 7 DDK provider) S3 catchme; \??\C:\ComboFix\catchme.sys [X] S3 TDEIO; \??\c:\Windows\SysWOW64\sysprep\Bootprio\tdeio64.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-03-31 22:05 - 2014-03-31 22:06 - 00987442 _____ () C:\Users\Gert\Desktop\SecurityCheck.exe 2014-03-31 21:40 - 2014-03-31 21:40 - 02347384 _____ (ESET) C:\Users\Gert\Downloads\esetsmartinstaller_enu.exe 2014-03-31 07:47 - 2014-03-31 07:48 - 02157056 _____ (Farbar) C:\Users\Gert\Downloads\FRST64 (1).exe 2014-03-31 01:37 - 2014-03-31 01:37 - 00002705 _____ () C:\Users\Gert\Desktop\JRT.txt 2014-03-31 00:00 - 2014-03-31 00:00 - 00000000 ____D () C:\Windows\ERUNT 2014-03-30 23:56 - 2014-03-30 23:56 - 01038974 _____ (Thisisu) C:\Users\Gert\Desktop\JRT.exe 2014-03-30 23:55 - 2014-03-30 23:55 - 00016381 _____ () C:\Users\Gert\Desktop\download-junkware_removal_tool.htm 2014-03-30 23:37 - 2014-03-30 23:37 - 01950720 _____ () C:\Users\Gert\Downloads\adwcleaner (1).exe 2014-03-30 23:27 - 2014-03-30 23:27 - 00013168 _____ () C:\Users\Gert\Desktop\mbam.txt 2014-03-30 22:52 - 2014-03-30 22:52 - 01950720 _____ () C:\Users\Gert\Downloads\adwcleaner.exe 2014-03-30 22:24 - 2014-03-31 20:21 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-03-30 22:24 - 2014-03-30 22:24 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware2 2014-03-30 22:24 - 2014-03-05 09:26 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-03-30 22:24 - 2014-03-05 09:26 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-03-30 22:16 - 2014-03-30 22:16 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr 2014-03-27 20:29 - 2014-03-27 20:29 - 00019453 _____ () C:\ComboFix.txt 2014-03-27 19:59 - 2014-03-27 20:30 - 00000000 ____D () C:\ComboFix 2014-03-27 19:58 - 2014-03-27 19:58 - 00001156 _____ () C:\Users\Gert\Desktop\ComboFix - Verknüpfung.lnk 2014-03-27 19:57 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe 2014-03-27 19:57 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe 2014-03-27 19:57 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2014-03-27 19:57 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2014-03-27 19:57 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2014-03-27 19:57 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe 2014-03-27 19:57 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe 2014-03-27 19:57 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe 2014-03-27 19:56 - 2014-03-27 20:29 - 00000000 ____D () C:\Qoobox 2014-03-27 19:56 - 2014-03-27 20:26 - 00000000 ____D () C:\Windows\erdnt 2014-03-27 19:52 - 2014-03-27 19:53 - 00037542 _____ () C:\Users\Gert\Downloads\Addition.txt 2014-03-27 19:51 - 2014-03-31 07:49 - 00037176 _____ () C:\Users\Gert\Downloads\FRST.txt 2014-03-27 19:51 - 2014-03-27 19:51 - 02157056 _____ (Farbar) C:\Users\Gert\Downloads\FRST64.exe 2014-03-27 19:33 - 2014-03-27 19:33 - 00001275 _____ () C:\Users\Gert\Desktop\Revo Uninstaller.lnk 2014-03-27 19:33 - 2014-03-27 19:33 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group 2014-03-27 19:27 - 2014-03-27 19:27 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Gert\Downloads\revosetup95.exe 2014-03-27 19:23 - 2014-03-27 19:23 - 05192353 ____R (Swearware) C:\Users\Gert\Downloads\ComboFix.exe 2014-03-24 21:09 - 2014-03-25 08:15 - 00017604 _____ () C:\Users\Gert\Desktop\Theodor.odt 2014-03-23 19:43 - 2014-04-01 06:28 - 00000000 ____D () C:\FRST 2014-03-23 18:42 - 2014-03-23 18:42 - 00000000 ____D () C:\Users\Gert\AppData\Roaming\SUPERAntiSpyware.com 2014-03-23 18:41 - 2014-03-23 18:42 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware 2014-03-23 18:41 - 2014-03-23 18:41 - 00001815 _____ () C:\Users\Public\Desktop\SUPERAntiSpyware Professional.lnk 2014-03-23 18:41 - 2014-03-23 18:41 - 00000000 ____D () C:\ProgramData\SUPERAntiSpyware.com 2014-03-23 18:37 - 2014-03-30 22:24 - 00001120 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-03-23 18:37 - 2014-03-30 22:24 - 00000000 ____D () C:\Users\Gert\AppData\Roaming\Malwarebytes 2014-03-23 18:37 - 2014-03-30 22:24 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-03-23 18:37 - 2014-03-05 09:26 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-03-22 15:19 - 2014-03-22 15:19 - 00000000 ____D () C:\Windows\pss 2014-03-18 17:58 - 2014-03-18 18:29 - 00301498 _____ () C:\Users\Gert\Desktop\Chemie 2.odp 2014-03-18 17:10 - 2014-03-20 20:47 - 00018348 _____ () C:\Users\Gert\Desktop\chemie-essigsäure.odt 2014-03-17 20:42 - 2014-03-18 23:01 - 00012668 _____ () C:\Users\Gert\Desktop\Französisch Vokabelliste.odt 2014-03-13 17:36 - 2014-03-01 08:05 - 23133696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-03-13 17:36 - 2014-03-01 07:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-03-13 17:36 - 2014-03-01 07:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-03-13 17:36 - 2014-03-01 06:58 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-03-13 17:36 - 2014-03-01 06:52 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-03-13 17:36 - 2014-03-01 06:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-03-13 17:36 - 2014-03-01 06:42 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-03-13 17:36 - 2014-03-01 06:40 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-03-13 17:36 - 2014-03-01 06:37 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-03-13 17:36 - 2014-03-01 06:33 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-03-13 17:36 - 2014-03-01 06:33 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-03-13 17:36 - 2014-03-01 06:32 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-03-13 17:36 - 2014-03-01 06:30 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-03-13 17:36 - 2014-03-01 06:23 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-03-13 17:36 - 2014-03-01 06:17 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-03-13 17:36 - 2014-03-01 06:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-03-13 17:36 - 2014-03-01 06:02 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-03-13 17:36 - 2014-03-01 05:54 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-03-13 17:36 - 2014-03-01 05:52 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-03-13 17:36 - 2014-03-01 05:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-03-13 17:36 - 2014-03-01 05:47 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-03-13 17:36 - 2014-03-01 05:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-03-13 17:36 - 2014-03-01 05:43 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-03-13 17:36 - 2014-03-01 05:42 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-03-13 17:36 - 2014-03-01 05:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-03-13 17:36 - 2014-03-01 05:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-03-13 17:36 - 2014-03-01 05:37 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-03-13 17:36 - 2014-03-01 05:35 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-03-13 17:36 - 2014-03-01 05:18 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-03-13 17:36 - 2014-03-01 05:16 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-03-13 17:36 - 2014-03-01 05:14 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-03-13 17:36 - 2014-03-01 05:10 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-03-13 17:36 - 2014-03-01 05:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-03-13 17:36 - 2014-03-01 05:00 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-03-13 17:36 - 2014-03-01 04:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-03-13 17:36 - 2014-03-01 04:38 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-03-13 17:36 - 2014-03-01 04:32 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-03-13 17:36 - 2014-03-01 04:27 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-03-13 17:36 - 2014-03-01 04:25 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-03-13 17:36 - 2014-03-01 04:25 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-03-13 17:36 - 2014-02-07 03:23 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-03-13 17:36 - 2014-01-29 04:32 - 00484864 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll 2014-03-13 17:36 - 2014-01-29 04:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll 2014-03-13 17:36 - 2014-01-28 04:32 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll 2014-03-13 17:33 - 2014-02-04 04:32 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2014-03-13 17:33 - 2014-02-04 04:32 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll 2014-03-13 17:33 - 2014-02-04 04:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll 2014-03-13 17:33 - 2014-02-04 04:04 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll 2014-03-11 22:38 - 2014-03-11 22:43 - 00000000 ____D () C:\Users\Gert\Desktop\ingap 2014-03-11 22:37 - 2014-03-11 22:41 - 00000000 ____D () C:\Users\Gert\Desktop\ole ==================== One Month Modified Files and Folders ======= 2014-04-01 06:28 - 2014-03-23 19:43 - 00000000 ____D () C:\FRST 2014-04-01 06:15 - 2013-04-28 00:46 - 00000000 ____D () C:\Program Files (x86)\ESET 2014-04-01 06:14 - 2013-12-06 09:43 - 00000000 ____D () C:\AdwCleaner 2014-04-01 05:52 - 2014-02-18 23:27 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-04-01 04:55 - 2014-01-15 18:05 - 00003930 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{B1B18CB8-D77A-448C-A166-A9D9BB773F17} 2014-04-01 03:03 - 2011-12-29 23:07 - 01832857 _____ () C:\Windows\WindowsUpdate.log 2014-04-01 01:50 - 2009-07-14 06:45 - 00025120 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-04-01 01:50 - 2009-07-14 06:45 - 00025120 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-03-31 22:06 - 2014-03-31 22:05 - 00987442 _____ () C:\Users\Gert\Desktop\SecurityCheck.exe 2014-03-31 21:40 - 2014-03-31 21:40 - 02347384 _____ (ESET) C:\Users\Gert\Downloads\esetsmartinstaller_enu.exe 2014-03-31 21:39 - 2011-02-11 10:21 - 00699682 _____ () C:\Windows\system32\perfh007.dat 2014-03-31 21:39 - 2011-02-11 10:21 - 00149790 _____ () C:\Windows\system32\perfc007.dat 2014-03-31 21:39 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-03-31 20:21 - 2014-03-30 22:24 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-03-31 16:52 - 2014-02-18 23:27 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-03-31 16:27 - 2013-03-05 00:26 - 00042174 _____ () C:\Windows\setupact.log 2014-03-31 16:27 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-03-31 07:49 - 2014-03-27 19:51 - 00037176 _____ () C:\Users\Gert\Downloads\FRST.txt 2014-03-31 07:48 - 2014-03-31 07:47 - 02157056 _____ (Farbar) C:\Users\Gert\Downloads\FRST64 (1).exe 2014-03-31 07:10 - 2012-08-03 14:06 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update 2014-03-31 01:37 - 2014-03-31 01:37 - 00002705 _____ () C:\Users\Gert\Desktop\JRT.txt 2014-03-31 00:00 - 2014-03-31 00:00 - 00000000 ____D () C:\Windows\ERUNT 2014-03-30 23:56 - 2014-03-30 23:56 - 01038974 _____ (Thisisu) C:\Users\Gert\Desktop\JRT.exe 2014-03-30 23:55 - 2014-03-30 23:55 - 00016381 _____ () C:\Users\Gert\Desktop\download-junkware_removal_tool.htm 2014-03-30 23:50 - 2009-07-14 04:34 - 00000555 _____ () C:\Windows\win.ini 2014-03-30 23:47 - 2013-05-17 05:44 - 00359374 _____ () C:\Windows\PFRO.log 2014-03-30 23:37 - 2014-03-30 23:37 - 01950720 _____ () C:\Users\Gert\Downloads\adwcleaner (1).exe 2014-03-30 23:27 - 2014-03-30 23:27 - 00013168 _____ () C:\Users\Gert\Desktop\mbam.txt 2014-03-30 22:52 - 2014-03-30 22:52 - 01950720 _____ () C:\Users\Gert\Downloads\adwcleaner.exe 2014-03-30 22:24 - 2014-03-30 22:24 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware2 2014-03-30 22:24 - 2014-03-23 18:37 - 00001120 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-03-30 22:24 - 2014-03-23 18:37 - 00000000 ____D () C:\Users\Gert\AppData\Roaming\Malwarebytes 2014-03-30 22:24 - 2014-03-23 18:37 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-03-30 22:16 - 2014-03-30 22:16 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr 2014-03-30 22:16 - 2013-12-26 11:40 - 00084816 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys 2014-03-30 22:16 - 2013-03-05 00:34 - 00208928 _____ () C:\Windows\system32\Drivers\aswVmm.sys 2014-03-30 22:16 - 2013-03-05 00:34 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys 2014-03-30 22:16 - 2012-04-04 00:00 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys 2014-03-30 22:16 - 2012-04-04 00:00 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys 2014-03-30 22:16 - 2012-04-04 00:00 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe 2014-03-30 22:16 - 2012-04-04 00:00 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys 2014-03-30 22:16 - 2012-04-04 00:00 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys 2014-03-30 22:16 - 2012-04-04 00:00 - 00001973 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk 2014-03-30 19:54 - 2014-02-17 20:54 - 00000000 ____D () C:\Users\Gert\AppData\Roaming\FileAdvisor 2014-03-30 19:54 - 2014-02-14 20:54 - 00000000 ____D () C:\Program Files (x86)\File Type Advisor 2014-03-30 16:47 - 2014-02-18 23:27 - 00004102 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2014-03-30 16:47 - 2014-02-18 23:27 - 00003850 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2014-03-28 07:25 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache 2014-03-27 20:30 - 2014-03-27 19:59 - 00000000 ____D () C:\ComboFix 2014-03-27 20:29 - 2014-03-27 20:29 - 00019453 _____ () C:\ComboFix.txt 2014-03-27 20:29 - 2014-03-27 19:56 - 00000000 ____D () C:\Qoobox 2014-03-27 20:29 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default 2014-03-27 20:26 - 2014-03-27 19:56 - 00000000 ____D () C:\Windows\erdnt 2014-03-27 20:25 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini 2014-03-27 19:58 - 2014-03-27 19:58 - 00001156 _____ () C:\Users\Gert\Desktop\ComboFix - Verknüpfung.lnk 2014-03-27 19:53 - 2014-03-27 19:52 - 00037542 _____ () C:\Users\Gert\Downloads\Addition.txt 2014-03-27 19:51 - 2014-03-27 19:51 - 02157056 _____ (Farbar) C:\Users\Gert\Downloads\FRST64.exe 2014-03-27 19:33 - 2014-03-27 19:33 - 00001275 _____ () C:\Users\Gert\Desktop\Revo Uninstaller.lnk 2014-03-27 19:33 - 2014-03-27 19:33 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group 2014-03-27 19:27 - 2014-03-27 19:27 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Gert\Downloads\revosetup95.exe 2014-03-27 19:23 - 2014-03-27 19:23 - 05192353 ____R (Swearware) C:\Users\Gert\Downloads\ComboFix.exe 2014-03-25 08:15 - 2014-03-24 21:09 - 00017604 _____ () C:\Users\Gert\Desktop\Theodor.odt 2014-03-23 23:27 - 2014-01-11 20:01 - 00001293 _____ () C:\Users\Public\Desktop\Panda Cloud Cleaner.lnk 2014-03-23 18:42 - 2014-03-23 18:42 - 00000000 ____D () C:\Users\Gert\AppData\Roaming\SUPERAntiSpyware.com 2014-03-23 18:42 - 2014-03-23 18:41 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware 2014-03-23 18:41 - 2014-03-23 18:41 - 00001815 _____ () C:\Users\Public\Desktop\SUPERAntiSpyware Professional.lnk 2014-03-23 18:41 - 2014-03-23 18:41 - 00000000 ____D () C:\ProgramData\SUPERAntiSpyware.com 2014-03-23 17:11 - 2012-12-18 20:46 - 00000000 ____D () C:\Users\Gert\Desktop\ebay 2014-03-22 15:19 - 2014-03-22 15:19 - 00000000 ____D () C:\Windows\pss 2014-03-20 20:47 - 2014-03-18 17:10 - 00018348 _____ () C:\Users\Gert\Desktop\chemie-essigsäure.odt 2014-03-20 17:57 - 2013-07-14 12:44 - 00000000 ____D () C:\Windows\system32\MRT 2014-03-20 17:53 - 2012-06-09 16:46 - 90015360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-03-18 23:01 - 2014-03-17 20:42 - 00012668 _____ () C:\Users\Gert\Desktop\Französisch Vokabelliste.odt 2014-03-18 18:29 - 2014-03-18 17:58 - 00301498 _____ () C:\Users\Gert\Desktop\Chemie 2.odp 2014-03-17 22:21 - 2013-10-14 19:19 - 00000000 ____D () C:\Users\Gert\Documents\BStappen20October2013 2014-03-17 19:25 - 2013-03-05 00:26 - 00303496 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-03-17 19:23 - 2013-03-14 00:00 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2014-03-17 19:23 - 2013-03-14 00:00 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight 2014-03-12 16:28 - 2012-10-21 19:17 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-03-12 01:22 - 2012-09-25 22:01 - 00000998 _____ () C:\Users\Public\Desktop\CCleaner.lnk 2014-03-11 22:43 - 2014-03-11 22:38 - 00000000 ____D () C:\Users\Gert\Desktop\ingap 2014-03-11 22:41 - 2014-03-11 22:37 - 00000000 ____D () C:\Users\Gert\Desktop\ole 2014-03-11 19:53 - 2012-06-09 20:30 - 00000000 ____D () C:\Program Files\CCleaner 2014-03-11 19:39 - 2012-10-21 19:17 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-03-11 19:39 - 2012-10-21 19:17 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-03-11 19:39 - 2012-10-21 19:17 - 00003824 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-03-10 18:41 - 2009-07-14 07:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-03-07 17:29 - 2013-05-24 19:47 - 00000000 ___RD () C:\Program Files (x86)\Skype 2014-03-07 17:28 - 2011-08-08 11:06 - 00000000 ____D () C:\ProgramData\Skype 2014-03-05 09:26 - 2014-03-30 22:24 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-03-05 09:26 - 2014-03-30 22:24 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-03-05 09:26 - 2014-03-23 18:37 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys Some content of TEMP: ==================== C:\Users\Gert\AppData\Local\Temp\Quarantine.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-04-01 01:42 ==================== End Of Log ============================ --- --- --- Grüße Biene Geändert von Biene66 (01.04.2014 um 05:32 Uhr) |
01.04.2014, 13:26 | #10 |
/// the machine /// TB-Ausbilder | Computer, windows 7, wurde langsammer, malwarebytes findet Schädlinge Flash und Adobe updaten. Fertig Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
05.04.2014, 21:51 | #11 |
| Computer, windows 7, wurde langsammer, malwarebytes findet Schädlinge Hallo Schrauber. Ich habe soweit alles abgearbeitet. Erst einmal mega vielen Dank, dass Du mich bis hierher begleitet hast. Ich schreibe Dir einmal auf, was ich gemacht habe und wo ich noch nicht so genau weiß, ob ich alles richtig gemacht habe: Windows update habe ich aktiviert. PSI habe ich installiert. PSI startet mit dem Rechner und ich habe das Gefühl, dass das starten dadurch langsamer wird. Ich habe meine zu vielen Virenprogramme deinstalliert und nun läuft noch AVASt und malwarebytes. Malewarebytes startet mit dem Rechner und läuft im Hintergrund. Ist das gut? Winpatrol habe ich mir installiert, aber irgendwie weiß ich noch nicht, was ich damit machen soll. Es sieht so aus, dass es jetzt auch immer nebenbei läuft - so ein scotty whatchdog? Der poppt jetzt dauernd auf, wenn ich irgendetwas tue und fragt nach. Du schreibst "Halte dich fern von jedlichen Registry Cleanern. " Ich habe ja den CC cleaner. Meinst du den? Damit reinige ich immer Cache und temp und so. Ist das nicht gut? zum sicheren browsen: SpywareBlaster habe ich installiert. WOT habe ich runtergeladen, aber es kann nicht installiert werden, weil da steht der Internet Explorer wäre nicht aktuell. Da steht für WOT benötigt man IE 6 oder höher. Bitte aktualisieren sie IE. Aber PSI hat kein fehlendes update festgestellt. Ich verstehe es irgendwie nicht. Wenn ich auf die Microsoft Seite gehe, steht da "Sie verwenden Internet Explorer 11 für Windows 7" und unter Extras vom IE habe ich die automatischen updates aktiviert. Müsste doch aktuell sein? Jetzt habe ich nochmal neu gestartet und es kommt die gleiche Meldung. Wenn ich aber ins Internet gehe mit IE, dann ist oben links in der Leiste ein grünes Omit blauem Ausrufezeichen. Sieht aus, als wäre das WOT- also ist es installiert? Jetzt habe ich ja viele neue Programme installiert, die nebenbei laufen. Wird der Rechner dadurch noch langsamer? Außerdem läuft immer das Wartungscenter. Ist das gut? Viele Fragen. Sorry Grüße Biene Geändert von Biene66 (05.04.2014 um 22:49 Uhr) |
06.04.2014, 15:53 | #12 | ||||
/// the machine /// TB-Ausbilder | Computer, windows 7, wurde langsammer, malwarebytes findet SchädlingeZitat:
Zitat:
Zitat:
Zitat:
Das Wartungscenter muss ja laufen, oder was genau meinst Du. Zu WOT: Teste mal wie oben beschrieben den FileHippo Update Checker.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
18.04.2014, 22:15 | #13 |
| Computer, windows 7, wurde langsammer, malwarebytes findet Schädlinge HalloSchrauber, tut mir leid, bin zur Zeit auch nur unregelmäßig am Rechner. WOT will über den link irgendwie nicht. Da kommt immer die Meldung mein IE wäre alt. Aber ich habe IE geprüft und da steht es ist die aktuelle Version. Ich habe noch hier WOT zum runterladen gefunden, aber da wird es kritisch diskutiert, deshalb weiß ich jetzt nicht so genau, was ich machen soll: Bei heise online - Web of Trust (WOT) - Download Filehippo habe ich runtergeladen. Der findet vor allem Betaversionen. Winpatrol ist wohl im Hintergrund, aber jetzt bekomme ich gar keine Meldungen mehr - nichts poppt auf. Komisch? Aber ansonsten scheint alles gut zu sein. Du hast mir wirklich sehr geholfen und viel Zeit investiert. Vielen Dank. Grüße Biene |
19.04.2014, 12:34 | #14 |
/// the machine /// TB-Ausbilder | Computer, windows 7, wurde langsammer, malwarebytes findet Schädlinge WOT ist schon gut . Gern Geschehen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
Themen zu Computer, windows 7, wurde langsammer, malwarebytes findet Schädlinge |
administrator, anti-malware, appdata, autostart, avast, code, computer, dateien, detected, explorer, home, logfile, malwarebytes, microsoft, rechner, roaming, schädling, schädlinge, speicher, superantispyware, test, tools, toshiba, windows, windows 7 |