| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Win32:Dropper-LTG (Drp) - Noch da oder nicht?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
01.04.2014, 14:57
| #1 |
 |  Win32:Dropper-LTG (Drp) - Noch da oder nicht? Avast hat bei einem Systemcheck eine Bedrohung gefunden: Win32Dropper-LTG (Drp) Beim Versuch, die Datei zu löschen, kommt die Meldung "Fehler: Das S ystem kann den angegebenen Pfad nicht finden". Pfad: C:\Users\martin\Appdata\Local\Temp\avast_\...\1.exe Weitere Suchläufe sin dohne Ergebnis: "kein Virus gefunden". Die zuästzliche Überprüfung mit Malwarebytes und Ad-Aware zeigte auch keine Ergebnisse an. Jetzt bin ich etwas unsicher, ob dieser Dropper nun noch auf dem Rechner ist oder nicht. Vielleicht hat ja jemand schon das gleiche Problem gehabt und kann mir einen Tipp geben. Danke. enterprise |
|
01.04.2014, 15:10
| #2 |
| /// TB-Ausbilder   | Win32:Dropper-LTG (Drp) - Noch da oder nicht? Mein Name ist Matthias und ich werde dir bei der Bereinigung deines Computers helfen. Bitte beachte folgende Hinweise:
Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
|
|
01.04.2014, 16:53
| #3 |
| | Win32:Dropper-LTG (Drp) - Noch da oder nicht? Nachtrag, hier die addition.txt
__________________Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-03-2014
Ran by martin at 2014-04-01 18:00:42
Running from C:\Users\martin\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Out of date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
==================== Installed Programs ======================
Ad-Aware Antivirus (HKLM\...\{6A16ADA5-0B30-4893-84AB-961B1340D14A}_AdAwareUpdater) (Version: 11.1.5354.0 - Lavasoft)
Ad-Aware Security Add-on (HKLM-x32\...\adawaretb) (Version: 3.8.0.10 - Lavasoft)
AdAwareInstaller (Version: 11.1.5354.0 - Lavasoft) Hidden
AdAwareUpdater (Version: 11.1.5354.0 - Lavasoft) Hidden
AdblockIE (HKLM-x32\...\{5508128A-2C7B-46B5-81F9-58E8E8115F0B}) (Version: 1.2 - af0.net)
Adobe Flash Player 12 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 12.0.0.77 - Adobe Systems Incorporated)
Adobe Flash Player 12 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 12.0.0.77 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated)
AIS Connect (HKLM-x32\...\AIS Connect) (Version: 1.1.1.6 - Fujitsu Technology Solutions GmbH)
AIS Connect (x32 Version: 1.1.1.6 - Fujitsu Technology Solutions GmbH) Hidden
Amazon Kindle (HKCU\...\Amazon Kindle) (Version: - Amazon)
AntimalwareEngine (Version: 2.6.0.0 - Lavasoft) Hidden
Apple Application Support (HKLM-x32\...\{AAC5D43E-816D-4C2D-8E51-55FFF35BE301}) (Version: 3.0.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{787136D2-F0F8-4625-AA3F-72D7795AC842}) (Version: 7.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
avast! Free Antivirus (HKLM-x32\...\Avast) (Version: 9.0.2016 - Avast Software)
AVS Media Player 4.1.7.92 (HKLM-x32\...\AVS Media Player_is1) (Version: - Online Media Technologies Ltd.)
AVS Update Manager 1.0 (HKLM-x32\...\AVS Update Manager_is1) (Version: - Online Media Technologies Ltd.)
AVS Video Converter 8 (HKLM-x32\...\AVS4YOU Video Converter 7_is1) (Version: - Online Media Technologies Ltd.)
AVS4YOU Software Navigator 1.4 (HKLM-x32\...\AVS4YOU Software Navigator_is1) (Version: - Online Media Technologies Ltd.)
Biet-O-Matic v2.14.8 (HKLM-x32\...\Biet-O-Matic v2.14.8) (Version: Biet-O-Matic v2.14.8 - BOM Development Team)
Bluetooth Feature Pack 5.0 (HKLM\...\{B2F4C332-2359-4ADE-AF0C-C631768BBB89}) (Version: 5.0.14 - CSR Plc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 4.12 - Piriform)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{92C42EDD-6524-4577-B2EB-6C68C63B6D4A}) (Version: - Microsoft)
Dropbox (HKCU\...\Dropbox) (Version: 2.4.11 - Dropbox, Inc.)
eBay (HKLM-x32\...\{9983CD31-473F-4808-8317-5346119F0187}) (Version: 1.0.1 - eBay Inc.)
Feedback Tool (HKLM-x32\...\{90024193-9F13-4877-89D5-A1CDF0CBBF28}) (Version: 1.1.0 - Microsoft Corporation)
Fujitsu Display Manager (HKLM-x32\...\InstallShield_{4108974B-DE87-4AD4-9167-930C62C45691}) (Version: - )
Fujitsu Display Manager (Version: 7.01.00.210 - FUJITSU LIMITED) Hidden
Fujitsu Hotkey Utility (HKLM-x32\...\InstallShield_{BA0CC975-682B-4678-A35C-05E607F36387}) (Version: 3.60.1.0 - FUJITSU LIMITED)
Fujitsu Hotkey Utility (x32 Version: 3.60.1.0 - FUJITSU LIMITED) Hidden
Fujitsu MobilityCenter Extension Utility (HKLM-x32\...\InstallShield_{EC314CDF-3521-482B-A21C-65AC95664814}) (Version: - )
Fujitsu MobilityCenter Extension Utility (Version: 3.01.00.000 - Ihr Firmenname) Hidden
Fujitsu System Extension Utility (HKLM-x32\...\InstallShield_{E8A5B78F-4456-4511-AB3D-E7BFFB974A7A}) (Version: - )
Fujitsu System Extension Utility (Version: 3.1.1.0 - FUJITSU LIMITED) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 33.0.1750.154 - Google Inc.)
Google Update Helper (x32 Version: 1.3.23.9 - Google Inc.) Hidden
iCloud (HKLM\...\{81E20D41-C277-4526-934D-F2380AF91B78}) (Version: 3.1.0.40 - Apple Inc.)
Intel(R) Graphics Media Accelerator Driver (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2025 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation)
iTunes (HKLM\...\{B8BA155B-1E75-405F-9CB4-8A99615D09DC}) (Version: 11.1.5.5 - Apple Inc.)
Java 7 Update 51 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417051FF}) (Version: 7.0.510 - Oracle)
Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.510 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Junk Mail filter update (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Malwarebytes Anti-Malware Version 2.00.0.1000 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.00.0.1000 - Malwarebytes Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30320 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30320 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Extended DEU Language Pack) (Version: 4.0.30320 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30320 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Choice Guard (x32 Version: 2.0.48.0 - Microsoft Corporation) Hidden
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Klick-und-Los 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Starter 2010 - Deutsch (HKLM-x32\...\{90140011-0066-0407-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (HKLM\...\{8338783A-0968-3B85-AFC7-BAAE0A63DC50}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MobileMe Control Panel (HKLM\...\{41BC9E31-0D39-462E-8E4C-767B21A3B1C3}) (Version: 3.1.8.0 - Apple Inc.)
Mozilla Firefox 28.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 28.0 (x86 de)) (Version: 28.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 28.0 - Mozilla)
Mozilla Thunderbird 24.3.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 24.3.0 (x86 de)) (Version: 24.3.0 - Mozilla)
MSVCRT (x32 Version: 14.0.1468.721 - Microsoft) Hidden
MSXML (x32 Version: 1.00.0000 - Companion) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Paint Shop Pro 5.03 CD (HKLM-x32\...\Paint Shop Pro 5.03) (Version: - )
PaperPort (HKLM-x32\...\{DF4C31CF-0EED-4680-873F-F6AD64E21B46}) (Version: 9.02.0823 - ScanSoft, Inc.)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.2.0 - Frank Heindörfer, Philip Chinery)
PixiePack Codec Pack (HKLM-x32\...\{A8D647C8-65AC-409F-B7B2-3C0FEE1A32F2}) (Version: 1.1.1200.0 - None)
Power Saving Utility (HKLM-x32\...\InstallShield_{7254349B-460B-488F-B4DB-A96100C5C48B}) (Version: - )
Power Saving Utility (Version: 31.01.11.013 - FUJITSU LIMITED) Hidden
QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5969 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7100.30087 - Realtek Semiconductor Corp.)
SecureW2 EAP Suite 2.0.4 for Windows (HKLM-x32\...\SecureW2 EAP Suite) (Version: - )
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version: - Microsoft) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 14.0.10.0 - Synaptics Incorporated)
SystemDiagnostics (HKLM-x32\...\{80B0B731-5FAE-475D-8844-20F46373780D}) (Version: 3.02.0010 - Fujitsu Technology Solutions)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{B4A38370-2ADB-46B0-A1B0-0C4A2F7DCA31}) (Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2837594) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{D3C85176-ACCC-4AF0-817D-1BC803303B74}) (Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2837594) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{D3C85176-ACCC-4AF0-817D-1BC803303B74}) (Version: - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{4EEA3D3E-989C-4DF4-AB0A-3042C0C12AA3}) (Version: - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817396) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{39767ECA-1731-45DB-AB5B-6BF40E151D66}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2494150) (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{3FCFD88F-4D13-4F38-8625-ABABEA7F61EA}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DADF7E25-FFA4-4D02-BE84-1DAE62C18516}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{287A1E92-9E41-4BC1-8920-B3D0E9220800}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{9D69691D-823D-4C3E-9B12-563A3F520366}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{35698CB7-AAA2-4577-B505-DBFF504AEF23}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{5AA578BB-759C-40FD-9661-A737C0884541}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2825640) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{BA610006-2C39-4419-9834-CF61AB24810A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{C70D2038-A2C4-4A99-87DE-5272BB44F0CE}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{82F87E28-B18E-46D6-A399-E2F19CF5949B}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2863818) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{83B1B530-7D9E-4C6A-907F-E979CEE9C295}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2878225) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{EFF5EBA3-40AD-4859-85E7-3C1CF4F297EB}) (Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version: - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-001A-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{A0657506-69DC-44AE-8DC1-58E7C6F5B1C9}) (Version: - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{2AB483F1-C86E-427A-83B4-23889B03512D}) (Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (HKLM-x32\...\{90140000-0018-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{81812245-FC84-426A-BC02-6659C88CC7B2}) (Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2775360) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{80F56E3F-1D47-4E45-B6E0-FEF4E919F4F9}) (Version: - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version: - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version: - Microsoft)
Update for Microsoft Visio 2010 (KB2878227) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{5D357893-40BA-4323-86BA-D97C66CD72F4}) (Version: - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{8C55AA83-54C2-4236-A622-78440A411DC5}) (Version: - Microsoft)
Windows Live Anmelde-Assistent (HKLM-x32\...\{52B97218-98CB-4B8B-9283-D213C85E1AA4}) (Version: 5.000.818.5 - Microsoft Corporation)
Windows Live Call (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Communications Platform (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite_Wave3) (Version: 14.0.8117.0416 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Sync (HKLM-x32\...\{586509F0-350D-48B5-B763-9CC2F8D96C4C}) (Version: 14.0.8117.416 - Microsoft Corporation)
Windows Live Writer (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live-Uploadtool (HKLM-x32\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
Wireless Selector (HKLM-x32\...\InstallShield_{51692C66-5505-41B8-92A7-548C69FB867C}) (Version: - )
Wireless Selector (Version: 4.01.00.101 - FUJITSU LIMITED) Hidden
==================== Restore Points =========================
14-03-2014 09:52:48 Geplanter Prüfpunkt
15-03-2014 07:55:22 Windows Update
17-03-2014 07:05:35 Windows Update
24-03-2014 10:46:34 Geplanter Prüfpunkt
29-03-2014 12:55:08 avast! antivirus system restore point
29-03-2014 13:18:45 avast! antivirus system restore point
29-03-2014 13:23:00 avast! antivirus system restore point
29-03-2014 13:39:29 Windows Update
01-04-2014 06:20:04 AA11
==================== Hosts content: ==========================
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {027595EC-39B4-4889-B39A-EFB3AA96DA5D} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {0B54AFA5-0920-4C20-B57B-C556177580C9} - System32\Tasks\Games\UpdateCheck_S-1-5-21-4294004471-4141303439-88424932-1001
Task: {0FA1A643-8978-47FE-B8EF-0F83AC186E45} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-10-13] (Google Inc.)
Task: {1278E932-427F-4C2B-85C5-226E828D2BBC} - System32\Tasks\Ad-Aware Antivirus Scheduled Scan => C:\PROGRA~2\AD-AWA~1\AdAwareLauncher.exe
Task: {2062BF89-590A-449C-8824-03FB6F3EAA17} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-03-29] (AVAST Software)
Task: {36345880-E51B-4787-A982-C0C282F2E1A5} - System32\Tasks\Opera D5 => C:\Program Files (x86)\Opera\launcher.exe
Task: {37304473-8CFC-4F7C-BA75-95A1AB9071CC} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-10-13] (Google Inc.)
Task: {4B68F471-2392-4918-9CDB-DE59337BAE07} - System32\Tasks\Opera D6 => C:\Program Files (x86)\Opera\launcher.exe
Task: {5B41411F-2B5E-48AD-9F55-F8E8E51A59B2} - System32\Tasks\Opera D3 => C:\Program Files (x86)\Opera\launcher.exe
Task: {61096F98-CE9F-4661-9435-3561E93592FE} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-03-12] (Adobe Systems Incorporated)
Task: {C2DDBB8E-5BB4-4F41-801F-6FD359E39B48} - System32\Tasks\{0472828D-BF17-4295-98AC-8C301FCD110B} => C:\Program Files (x86)\Skype\Phone\Skype.exe
Task: {C96CF47E-8C44-4B07-9093-E00DFA95CEE4} - System32\Tasks\CCleanerSkipUAC => C:\Program Files (x86)\CCleaner\CCleaner.exe [2014-03-18] (Piriform Ltd)
Task: {CC0F88A7-6C2B-472B-830A-3FD54DCF986B} - System32\Tasks\Opera D2 => C:\Program Files (x86)\Opera\launcher.exe
Task: {E772F1EA-9919-4BB2-B9CA-8634579F7055} - System32\Tasks\Opera D7 => C:\Program Files (x86)\Opera\launcher.exe
Task: {F52777C2-1E81-446E-BFD4-93B1E0FF7EF0} - System32\Tasks\Opera D4 => C:\Program Files (x86)\Opera\launcher.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2013-09-05 01:17 - 2013-09-05 01:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2014-01-23 16:29 - 2014-01-23 16:29 - 02141040 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareShellExtension.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00685904 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\SQLite.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 02595144 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\RCF.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00123776 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_filesystem-vc100-mt-1_55.dll
2014-01-23 16:30 - 2014-01-23 16:30 - 00024440 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_system-vc100-mt-1_55.dll
2007-07-30 09:05 - 2007-07-30 09:05 - 00050688 _____ () C:\Windows\System32\LFXPJL2K.DLL
2011-02-12 00:42 - 2005-03-12 01:07 - 00087040 _____ () C:\Windows\System32\pdfcmnnt.dll
2006-12-04 02:26 - 2006-12-04 02:26 - 00022016 _____ () C:\Windows\System32\sugs2l6.dll
2014-01-23 16:09 - 2014-01-23 16:09 - 00702744 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe
2014-01-23 16:30 - 2014-01-23 16:30 - 00103800 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_thread-vc100-mt-1_55.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00033656 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_chrono-vc100-mt-1_55.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00055680 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_date_time-vc100-mt-1_55.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 03720040 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareServiceKernel.dll
2014-01-23 16:30 - 2014-01-23 16:30 - 00158032 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\pugixml.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00788856 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_regex-vc100-mt-1_55.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00602984 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareActivation.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00291192 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareApplicationUpdater.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00142696 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareGamingMode.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00098648 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareReset.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00120152 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTime.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00268152 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareDefinitionsUpdater.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00198024 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareDefinitionsUpdaterScheduler.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00417128 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareIgnoreList.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00253800 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareQuarantine.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00293744 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareAntiMalwareEngine.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00212336 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareAntiRootkitEngine.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00509808 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareScannerHistory.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00607584 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareScanner.dll
2014-01-23 16:30 - 2014-01-23 16:30 - 00035192 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_timer-vc100-mt-1_55.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00325488 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareScannerScheduler.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00333688 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareRealTimeProtection.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00227688 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareIncompatibles.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00219488 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareAntiSpam.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00129896 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareAntiPhishing.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00599920 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareParentalControl.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 01926504 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareWebProtection.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00263536 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareEmailProtection.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00650608 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareNetworkProtection.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00490848 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareInstaller.dll
2014-01-23 16:30 - 2014-01-23 16:30 - 00106824 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\zlib.dll
2014-01-23 16:30 - 2014-01-23 16:30 - 00149840 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\libssh2.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00358744 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwarePromo.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00291680 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareFeedback.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00154464 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\SecurityCenter.dll
2013-07-17 17:10 - 2013-07-17 17:10 - 00777296 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Antimalware Engine\2.6.0.0\BDSmartDB.dll
2009-07-21 20:31 - 2009-07-21 20:31 - 00062312 _____ () C:\Program Files\Fujitsu\WirelessSelector\WSUService.exe
2014-01-23 16:29 - 2014-01-23 16:29 - 04114264 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTray.exe
2014-01-23 16:29 - 2014-01-23 16:29 - 00500088 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\boost_locale-vc100-mt-1_55.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00361824 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\HtmlFramework.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00066904 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\DllStorage.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00788848 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTrayDefaultSkin.dll
2014-01-23 16:29 - 2014-01-23 16:29 - 00139608 _____ () C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\Localization.dll
2007-07-30 09:27 - 2007-07-30 09:27 - 00017408 _____ () C:\Windows\system32\LFXGDIPO.exe
2014-04-01 14:46 - 2014-04-01 14:46 - 02189312 _____ () C:\Program Files\AVAST Software\Avast\defs\14040100\algo.dll
2014-02-06 01:52 - 2014-02-06 01:52 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-02-06 01:52 - 2014-02-06 01:52 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2013-10-19 01:55 - 2013-10-19 01:55 - 25100288 _____ () C:\Users\martin\AppData\Roaming\Dropbox\bin\libcef.dll
2014-01-11 19:03 - 2014-01-11 19:03 - 19336120 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2014-03-30 09:53 - 2014-03-30 09:53 - 03642480 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2013-09-05 01:14 - 2013-09-05 01:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\ProgramData\Temp:CB0AACC9
==================== Safe Mode (whitelisted) ===================
==================== Disabled items from MSCONFIG ==============
MSCONFIG\startupfolder: C:^Users^martin^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^startup^Dropbox.lnk => C:\Windows\pss\Dropbox.lnk.Startup
MSCONFIG\startupreg: ConMgr => "C:\Program Files\CSR\Bluetooth Feature Pack 5.0\ConMgr.exe"
MSCONFIG\startupreg: CSRSkype => C:\Program Files\CSR\Bluetooth Feature Pack 5.0\CSRSkype.exe
MSCONFIG\startupreg: IndexSearch => C:\Program Files (x86)\ScanSoft\PaperPort\IndexSearch.exe
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: PaperPort PTD => C:\Program Files (x86)\ScanSoft\PaperPort\pptd40nt.exe
MSCONFIG\startupreg: SSBkgdUpdate => "C:\Program Files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
MSCONFIG\startupreg: SynTPEnh => %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
MSCONFIG\startupreg: YouCam Mirror Tray icon => "C:\Program Files (x86)\CyberLink\YouCam\YouCamTray.exe" /s
==================== Faulty Device Manager Devices =============
Name: Bluetooth-Peripheriegerät
Description: Bluetooth-Peripheriegerät
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Bluetooth-Peripheriegerät
Description: Bluetooth-Peripheriegerät
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (04/01/2014 04:51:03 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 9063
Error: (04/01/2014 04:51:03 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 9063
Error: (04/01/2014 04:51:03 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (04/01/2014 04:51:02 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 8065
Error: (04/01/2014 04:51:02 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 8065
Error: (04/01/2014 04:51:02 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (04/01/2014 04:51:01 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 7066
Error: (04/01/2014 04:51:01 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 7066
Error: (04/01/2014 04:51:01 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (04/01/2014 04:51:00 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 6068
System errors:
=============
Error: (04/01/2014 05:35:06 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem Fehler beendet:
%%-2147024891
Error: (04/01/2014 05:35:06 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Heimnetzgruppen-Anbieter" ist vom Dienst "Funktionssuche-Ressourcenveröffentlichung" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%-2147024891
Error: (04/01/2014 05:34:53 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem Fehler beendet:
%%-2147024891
Error: (04/01/2014 05:34:53 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Heimnetzgruppen-Anbieter" ist vom Dienst "Funktionssuche-Ressourcenveröffentlichung" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%-2147024891
Error: (04/01/2014 02:48:37 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Heimnetzgruppen-Anbieter" ist vom Dienst "Funktionssuche-Ressourcenveröffentlichung" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%-2147024891
Error: (04/01/2014 02:48:37 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem Fehler beendet:
%%-2147024891
Error: (04/01/2014 02:47:48 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem Fehler beendet:
%%-2147024891
Error: (04/01/2014 02:45:54 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Heimnetzgruppen-Anbieter" ist vom Dienst "Funktionssuche-Ressourcenveröffentlichung" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%-2147024891
Error: (04/01/2014 02:45:54 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem Fehler beendet:
%%-2147024891
Error: (04/01/2014 02:44:09 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem Fehler beendet:
%%-2147024891
Microsoft Office Sessions:
=========================
Error: (04/01/2014 04:51:03 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 9063
Error: (04/01/2014 04:51:03 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledEvent 9063
Error: (04/01/2014 04:51:03 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (04/01/2014 04:51:02 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 8065
Error: (04/01/2014 04:51:02 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledEvent 8065
Error: (04/01/2014 04:51:02 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (04/01/2014 04:51:01 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 7066
Error: (04/01/2014 04:51:01 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledEvent 7066
Error: (04/01/2014 04:51:01 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (04/01/2014 04:51:00 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 6068
CodeIntegrity Errors:
===================================
Date: 2010-11-18 21:02:27.872
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2010-11-18 21:02:27.872
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Percentage of memory in use: 60%
Total physical RAM: 3892.55 MB
Available physical RAM: 1529.05 MB
Total Pagefile: 7783.29 MB
Available Pagefile: 5442.63 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB
==================== Drives ================================
Drive c: (System) (Fixed) (Total:296.08 GB) (Free:200.53 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive f: (130810_1135) (CDROM) (Total:0.04 GB) (Free:0 GB) CDFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: 8E760A6D)
Partition 1: (Active) - (Size=2 GB) - (Type=27)
Partition 2: (Not Active) - (Size=296 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Hallo Matthias, danke für das Hilfsangebot. Ich bin das erste Mal hier und hoffe, dass ich korrekt gepostet habe. Falls nicht, wäre ich dankbar, für einen Hinweis, was falsch war. enterprise FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014
Ran by martin (administrator) on MARTIN-PC on 01-04-2014 17:46:03
Running from C:\Users\martin\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(FUJITSU LIMITED) C:\Program Files\Fujitsu\PSUtility\PSUService.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(CSR, plc) C:\Program Files\CSR\Bluetooth Feature Pack 5.0\VFPRadioSupportService.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(FUJITSU LIMITED) C:\Program Files\Fujitsu\PSUtility\TrayManager.exe
(FUJITSU LIMITED) C:\Program Files\Fujitsu\FDM7\FdmDaemon.exe
() C:\Program Files\Fujitsu\WirelessSelector\WSUService.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTray.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE
(Dropbox, Inc.) C:\Users\martin\AppData\Roaming\Dropbox\bin\Dropbox.exe
(FUJITSU LIMITED) C:\Program Files (x86)\Fujitsu\FUJ02E3\FUJ02E3.exe
(FUJITSU LIMITED) C:\Program Files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Lavasoft) C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
() C:\Windows\system32\LFXGDIPO.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [PSUTility] - C:\Program Files\Fujitsu\PSUtility\TrayManager.exe [188264 2009-07-30] (FUJITSU LIMITED)
HKLM\...\Run: [FDM7] - C:\Program Files\Fujitsu\FDM7\FdmDaemon.exe [164712 2009-11-26] (FUJITSU LIMITED)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8312352 2009-10-28] (Realtek Semiconductor)
HKLM\...\Run: [] - [X]
HKLM\...\Run: [AdAwareTray] - C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTray.exe [4114264 2014-01-23] ()
HKLM-x32\...\Run: [LoadFUJ02E3] - C:\Program Files (x86)\Fujitsu\FUJ02E3\FUJ02E3.exe [36712 2009-10-08] (FUJITSU LIMITED)
HKLM-x32\...\Run: [IndicatorUtility] - C:\Program Files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe [47976 2009-10-09] (FUJITSU LIMITED)
HKLM-x32\...\Run: [BCSSync] - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [PPort9reminder] - C:\Program Files (x86)\ScanSoft\PaperPort\WebEreg\Ereg.exe [729088 2004-10-27] (ScanSoft, Inc.)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-06] (Apple Inc.)
HKLM-x32\...\Run: [AppleSyncNotifier] - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [59240 2011-11-02] (Apple Inc.)
HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3854640 2014-03-29] (AVAST Software)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)
HKLM-x32\...\Run: [Ad-Aware Browsing Protection] - C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe [559696 2013-09-27] (Lavasoft)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-4294004471-4141303439-88424932-1001\...\Run: [OfficeSyncProcess] - C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE [720064 2013-04-22] (Microsoft Corporation)
HKU\S-1-5-21-4294004471-4141303439-88424932-1001\...\MountPoints2: {26c86b04-8cef-11e0-b66e-b060aa673392} - D:\AutoRun.exe
HKU\S-1-5-21-4294004471-4141303439-88424932-1001\...\MountPoints2: {2c18385b-a2e8-11e0-a866-806e6f6e6963} - D:\Windows\AutoRun.exe
HKU\S-1-5-21-4294004471-4141303439-88424932-1001\...\MountPoints2: {abb48963-8a16-11e0-9789-b482fe645551} - D:\AutoRun.exe
HKU\S-1-5-21-4294004471-4141303439-88424932-1001\...\MountPoints2: {abb48969-8a16-11e0-9789-b482fe645551} - D:\AutoRun.exe
HKU\S-1-5-21-4294004471-4141303439-88424932-1001\...\MountPoints2: {dd337800-8ec8-11e0-b4c5-8926476bb392} - D:\AutoRun.exe
HKU\S-1-5-21-4294004471-4141303439-88424932-1001\...409d6c4515e9\InprocServer32: [Default-shell32] <==== ATTENTION!
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\LaunchCenter.lnk
ShortcutTarget: LaunchCenter.lnk -> C:\Program Files (x86)\Fujitsu\LaunchCenter\LaunchCenter.exe (Fujitsu Technology Solutions)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\LaunchCenter.lnk
ShortcutTarget: LaunchCenter.lnk -> C:\Program Files (x86)\Fujitsu\LaunchCenter\LaunchCenter.exe (Fujitsu Technology Solutions)
Startup: C:\Users\martin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\martin\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
==================== Internet (Whitelisted) ====================
ProxyServer: :0
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.romehome.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ts.fujitsu.com
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=FTSF&bmod=FTSF
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - DefaultScope {7C27DACE-6E40-4A35-9CAC-CC8F641A9287} URL = hxxp://search.softonic.com/MOY00621/tb_v1?q={searchTerms}&SearchSource=4&cc=&mi=56ea20180000000000007ee4004fb759&r=72
SearchScopes: HKCU - {20BF500C-B7E4-4194-9AC7-5AA70EA8ADF6} URL =
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={sear
SearchScopes: HKCU - {7C27DACE-6E40-4A35-9CAC-CC8F641A9287} URL = hxxp://search.softonic.com/MOY00621/tb_v1?q={searchTerms}&SearchSource=4&cc=&mi=56ea20180000000000007ee4004fb759&r=72
SearchScopes: HKCU - {A7AFCD2D-35B1-404C-90AA-19F9640E6A87} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms}
SearchScopes: HKCU - {D4C63CE7-CD77-47CC-8892-F0C8EB5AF419} URL =
BHO: Ad-Aware Security Add-on - {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files (x86)\Lavasoft\AdAware SecureSearch Toolbar\adawareDx64.dll ()
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO-x32: Ad-Aware Security Add-on - {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files (x86)\Lavasoft\AdAware SecureSearch Toolbar\adawareDx.dll ()
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: af0.Adblock.BHO - {90EFF544-3981-4d46-85C9-C0361D0931D6} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Ad-Aware Security Add-on - {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files (x86)\Lavasoft\AdAware SecureSearch Toolbar\adawareDx64.dll ()
Toolbar: HKLM-x32 - Ad-Aware Security Add-on - {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files (x86)\Lavasoft\AdAware SecureSearch Toolbar\adawareDx.dll ()
DPF: HKLM-x32 {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://eu.maxlite.mobi/dana-cached/sc/JuniperSetupClient.cab
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\martin\AppData\Roaming\Mozilla\Firefox\Profiles\6pvzp2xy.default
FF SearchEngineOrder.1: Google
FF SelectedSearchEngine: Google
FF Homepage: www.google.de
FF Keyword.URL: https://www.google.com/search
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\adawaretb.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Delicious Bookmarks - C:\Users\martin\AppData\Roaming\Mozilla\Firefox\Profiles\6pvzp2xy.default\Extensions\{2fa4ed95-0317-4c6a-a74c-5f3e3912c1f9} [2012-10-18]
FF Extension: Bitdefender QuickScan - C:\Users\martin\AppData\Roaming\Mozilla\Firefox\Profiles\6pvzp2xy.default\Extensions\{e001c731-5e37-4538-a5cb-8168736a2360} [2012-10-18]
FF Extension: Adblock Plus - C:\Users\martin\AppData\Roaming\Mozilla\Firefox\Profiles\6pvzp2xy.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011-05-27]
Chrome:
=======
CHR HomePage: www.google.com
CHR RestoreOnStartup: "sync": {
"suppress_start"
CHR Plugin: (Shockwave Flash) - C:\Users\martin\AppData\Local\Google\Chrome\User Data\PepperFlash\11.7.700.225\pepflashplayer.dll No File
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll No File
CHR Plugin: (McAfee Security Scanner +) - C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll No File
CHR Plugin: (Windows Live Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll No File
CHR Extension: (Google Wallet) - C:\Users\martin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]
CHR HKLM-x32\...\Chrome\Extension: [oejkcgajlodefenbbjdnaiahmbnnoole] - C:\Program Files (x86)\adawaretb\chrome-newtab-search.crx [2013-08-22]
CHR HKCU\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Services (Whitelisted) =================
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-03-29] (AVAST Software)
R2 LavasoftAdAwareService11; C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe [702744 2014-01-23] ()
R2 PowerSavingUtilityService; C:\Program Files\Fujitsu\PSUtility\PSUService.exe [63336 2009-07-30] (FUJITSU LIMITED)
S3 TestHandler; C:\Program Files (x86)\Fujitsu\SystemDiagnostics\OnlineDiagnostic\TestManager\HaDTMan.exe [384792 2010-09-24] (Fujitsu Technology Solutions)
R2 VFPRadioSupportService; C:\Program Files\CSR\Bluetooth Feature Pack 5.0\VFPRadioSupportService.exe [145840 2009-12-24] (CSR, plc)
R2 WirelessSelectorService; C:\Program Files\Fujitsu\WirelessSelector\WSUService.exe [62312 2009-07-21] ()
==================== Drivers (Whitelisted) ====================
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-03-29] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-03-29] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-03-29] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-03-29] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-03-29] (AVAST Software)
R3 aswStm; C:\Windows\system32\drivers\aswStm.sys [84816 2014-03-29] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208928 2014-03-29] ()
R3 FUJ02B1; C:\Windows\System32\DRIVERS\FUJ02B1.sys [7808 2006-11-01] (FUJITSU LIMITED)
R3 FUJ02E3; C:\Windows\System32\DRIVERS\FUJ02E3.sys [7296 2006-11-01] (FUJITSU LIMITED)
R0 gfibto; C:\Windows\System32\drivers\gfibto.sys [14456 2013-07-04] (GFI Software)
S3 ONDAusbmdm6k; C:\Windows\System32\DRIVERS\ONDAusbmdm6k.sys [150656 2008-09-16] (ONDA Incorporated)
S3 ONDAusbnet; C:\Windows\System32\DRIVERS\ONDAusbnet.sys [167424 2008-09-16] (ONDA Corporation)
S3 ONDAusbnmea; C:\Windows\System32\DRIVERS\ONDAusbnmea.sys [150656 2008-09-16] (ONDA Incorporated)
S3 ONDAusbser6k; C:\Windows\System32\DRIVERS\ONDAusbser6k.sys [150656 2008-09-16] (ONDA Incorporated)
S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [27520 2007-05-14] (Research In Motion Limited)
R3 Trufos; C:\Windows\System32\DRIVERS\Trufos.sys [329800 2013-07-17] (BitDefender S.R.L.)
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [X]
S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-04-01 17:46 - 2014-04-01 17:46 - 00020750 _____ () C:\Users\martin\Desktop\FRST.txt
2014-04-01 15:05 - 2014-04-01 15:05 - 00001985 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk
2014-04-01 15:05 - 2014-04-01 15:05 - 00000000 ____D () C:\Users\martin\AppData\Roaming\Oracle
2014-04-01 15:04 - 2014-04-01 15:04 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-04-01 08:22 - 2014-04-01 14:50 - 00002311 _____ () C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
2014-04-01 08:22 - 2014-04-01 08:22 - 00000000 ____D () C:\Users\martin\AppData\Local\adawarebp
2014-04-01 08:22 - 2014-04-01 08:22 - 00000000 ____D () C:\Program Files\Lavasoft
2014-04-01 08:21 - 2014-04-01 08:22 - 00000000 ____D () C:\ProgramData\Ad-Aware Browsing Protection
2014-04-01 08:21 - 2014-04-01 08:21 - 00000000 ____D () C:\Program Files (x86)\Toolbar Cleaner
2014-04-01 08:21 - 2014-04-01 08:21 - 00000000 ____D () C:\Program Files (x86)\Lavasoft
2014-04-01 08:20 - 2014-04-01 08:20 - 00000000 ____D () C:\Users\martin\AppData\Roaming\Lavasoft
2014-04-01 08:20 - 2014-04-01 08:20 - 00000000 ____D () C:\Program Files\Common Files\Lavasoft
2014-04-01 08:19 - 2014-04-01 08:19 - 01727624 _____ () C:\Users\martin\Downloads\Adaware_Installer_11153540.exe
2014-04-01 08:18 - 2014-04-01 08:18 - 00003150 _____ () C:\Windows\System32\Tasks\{61C75910-2343-4DBA-9844-339F75661779}
2014-04-01 08:18 - 2014-04-01 08:18 - 00000000 ____D () C:\ProgramData\Lavasoft
2014-03-30 22:19 - 2014-03-30 22:19 - 00000000 ____D () C:\Users\martin\AppData\Roaming\Opera Software
2014-03-30 22:19 - 2014-03-30 22:19 - 00000000 ____D () C:\Users\martin\AppData\Local\Opera Software
2014-03-30 22:17 - 2014-04-01 14:49 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-03-30 22:16 - 2014-03-30 22:16 - 00001068 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-03-30 22:16 - 2014-03-30 22:16 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-03-30 22:16 - 2014-03-05 09:26 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-03-30 22:16 - 2014-03-05 09:26 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-03-30 22:16 - 2014-03-05 09:26 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-03-30 22:15 - 2014-03-30 23:25 - 00000000 ____D () C:\Program Files (x86)\Opera
2014-03-30 22:15 - 2014-03-30 22:15 - 00003258 _____ () C:\Windows\System32\Tasks\Opera D7
2014-03-30 22:15 - 2014-03-30 22:15 - 00003258 _____ () C:\Windows\System32\Tasks\Opera D6
2014-03-30 22:15 - 2014-03-30 22:15 - 00003258 _____ () C:\Windows\System32\Tasks\Opera D5
2014-03-30 22:15 - 2014-03-30 22:15 - 00003258 _____ () C:\Windows\System32\Tasks\Opera D4
2014-03-30 22:15 - 2014-03-30 22:15 - 00003258 _____ () C:\Windows\System32\Tasks\Opera D3
2014-03-30 22:15 - 2014-03-30 22:15 - 00003258 _____ () C:\Windows\System32\Tasks\Opera D2
2014-03-30 20:15 - 2014-03-30 20:15 - 00053000 _____ () C:\Users\martin\Downloads\Shortcut.txt
2014-03-30 20:13 - 2014-03-30 20:15 - 00035605 _____ () C:\Users\martin\Downloads\Addition.txt
2014-03-30 20:12 - 2014-04-01 17:46 - 00000000 ____D () C:\FRST
2014-03-30 20:12 - 2014-03-30 20:15 - 00069284 _____ () C:\Users\martin\Downloads\FRST.txt
2014-03-30 20:12 - 2014-03-30 20:12 - 02157056 _____ (Farbar) C:\Users\martin\Desktop\FRST64.exe
2014-03-30 09:53 - 2014-03-30 09:53 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-03-29 19:42 - 2014-04-01 14:47 - 00000448 _____ () C:\Windows\setupact.log
2014-03-29 19:42 - 2014-03-31 17:48 - 00183252 _____ () C:\Windows\PFRO.log
2014-03-29 19:42 - 2014-03-29 19:42 - 00000000 _____ () C:\Windows\setuperr.log
2014-03-29 15:24 - 2014-03-29 15:24 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-03-29 14:51 - 2014-03-29 15:15 - 00000000 ____D () C:\Users\martin\AppData\Roaming\Security System 2
2014-03-29 14:51 - 2014-03-29 15:15 - 00000000 ____D () C:\Users\martin\AppData\Roaming\BupSystem
2014-03-29 14:50 - 2014-03-29 15:15 - 00000000 ____D () C:\Users\martin\AppData\Local\DownloadGuide
2014-03-29 14:50 - 2014-03-29 14:51 - 00000000 ____D () C:\Users\martin\AppData\Local\SearchProtect
2014-03-29 14:50 - 2014-03-29 14:50 - 00000000 _____ () C:\END
2014-03-25 10:01 - 2014-03-25 10:01 - 00001116 _____ () C:\Users\martin\Downloads\BAHN_Fahrplan_20140328.ics
2014-03-18 17:33 - 2014-03-18 17:43 - 91099924 _____ () C:\Users\martin\Downloads\wetransfer-8f3f18.zip
2014-03-18 13:37 - 2014-03-18 13:52 - 00000000 ____D () C:\Users\martin\Documents\wetransfer-e6941c
2014-03-18 10:28 - 2014-03-18 10:28 - 00079872 _____ () C:\Users\martin\Downloads\agency_occupancy_march17_2014.xls
2014-03-17 09:05 - 2014-01-09 04:22 - 05694464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-03-17 09:05 - 2014-01-04 00:44 - 06574592 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-03-17 00:07 - 2014-03-20 17:49 - 00000000 ____D () C:\Users\martin\Desktop\ebay-bilder
2014-03-16 16:03 - 2014-03-16 16:03 - 00001749 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-03-16 16:02 - 2014-03-16 16:03 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-03-16 16:02 - 2014-03-16 16:03 - 00000000 ____D () C:\Program Files\iTunes
2014-03-16 16:02 - 2014-03-16 16:03 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-03-16 16:02 - 2014-03-16 16:02 - 00000000 ____D () C:\Program Files\iPod
2014-03-16 15:55 - 2014-03-16 15:55 - 00001811 _____ () C:\Users\Public\Desktop\QuickTime Player.lnk
2014-03-16 15:55 - 2014-03-16 15:55 - 00000000 ____D () C:\Program Files (x86)\QuickTime
2014-03-15 10:02 - 2013-10-02 04:22 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys
2014-03-15 10:02 - 2013-10-02 04:11 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2014-03-15 10:02 - 2013-10-02 04:08 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2014-03-15 10:02 - 2013-10-02 03:48 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll
2014-03-15 10:02 - 2013-10-02 03:48 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll
2014-03-15 10:02 - 2013-10-02 03:29 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2014-03-15 10:02 - 2013-10-02 03:10 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll
2014-03-15 10:02 - 2013-10-02 02:15 - 01057280 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2014-03-15 10:02 - 2013-10-02 02:14 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll
2014-03-15 10:02 - 2013-10-02 02:14 - 00017920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll
2014-03-15 10:02 - 2013-10-02 02:08 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2014-03-15 10:02 - 2013-10-02 02:01 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2014-03-15 10:02 - 2013-10-02 01:58 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2014-03-15 10:02 - 2013-10-02 01:31 - 01147392 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2014-03-15 10:02 - 2013-10-02 01:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll
2014-03-15 10:02 - 2013-10-02 00:34 - 01068544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2014-03-15 09:54 - 2014-03-01 08:05 - 23133696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-15 09:54 - 2014-03-01 07:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-15 09:54 - 2014-03-01 07:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-03-15 09:54 - 2014-03-01 06:58 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-03-15 09:54 - 2014-03-01 06:52 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-03-15 09:54 - 2014-03-01 06:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-03-15 09:54 - 2014-03-01 06:42 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-03-15 09:54 - 2014-03-01 06:40 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-03-15 09:54 - 2014-03-01 06:37 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-03-15 09:54 - 2014-03-01 06:33 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-03-15 09:54 - 2014-03-01 06:33 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-03-15 09:54 - 2014-03-01 06:32 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-03-15 09:54 - 2014-03-01 06:30 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-03-15 09:54 - 2014-03-01 06:23 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-03-15 09:54 - 2014-03-01 06:17 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-03-15 09:54 - 2014-03-01 06:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-03-15 09:54 - 2014-03-01 06:02 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-03-15 09:54 - 2014-03-01 05:54 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-03-15 09:54 - 2014-03-01 05:52 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-03-15 09:54 - 2014-03-01 05:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-03-15 09:54 - 2014-03-01 05:47 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-03-15 09:54 - 2014-03-01 05:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-03-15 09:54 - 2014-03-01 05:43 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-03-15 09:54 - 2014-03-01 05:42 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-03-15 09:54 - 2014-03-01 05:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-03-15 09:54 - 2014-03-01 05:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-03-15 09:54 - 2014-03-01 05:37 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-03-15 09:54 - 2014-03-01 05:35 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-03-15 09:54 - 2014-03-01 05:18 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-03-15 09:54 - 2014-03-01 05:16 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-03-15 09:54 - 2014-03-01 05:14 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-03-15 09:54 - 2014-03-01 05:10 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-03-15 09:54 - 2014-03-01 05:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-03-15 09:54 - 2014-03-01 05:00 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-03-15 09:54 - 2014-03-01 04:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-03-15 09:54 - 2014-03-01 04:38 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-03-15 09:54 - 2014-03-01 04:32 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-03-15 09:54 - 2014-03-01 04:27 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-03-15 09:54 - 2014-03-01 04:25 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-03-15 09:54 - 2014-03-01 04:25 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-03-15 09:54 - 2014-02-07 03:23 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-03-15 09:54 - 2014-01-29 04:32 - 00484864 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2014-03-15 09:54 - 2014-01-29 04:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll
2014-03-15 09:54 - 2014-01-28 04:32 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2014-03-15 09:54 - 2013-09-25 04:23 - 01030144 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2014-03-15 09:54 - 2013-09-25 03:57 - 00792576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll
2014-03-15 09:53 - 2014-02-04 04:32 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-03-15 09:53 - 2014-02-04 04:32 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-03-15 09:53 - 2014-02-04 04:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-03-15 09:53 - 2014-02-04 04:04 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-03-15 06:04 - 2014-03-15 06:04 - 00005048 _____ () C:\Users\martin\Downloads\=_utf-8_B_RndkIFdHIFdJQ0hUSUcgZsO8ciBSZW50ZSBBbmVya2VubnVuZyB2b24genU=_= =_utf-8_B_cyBFcnppZWh1bmdzemVpdGVuIGJlaSBLaW5kZXJuIHZvciAxOTkyLnppcA==_=
2014-03-13 20:36 - 2014-03-14 00:09 - 00012496 _____ () C:\Users\martin\Downloads\Einladungsliste_ 2014_03_Rita_Geb 000 (1).xlsx
2014-03-12 19:20 - 2014-03-12 19:20 - 05777288 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-03-06 23:07 - 2014-03-06 23:07 - 04765152 _____ (Piriform Ltd) C:\Users\martin\Downloads\ccsetup411.exe
2014-03-06 14:19 - 2014-03-06 14:19 - 00272482 _____ () C:\Users\martin\Downloads\=_utf-8_B_SW1tb3dlbHQgVGVpbG5haG1lYmVzdMOkdGlndW5nIDU0MjQ5NC5wZGY=_=
2014-03-05 23:58 - 2013-12-21 11:53 - 00548864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-03-05 23:58 - 2013-12-21 10:56 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-03-05 23:55 - 2014-01-01 01:05 - 00420008 _____ () C:\Windows\SysWOW64\locale.nls
2014-03-05 23:55 - 2014-01-01 01:04 - 00420008 _____ () C:\Windows\system32\locale.nls
2014-03-05 23:55 - 2013-12-25 01:09 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-03-05 23:55 - 2013-12-25 00:48 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-03-05 23:55 - 2013-12-06 04:30 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-03-05 23:55 - 2013-12-06 04:30 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-03-05 23:55 - 2013-12-06 04:02 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-03-05 23:55 - 2013-12-06 04:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-03-05 23:55 - 2013-12-04 04:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll
2014-03-05 23:55 - 2013-12-04 04:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll
2014-03-05 23:55 - 2013-12-04 04:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll
2014-03-05 23:55 - 2013-12-04 04:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll
2014-03-05 23:55 - 2013-12-04 04:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll
2014-03-05 23:55 - 2013-12-04 04:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe
2014-03-05 23:55 - 2013-12-04 04:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe
2014-03-05 23:55 - 2013-12-04 04:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe
2014-03-05 23:55 - 2013-12-04 04:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe
2014-03-05 23:55 - 2013-12-04 04:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll
2014-03-05 23:55 - 2013-12-04 04:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll
2014-03-05 23:55 - 2013-12-04 04:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll
2014-03-05 23:55 - 2013-12-04 04:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll
2014-03-05 23:55 - 2013-12-04 04:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll
2014-03-05 23:55 - 2013-12-04 03:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe
2014-03-05 23:55 - 2013-12-04 03:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe
2014-03-05 23:55 - 2013-12-04 03:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe
2014-03-05 23:55 - 2013-12-04 03:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe
2014-03-05 23:55 - 2013-11-26 10:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2014-03-05 23:55 - 2013-11-23 00:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
==================== One Month Modified Files and Folders =======
2014-04-01 17:46 - 2014-04-01 17:46 - 00020750 _____ () C:\Users\martin\Desktop\FRST.txt
2014-04-01 17:46 - 2014-03-30 20:12 - 00000000 ____D () C:\FRST
2014-04-01 17:34 - 2013-02-25 20:09 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-01 17:34 - 2010-10-13 11:32 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-01 17:34 - 2010-10-13 11:32 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-01 15:05 - 2014-04-01 15:05 - 00001985 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk
2014-04-01 15:05 - 2014-04-01 15:05 - 00000000 ____D () C:\Users\martin\AppData\Roaming\Oracle
2014-04-01 15:05 - 2010-10-13 11:37 - 00000000 ____D () C:\Users\martin\AppData\Local\Adobe
2014-04-01 15:04 - 2014-04-01 15:04 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-04-01 15:04 - 2010-10-13 11:32 - 00000000 ____D () C:\ProgramData\Adobe
2014-04-01 14:56 - 2009-07-14 06:45 - 00009920 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-01 14:56 - 2009-07-14 06:45 - 00009920 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-01 14:53 - 2013-12-14 14:17 - 01260468 _____ () C:\Windows\WindowsUpdate.log
2014-04-01 14:50 - 2014-04-01 08:22 - 00002311 _____ () C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
2014-04-01 14:49 - 2014-03-30 22:17 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-01 14:49 - 2011-10-27 12:29 - 00000000 ___RD () C:\Users\martin\Dropbox
2014-04-01 14:49 - 2011-10-27 12:26 - 00000000 ____D () C:\Users\martin\AppData\Roaming\Dropbox
2014-04-01 14:47 - 2014-03-29 19:42 - 00000448 _____ () C:\Windows\setupact.log
2014-04-01 14:47 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-01 14:45 - 2014-01-11 19:03 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-04-01 08:43 - 2012-02-26 17:31 - 00001381 _____ () C:\Users\martin\Desktop\Internet Explorer (64-bit).lnk
2014-04-01 08:22 - 2014-04-01 08:22 - 00000000 ____D () C:\Users\martin\AppData\Local\adawarebp
2014-04-01 08:22 - 2014-04-01 08:22 - 00000000 ____D () C:\Program Files\Lavasoft
2014-04-01 08:22 - 2014-04-01 08:21 - 00000000 ____D () C:\ProgramData\Ad-Aware Browsing Protection
2014-04-01 08:21 - 2014-04-01 08:21 - 00000000 ____D () C:\Program Files (x86)\Toolbar Cleaner
2014-04-01 08:21 - 2014-04-01 08:21 - 00000000 ____D () C:\Program Files (x86)\Lavasoft
2014-04-01 08:20 - 2014-04-01 08:20 - 00000000 ____D () C:\Users\martin\AppData\Roaming\Lavasoft
2014-04-01 08:20 - 2014-04-01 08:20 - 00000000 ____D () C:\Program Files\Common Files\Lavasoft
2014-04-01 08:19 - 2014-04-01 08:19 - 01727624 _____ () C:\Users\martin\Downloads\Adaware_Installer_11153540.exe
2014-04-01 08:18 - 2014-04-01 08:18 - 00003150 _____ () C:\Windows\System32\Tasks\{61C75910-2343-4DBA-9844-339F75661779}
2014-04-01 08:18 - 2014-04-01 08:18 - 00000000 ____D () C:\ProgramData\Lavasoft
2014-04-01 08:07 - 2010-04-26 15:06 - 00700118 _____ () C:\Windows\system32\perfh007.dat
2014-04-01 08:07 - 2010-04-26 15:06 - 00149968 _____ () C:\Windows\system32\perfc007.dat
2014-04-01 08:07 - 2009-07-14 07:13 - 01622164 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-01 01:06 - 2010-11-12 23:00 - 00000000 ____D () C:\Users\martin\AppData\Roaming\QuickScan
2014-03-31 17:48 - 2014-03-29 19:42 - 00183252 _____ () C:\Windows\PFRO.log
2014-03-31 09:39 - 2012-05-13 19:49 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-03-30 23:25 - 2014-03-30 22:15 - 00000000 ____D () C:\Program Files (x86)\Opera
2014-03-30 22:19 - 2014-03-30 22:19 - 00000000 ____D () C:\Users\martin\AppData\Roaming\Opera Software
2014-03-30 22:19 - 2014-03-30 22:19 - 00000000 ____D () C:\Users\martin\AppData\Local\Opera Software
2014-03-30 22:17 - 2011-09-17 20:45 - 00000000 ____D () C:\Users\martin\AppData\Local\CrashDumps
2014-03-30 22:16 - 2014-03-30 22:16 - 00001068 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-03-30 22:16 - 2014-03-30 22:16 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-03-30 22:16 - 2013-05-30 19:36 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-03-30 22:15 - 2014-03-30 22:15 - 00003258 _____ () C:\Windows\System32\Tasks\Opera D7
2014-03-30 22:15 - 2014-03-30 22:15 - 00003258 _____ () C:\Windows\System32\Tasks\Opera D6
2014-03-30 22:15 - 2014-03-30 22:15 - 00003258 _____ () C:\Windows\System32\Tasks\Opera D5
2014-03-30 22:15 - 2014-03-30 22:15 - 00003258 _____ () C:\Windows\System32\Tasks\Opera D4
2014-03-30 22:15 - 2014-03-30 22:15 - 00003258 _____ () C:\Windows\System32\Tasks\Opera D3
2014-03-30 22:15 - 2014-03-30 22:15 - 00003258 _____ () C:\Windows\System32\Tasks\Opera D2
2014-03-30 20:15 - 2014-03-30 20:15 - 00053000 _____ () C:\Users\martin\Downloads\Shortcut.txt
2014-03-30 20:15 - 2014-03-30 20:13 - 00035605 _____ () C:\Users\martin\Downloads\Addition.txt
2014-03-30 20:15 - 2014-03-30 20:12 - 00069284 _____ () C:\Users\martin\Downloads\FRST.txt
2014-03-30 20:12 - 2014-03-30 20:12 - 02157056 _____ (Farbar) C:\Users\martin\Desktop\FRST64.exe
2014-03-30 16:46 - 2010-10-13 11:32 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-03-30 16:46 - 2010-10-13 11:32 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-03-30 09:53 - 2014-03-30 09:53 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-03-29 19:42 - 2014-03-29 19:42 - 00000000 _____ () C:\Windows\setuperr.log
2014-03-29 15:57 - 2010-10-13 12:15 - 00002129 _____ () C:\Users\martin\Desktop\Google Chrome.lnk
2014-03-29 15:45 - 2010-10-13 19:49 - 01596444 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-03-29 15:34 - 2010-12-05 15:38 - 00000983 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-03-29 15:34 - 2010-10-13 12:01 - 00000000 ____D () C:\Program Files (x86)\CCleaner
2014-03-29 15:24 - 2014-03-29 15:24 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-03-29 15:24 - 2014-01-11 19:04 - 00001972 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-03-29 15:24 - 2014-01-11 19:03 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2014-03-29 15:24 - 2014-01-11 19:03 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2014-03-29 15:24 - 2014-01-11 19:03 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-03-29 15:24 - 2014-01-11 19:03 - 00208928 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-03-29 15:24 - 2014-01-11 19:03 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-03-29 15:24 - 2014-01-11 19:03 - 00084816 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2014-03-29 15:24 - 2014-01-11 19:03 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-03-29 15:24 - 2014-01-11 19:03 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-03-29 15:19 - 2010-10-13 20:37 - 00000000 ____D () C:\Windows\System32\Tasks\Games
2014-03-29 15:17 - 2010-10-13 11:37 - 00000000 ____D () C:\Users\martin
2014-03-29 15:16 - 2014-02-10 23:52 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-03-29 15:16 - 2012-02-26 14:30 - 00000000 ____D () C:\Users\Administrator
2014-03-29 15:16 - 2010-10-13 20:21 - 00000000 ____D () C:\Users\martin\AppData\Roaming\BOM
2014-03-29 15:16 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\AppCompat
2014-03-29 15:15 - 2014-03-29 14:51 - 00000000 ____D () C:\Users\martin\AppData\Roaming\Security System 2
2014-03-29 15:15 - 2014-03-29 14:51 - 00000000 ____D () C:\Users\martin\AppData\Roaming\BupSystem
2014-03-29 15:15 - 2014-03-29 14:50 - 00000000 ____D () C:\Users\martin\AppData\Local\DownloadGuide
2014-03-29 15:15 - 2012-02-26 17:34 - 00000000 ____D () C:\Users\martin\AppData\Local\Thunderbird
2014-03-29 15:15 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration
2014-03-29 15:14 - 2010-10-20 12:22 - 00000000 __RHD () C:\MSOCache
2014-03-29 14:51 - 2014-03-29 14:50 - 00000000 ____D () C:\Users\martin\AppData\Local\SearchProtect
2014-03-29 14:50 - 2014-03-29 14:50 - 00000000 _____ () C:\END
2014-03-25 17:39 - 2014-01-03 12:28 - 00036696 _____ () C:\Users\martin\Documents\Buchungen 2014.xlsx
2014-03-25 14:37 - 2011-09-17 22:09 - 00000000 ____D () C:\Users\martin\Documents\Outlook-Dateien
2014-03-25 10:01 - 2014-03-25 10:01 - 00001116 _____ () C:\Users\martin\Downloads\BAHN_Fahrplan_20140328.ics
2014-03-21 17:28 - 2012-09-17 14:08 - 00000000 ____D () C:\Users\martin\AppData\Roaming\TeamViewer
2014-03-20 17:49 - 2014-03-17 00:07 - 00000000 ____D () C:\Users\martin\Desktop\ebay-bilder
2014-03-20 09:43 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-03-18 17:43 - 2014-03-18 17:33 - 91099924 _____ () C:\Users\martin\Downloads\wetransfer-8f3f18.zip
2014-03-18 13:52 - 2014-03-18 13:37 - 00000000 ____D () C:\Users\martin\Documents\wetransfer-e6941c
2014-03-18 10:28 - 2014-03-18 10:28 - 00079872 _____ () C:\Users\martin\Downloads\agency_occupancy_march17_2014.xls
2014-03-17 18:09 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-03-16 16:03 - 2014-03-16 16:03 - 00001749 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-03-16 16:03 - 2014-03-16 16:02 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-03-16 16:03 - 2014-03-16 16:02 - 00000000 ____D () C:\Program Files\iTunes
2014-03-16 16:03 - 2014-03-16 16:02 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-03-16 16:02 - 2014-03-16 16:02 - 00000000 ____D () C:\Program Files\iPod
2014-03-16 15:55 - 2014-03-16 15:55 - 00001811 _____ () C:\Users\Public\Desktop\QuickTime Player.lnk
2014-03-16 15:55 - 2014-03-16 15:55 - 00000000 ____D () C:\Program Files (x86)\QuickTime
2014-03-15 10:27 - 2009-07-14 06:45 - 00431912 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-03-15 10:26 - 2013-03-13 23:50 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-03-15 10:25 - 2013-03-13 23:50 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-03-15 10:03 - 2011-02-25 11:49 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-03-15 10:01 - 2013-10-04 23:25 - 00000000 ____D () C:\Windows\system32\MRT
2014-03-15 09:59 - 2010-10-17 10:58 - 90015360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-03-15 06:04 - 2014-03-15 06:04 - 00005048 _____ () C:\Users\martin\Downloads\=_utf-8_B_RndkIFdHIFdJQ0hUSUcgZsO8ciBSZW50ZSBBbmVya2VubnVuZyB2b24genU=_= =_utf-8_B_cyBFcnppZWh1bmdzemVpdGVuIGJlaSBLaW5kZXJuIHZvciAxOTkyLnppcA==_=
2014-03-14 00:09 - 2014-03-13 20:36 - 00012496 _____ () C:\Users\martin\Downloads\Einladungsliste_ 2014_03_Rita_Geb 000 (1).xlsx
2014-03-12 19:20 - 2014-03-12 19:20 - 05777288 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-03-12 19:20 - 2013-02-25 20:09 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-03-12 19:20 - 2013-02-25 20:09 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-03-12 19:20 - 2011-07-28 10:08 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-03-06 23:07 - 2014-03-06 23:07 - 04765152 _____ (Piriform Ltd) C:\Users\martin\Downloads\ccsetup411.exe
2014-03-06 14:19 - 2014-03-06 14:19 - 00272482 _____ () C:\Users\martin\Downloads\=_utf-8_B_SW1tb3dlbHQgVGVpbG5haG1lYmVzdMOkdGlndW5nIDU0MjQ5NC5wZGY=_=
2014-03-05 23:59 - 2009-07-14 04:34 - 00000478 _____ () C:\Windows\win.ini
2014-03-05 09:26 - 2014-03-30 22:16 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-03-05 09:26 - 2014-03-30 22:16 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-03-05 09:26 - 2014-03-30 22:16 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
Some content of TEMP:
====================
C:\Users\Administrator\AppData\Local\Temp\AskSLib.dll
C:\Users\martin\AppData\Local\Temp\683ed83b-0fb0-49e7-b653-1850e809ec40.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-03-30 10:32
==================== End Of Log ============================
--- --- --- Geändert von enterprise (01.04.2014 um 17:02 Uhr) Grund: Reiche die addition nach. Hatte das vorhin nicht kapiert. Sorry! |
|
01.04.2014, 19:09
| #4 |
| /// TB-Ausbilder | Win32:Dropper-LTG (Drp) - Noch da oder nicht? Servus, Scan mit Combofix
|
|
01.04.2014, 20:44
| #5 |
| | Win32:Dropper-LTG (Drp) - Noch da oder nicht? Hallo und danke, nachstehend das logfile von ComboFix. Ich hoffe, es fällt nicht allzu schlimm aus. Viele Grüße, enterprise Code:
ATTFilter ComboFix 14-03-24.01 - martin 01.04.2014 21:15:58.1.4 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1252.49.1031.18.3893.2030 [GMT 2:00]
ausgeführt von:: c:\users\martin\Desktop\ComboFix.exe
AV: Avira Desktop *Enabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Enabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Spybot - Search and Destroy *Enabled/Outdated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\install.exe
c:\program files (x86)\SecureW2
c:\program files (x86)\SecureW2\Uninstall.exe
c:\programdata\Microsoft\Windows\Start Menu\Programs\SecureW2
c:\programdata\Microsoft\Windows\Start Menu\Programs\SecureW2\TTLS Manager.lnk
c:\programdata\Microsoft\Windows\Start Menu\Programs\SecureW2\Uninstall.lnk
c:\users\martin\AppData\Roaming\Ilgy
c:\users\martin\AppData\Roaming\Ilgy\tuqi.rir
c:\users\martin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SecureW2
c:\windows\security\Database\tmp.edb
c:\windows\SysWow64\System32\MASetupCleaner.exe
c:\windows\SysWow64\System32\muzapp.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-03-01 bis 2014-04-01 ))))))))))))))))))))))))))))))
.
.
2014-04-01 19:25 . 2014-04-01 19:25 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-04-01 19:25 . 2014-04-01 19:25 -------- d-----w- c:\users\Administrator\AppData\Local\temp
2014-04-01 13:05 . 2014-04-01 13:05 -------- d-----w- c:\users\martin\AppData\Roaming\Oracle
2014-04-01 13:04 . 2014-04-01 13:04 -------- d-----w- c:\program files (x86)\Common Files\Adobe
2014-04-01 06:22 . 2014-04-01 06:22 -------- d-----w- c:\program files\Lavasoft
2014-04-01 06:22 . 2014-04-01 06:22 -------- d-----w- c:\users\martin\AppData\Local\adawarebp
2014-04-01 06:21 . 2014-04-01 06:22 -------- d-----w- c:\programdata\Ad-Aware Browsing Protection
2014-04-01 06:21 . 2014-04-01 06:21 -------- d-----w- c:\program files (x86)\Toolbar Cleaner
2014-04-01 06:21 . 2014-04-01 19:28 -------- d-----w- c:\program files (x86)\Lavasoft
2014-04-01 06:20 . 2014-04-01 06:20 -------- d-----w- c:\users\martin\AppData\Roaming\Lavasoft
2014-04-01 06:20 . 2014-04-01 06:20 -------- d-----w- c:\program files\Common Files\Lavasoft
2014-04-01 06:18 . 2014-04-01 06:18 -------- d-----w- c:\programdata\Lavasoft
2014-03-30 20:19 . 2014-03-30 20:19 -------- d-----w- c:\users\martin\AppData\Local\Opera Software
2014-03-30 20:19 . 2014-03-30 20:19 -------- d-----w- c:\users\martin\AppData\Roaming\Opera Software
2014-03-30 20:17 . 2014-04-01 12:49 119512 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-03-30 20:16 . 2014-03-30 20:16 -------- d-----w- c:\program files (x86)\ Malwarebytes Anti-Malware
2014-03-30 20:16 . 2014-03-05 07:26 63192 ----a-w- c:\windows\system32\drivers\mwac.sys
2014-03-30 20:16 . 2014-03-05 07:26 88280 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-03-30 20:16 . 2014-03-05 07:26 25816 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-03-30 20:15 . 2014-03-30 21:25 -------- d-----w- c:\program files (x86)\Opera
2014-03-30 18:12 . 2014-04-01 16:01 -------- d-----w- C:\FRST
2014-03-29 13:41 . 2014-03-29 13:41 -------- d-----w- c:\windows\Migration
2014-03-29 13:24 . 2014-03-29 13:24 43152 ----a-w- c:\windows\avastSS.scr
2014-03-29 12:51 . 2014-03-29 13:15 -------- d-----w- c:\users\martin\AppData\Roaming\BupSystem
2014-03-29 12:51 . 2014-03-29 13:15 -------- d-----w- c:\users\martin\AppData\Roaming\Security System 2
2014-03-29 12:50 . 2014-03-29 12:51 -------- d-----w- c:\users\martin\AppData\Local\SearchProtect
2014-03-29 12:50 . 2014-03-29 13:15 -------- d-----w- c:\users\martin\AppData\Local\DownloadGuide
2014-03-17 07:05 . 2014-01-09 02:22 5694464 ----a-w- c:\windows\SysWow64\mstscax.dll
2014-03-17 07:05 . 2014-01-03 22:44 6574592 ----a-w- c:\windows\system32\mstscax.dll
2014-03-16 14:02 . 2014-03-16 14:02 -------- d-----w- c:\program files\iPod
2014-03-16 14:02 . 2014-03-16 14:03 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-03-16 14:02 . 2014-03-16 14:03 -------- d-----w- c:\program files\iTunes
2014-03-16 14:02 . 2014-03-16 14:03 -------- d-----w- c:\program files (x86)\iTunes
2014-03-16 13:55 . 2014-03-16 13:55 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin5.dll
2014-03-16 13:55 . 2014-03-16 13:55 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin4.dll
2014-03-16 13:55 . 2014-03-16 13:55 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin3.dll
2014-03-16 13:55 . 2014-03-16 13:55 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin2.dll
2014-03-16 13:55 . 2014-03-16 13:55 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin.dll
2014-03-16 13:55 . 2014-03-16 13:55 -------- d-----w- c:\program files (x86)\QuickTime
2014-03-15 07:54 . 2014-03-01 22:33 806104 ----a-w- c:\program files\Internet Explorer\iexplore.exe
2014-03-15 07:53 . 2014-02-04 02:32 1424384 ----a-w- c:\windows\system32\WindowsCodecs.dll
2014-03-15 07:53 . 2014-02-04 02:32 624128 ----a-w- c:\windows\system32\qedit.dll
2014-03-15 07:53 . 2014-02-04 02:04 1230336 ----a-w- c:\windows\SysWow64\WindowsCodecs.dll
2014-03-15 07:53 . 2014-02-04 02:04 509440 ----a-w- c:\windows\SysWow64\qedit.dll
2014-03-12 17:20 . 2014-03-12 17:20 5777288 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe
2014-03-05 21:58 . 2013-12-21 09:53 548864 ----a-w- c:\windows\system32\vbscript.dll
2014-03-05 21:58 . 2013-12-21 08:56 454656 ----a-w- c:\windows\SysWow64\vbscript.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-03-29 13:24 . 2014-01-11 17:03 84816 ----a-w- c:\windows\system32\drivers\aswstm.sys
2014-03-29 13:24 . 2014-01-11 17:03 65776 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2014-03-29 13:24 . 2014-01-11 17:03 208928 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2014-03-29 13:24 . 2014-01-11 17:03 79184 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2014-03-29 13:24 . 2014-01-11 17:03 423240 ----a-w- c:\windows\system32\drivers\aswSP.sys
2014-03-29 13:24 . 2014-01-11 17:03 1039096 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2014-03-29 13:24 . 2014-01-11 17:03 334648 ----a-w- c:\windows\system32\aswBoot.exe
2014-03-29 13:24 . 2014-01-11 17:03 93568 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2014-03-15 07:59 . 2010-10-17 08:58 90015360 ----a-w- c:\windows\system32\MRT.exe
2014-03-12 17:20 . 2013-02-25 18:09 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-03-12 17:20 . 2011-07-28 08:08 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-01-30 21:48 . 2014-01-30 21:48 108968 ----a-w- c:\windows\system32\WindowsAccessBridge-64.dll
2014-01-30 21:48 . 2014-01-30 21:49 312744 ----a-w- c:\windows\system32\javaws.exe
2014-01-30 21:48 . 2014-01-30 21:48 189352 ----a-w- c:\windows\system32\javaw.exe
2014-01-30 21:48 . 2014-01-30 21:48 189352 ----a-w- c:\windows\system32\java.exe
2014-01-27 14:32 . 2014-01-27 14:32 194048 ----a-w- c:\windows\SysWow64\elshyph.dll
2014-01-27 14:31 . 2014-01-27 14:31 942592 ----a-w- c:\windows\system32\jsIntl.dll
2014-01-27 14:31 . 2014-01-27 14:31 90112 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2014-01-27 14:31 . 2014-01-27 14:31 86016 ----a-w- c:\windows\SysWow64\iesysprep.dll
2014-01-27 14:31 . 2014-01-27 14:31 86016 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2014-01-27 14:31 . 2014-01-27 14:31 84992 ----a-w- c:\windows\system32\mshtmled.dll
2014-01-27 14:31 . 2014-01-27 14:31 83968 ----a-w- c:\windows\system32\MshtmlDac.dll
2014-01-27 14:31 . 2014-01-27 14:31 81408 ----a-w- c:\windows\system32\icardie.dll
2014-01-27 14:31 . 2014-01-27 14:31 774144 ----a-w- c:\windows\system32\jscript.dll
2014-01-27 14:31 . 2014-01-27 14:31 77312 ----a-w- c:\windows\system32\tdc.ocx
2014-01-27 14:31 . 2014-01-27 14:31 74240 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2014-01-27 14:31 . 2014-01-27 14:31 71680 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2014-01-27 14:31 . 2014-01-27 14:31 645120 ----a-w- c:\windows\SysWow64\jsIntl.dll
2014-01-27 14:31 . 2014-01-27 14:31 62464 ----a-w- c:\windows\SysWow64\tdc.ocx
2014-01-27 14:31 . 2014-01-27 14:31 62464 ----a-w- c:\windows\system32\pngfilt.dll
2014-01-27 14:31 . 2014-01-27 14:31 61952 ----a-w- c:\windows\SysWow64\MshtmlDac.dll
2014-01-27 14:31 . 2014-01-27 14:31 616104 ----a-w- c:\windows\system32\ieapfltr.dat
2014-01-27 14:31 . 2014-01-27 14:31 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2014-01-27 14:31 . 2014-01-27 14:31 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2014-01-27 14:31 . 2014-01-27 14:31 48640 ----a-w- c:\windows\system32\mshtmler.dll
2014-01-27 14:31 . 2014-01-27 14:31 48128 ----a-w- c:\windows\system32\imgutil.dll
2014-01-27 14:31 . 2014-01-27 14:31 453120 ----a-w- c:\windows\system32\dxtmsft.dll
2014-01-27 14:31 . 2014-01-27 14:31 413696 ----a-w- c:\windows\system32\html.iec
2014-01-27 14:31 . 2014-01-27 14:31 40448 ----a-w- c:\windows\system32\JavaScriptCollectionAgent.dll
2014-01-27 14:31 . 2014-01-27 14:31 36352 ----a-w- c:\windows\SysWow64\imgutil.dll
2014-01-27 14:31 . 2014-01-27 14:31 34816 ----a-w- c:\windows\SysWow64\JavaScriptCollectionAgent.dll
2014-01-27 14:31 . 2014-01-27 14:31 337408 ----a-w- c:\windows\SysWow64\html.iec
2014-01-27 14:31 . 2014-01-27 14:31 30208 ----a-w- c:\windows\system32\licmgr10.dll
2014-01-27 14:31 . 2014-01-27 14:31 296960 ----a-w- c:\windows\system32\dxtrans.dll
2014-01-27 14:31 . 2014-01-27 14:31 263376 ----a-w- c:\windows\system32\iedkcs32.dll
2014-01-27 14:31 . 2014-01-27 14:31 247808 ----a-w- c:\windows\system32\msls31.dll
2014-01-27 14:31 . 2014-01-27 14:31 24576 ----a-w- c:\windows\SysWow64\licmgr10.dll
2014-01-27 14:31 . 2014-01-27 14:31 243200 ----a-w- c:\windows\system32\webcheck.dll
2014-01-27 14:31 . 2014-01-27 14:31 235520 ----a-w- c:\windows\system32\url.dll
2014-01-27 14:31 . 2014-01-27 14:31 235008 ----a-w- c:\windows\system32\elshyph.dll
2014-01-27 14:31 . 2014-01-27 14:31 182272 ----a-w- c:\windows\SysWow64\msls31.dll
2014-01-27 14:31 . 2014-01-27 14:31 167424 ----a-w- c:\windows\system32\iexpress.exe
2014-01-27 14:31 . 2014-01-27 14:31 151552 ----a-w- c:\windows\SysWow64\iexpress.exe
2014-01-27 14:31 . 2014-01-27 14:31 147968 ----a-w- c:\windows\system32\occache.dll
2014-01-27 14:31 . 2014-01-27 14:31 143872 ----a-w- c:\windows\system32\wextract.exe
2014-01-27 14:31 . 2014-01-27 14:31 139264 ----a-w- c:\windows\SysWow64\wextract.exe
2014-01-27 14:31 . 2014-01-27 14:31 13824 ----a-w- c:\windows\system32\mshta.exe
2014-01-27 14:31 . 2014-01-27 14:31 135680 ----a-w- c:\windows\system32\iepeers.dll
2014-01-27 14:31 . 2014-01-27 14:31 13312 ----a-w- c:\windows\SysWow64\mshta.exe
2014-01-27 14:31 . 2014-01-27 14:31 13312 ----a-w- c:\windows\system32\msfeedssync.exe
2014-01-27 14:31 . 2014-01-27 14:31 131072 ----a-w- c:\windows\system32\IEAdvpack.dll
2014-01-27 14:31 . 2014-01-27 14:31 1228800 ----a-w- c:\windows\system32\mshtmlmedia.dll
2014-01-27 14:31 . 2014-01-27 14:31 111616 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2014-01-27 14:31 . 2014-01-27 14:31 105984 ----a-w- c:\windows\system32\iesysprep.dll
2014-01-27 14:31 . 2014-01-27 14:31 1051136 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2014-01-27 14:31 . 2014-01-27 14:31 101376 ----a-w- c:\windows\system32\inseng.dll
2014-01-27 14:12 . 2014-01-27 14:12 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-01-17 15:24 . 2014-01-17 15:24 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx
2014-01-17 15:24 . 2014-01-17 15:24 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OfficeSyncProcess"="c:\program files (x86)\Microsoft Office\Office14\MSOSYNC.EXE" [2013-04-22 720064]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"LoadFUJ02E3"="c:\program files (x86)\Fujitsu\FUJ02E3\FUJ02E3.exe" [2009-10-08 36712]
"IndicatorUtility"="c:\program files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe" [2009-10-09 47976]
"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2012-11-05 89184]
"PPort9reminder"="c:\program files (x86)\ScanSoft\PaperPort\WebEreg\Ereg.exe" [2004-10-27 729088]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2014-02-05 43848]
"AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-11-02 59240]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2014-03-29 3854640]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2014-01-17 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2014-02-21 152392]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-12-21 959904]
.
c:\users\martin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\
Dropbox.lnk - c:\users\martin\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2014-1-3 30714328]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
LaunchCenter.lnk - c:\program files (x86)\Fujitsu\LaunchCenter\LaunchCenter.exe [2010-6-24 360448]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0sdnclean64.exe
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys;c:\windows\SYSNATIVE\DRIVERS\netaapl64.sys [x]
R3 ONDAusbmdm6k;ONDA Proprietary USB Driver;c:\windows\system32\DRIVERS\ONDAusbmdm6k.sys;c:\windows\SYSNATIVE\DRIVERS\ONDAusbmdm6k.sys [x]
R3 ONDAusbnet;ONDA USB-NDIS miniport;c:\windows\system32\DRIVERS\ONDAusbnet.sys;c:\windows\SYSNATIVE\DRIVERS\ONDAusbnet.sys [x]
R3 ONDAusbnmea;ONDA NMEA Port;c:\windows\system32\DRIVERS\ONDAusbnmea.sys;c:\windows\SYSNATIVE\DRIVERS\ONDAusbnmea.sys [x]
R3 ONDAusbser6k;ONDA Diagnostic Port;c:\windows\system32\DRIVERS\ONDAusbser6k.sys;c:\windows\SYSNATIVE\DRIVERS\ONDAusbser6k.sys [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]
R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys;c:\windows\SYSNATIVE\DRIVERS\Rts516xIR.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S0 gfibto;gfibto;c:\windows\system32\drivers\gfibto.sys;c:\windows\SYSNATIVE\drivers\gfibto.sys [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x]
S2 LavasoftAdAwareService11;Ad-Aware Service 11;c:\program files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe;c:\program files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareService.exe [x]
S2 PowerSavingUtilityService;PowerSavingUtilityService;c:\program files\Fujitsu\PSUtility\PSUService.exe;c:\program files\Fujitsu\PSUtility\PSUService.exe [x]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [x]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S2 VFPRadioSupportService;Unterstützung für Bluetooth-Funktionen;c:\program files\CSR\Bluetooth Feature Pack 5.0\VFPRadioSupportService.exe;c:\program files\CSR\Bluetooth Feature Pack 5.0\VFPRadioSupportService.exe [x]
S2 WirelessSelectorService;WirelessSelectorService;c:\program files\Fujitsu\WirelessSelector\WSUService.exe;c:\program files\Fujitsu\WirelessSelector\WSUService.exe [x]
S3 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x]
S3 FUJ02E3;Fujitsu FUJ02E3 Device Driver;c:\windows\system32\DRIVERS\FUJ02E3.sys;c:\windows\SYSNATIVE\DRIVERS\FUJ02E3.sys [x]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys;c:\windows\SYSNATIVE\DRIVERS\HECIx64.sys [x]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys;c:\windows\SYSNATIVE\DRIVERS\Impcd.sys [x]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 qicflt;upper Device Filter Driver;c:\windows\system32\DRIVERS\qicflt.sys;c:\windows\SYSNATIVE\DRIVERS\qicflt.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-03-15 09:00 1150280 ----a-w- c:\program files (x86)\Google\Chrome\Application\33.0.1750.154\Installer\chrmstp.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{A8D647C8-65AC-409F-B7B2-3C0FEE1A32F2}]
2010-02-16 18:02 114688 ----a-w- c:\program files (x86)\PixiePack Codec Pack\InstallerHelper.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-04-01 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-02-25 17:20]
.
2014-04-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-13 09:32]
.
2014-04-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-10-13 09:32]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2014-03-29 13:24 290888 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-01-12 166424]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-01-12 390680]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-01-12 410136]
"PSUTility"="c:\program files\Fujitsu\PSUtility\TrayManager.exe" [2009-07-30 188264]
"FDM7"="c:\program files\Fujitsu\FDM7\FdmDaemon.exe" [2009-11-26 164712]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-10-28 8312352]
"AdAwareTray"="c:\program files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.1.5354.0\AdAwareTray.exe" [2014-01-23 4114264]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = www.google.com
uDefault_Search_URL = hxxp://www.google.com/ie
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: add to &BOM - c:\\PROGRA~2\\BIET-O~1\\\\AddToBOM.hta
IE: An OneNote s&enden - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\martin\AppData\Roaming\Mozilla\Firefox\Profiles\6pvzp2xy.default\
FF - prefs.js: browser.search.defaulturl - hxxps://www.google.com/search
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.google.de
FF - prefs.js: keyword.URL - hxxps://www.google.com/search
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{6c97a91e-4524-4019-86af-2aa2d567bf5c} - c:\program files (x86)\Lavasoft\AdAware SecureSearch Toolbar\adawareDx.dll
Toolbar-Locked - (no file)
Toolbar-{6c97a91e-4524-4019-86af-2aa2d567bf5c} - c:\program files (x86)\Lavasoft\AdAware SecureSearch Toolbar\adawareDx.dll
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
BHO-{6c97a91e-4524-4019-86af-2aa2d567bf5c} - c:\program files (x86)\Lavasoft\AdAware SecureSearch Toolbar\adawareDx64.dll
Toolbar-Locked - (no file)
Toolbar-{6c97a91e-4524-4019-86af-2aa2d567bf5c} - c:\program files (x86)\Lavasoft\AdAware SecureSearch Toolbar\adawareDx64.dll
AddRemove-SecureW2 EAP Suite - c:\program files (x86)\SecureW2\Uninstall.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_77_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_77_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_77_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_77_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.12"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2014-04-01 21:36:26 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2014-04-01 19:36
.
Vor Suchlauf: 13 Verzeichnis(se), 214.921.674.752 Bytes frei
Nach Suchlauf: 19 Verzeichnis(se), 214.745.489.408 Bytes frei
.
- - End Of File - - 4DF26C62B5F8E940613CA492E504D80E
|
|
02.04.2014, 15:26
| #6 |
| /// TB-Ausbilder | Win32:Dropper-LTG (Drp) - Noch da oder nicht? Servus, nein, nicht so schlimm, ein paar Adware-Reste entfernen wir jetzt: Schritt 1 Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Schritt 2 Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Schritt 3 Downloade Dir bitte  Malwarebytes Anti-Malware
Schritt 4 Bitte lade dir zoek.exe von hier: http://hijackthis.nl/smeenk/
Bitte poste mit deiner nächsten Antwort
|
|
02.04.2014, 22:09
| #7 |
| | Win32:Dropper-LTG (Drp) - Noch da oder nicht? Servus Matthias, ich bin schwer beeindruckt davon, wie du das Problem für mich angehst. Obwohl ich im Vergleich zu dir ein blutiger Laie bin, ist es mir anscheinend gelungen, die von dir gewünschten 4 Punkte "abzuarbeiten". Ich habe alle Logs zusammengefasst. Du findest Sie nachstehend. Falls du das in einer anderen Form brauchst, könnte ich es auch als txt.-Dateianlage schicken. Nochmals vielen Dank und beste Grüße  enterpriseCode:
ATTFilter Logfile AdwCleaberAdwCleaner Logfile: |
|
03.04.2014, 15:52
| #8 |
| /// TB-Ausbilder | Win32:Dropper-LTG (Drp) - Noch da oder nicht? Servus, Wir spüren die letzten Reste auf, damit wir sie später entfernen können: Schritt 1 Kontrollscan mit FRST Führe wie zuvor beschrieben einen Scan mit FRST aus. Setze dazu einen Haken bei Addition.txt rechts unten und klicke auf Scan. Es werden zwei Logdateien erzeugt. Poste mir diese. Schritt 2 Lade dir die passende Version von SystemLook vom folgenden Spiegel herunter und speichere das Tool auf dem Desktop: SystemLook (32 bit) | SystemLook (64 bit)
Gibt es noch Probleme mit der von dir genannten Meldung deines AV-Programms? Wie läuft der Rechner derzeit? Bitte poste mit deiner nächsten Antwort
|
|
03.04.2014, 18:53
| #9 |
| | Win32:Dropper-LTG (Drp) - Noch da oder nicht? Servius, kling für mich eingermaßen beruhigend, dass es nur noch "Reste" sind. Viele Grüße, Hermann (enterprise). Code:
ATTFilter Logdateien FRST:FRST Additions Logfile: |
|
03.04.2014, 19:31
| #10 |
| /// TB-Ausbilder | Win32:Dropper-LTG (Drp) - Noch da oder nicht? Servus, poste bitte noch die FRST.txt, dann kann es weitergehen. |
|
03.04.2014, 19:54
| #11 |
| | Win32:Dropper-LTG (Drp) - Noch da oder nicht? Sorry, die hatte ich wohl vergessen :-) FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014
Ran by martin (administrator) on MARTIN-PC on 03-04-2014 19:43:30
Running from C:\Users\martin\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(FUJITSU LIMITED) C:\Program Files\Fujitsu\PSUtility\PSUService.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(CSR, plc) C:\Program Files\CSR\Bluetooth Feature Pack 5.0\VFPRadioSupportService.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(FUJITSU LIMITED) C:\Program Files\Fujitsu\PSUtility\TrayManager.exe
() C:\Program Files\Fujitsu\WirelessSelector\WSUService.exe
(FUJITSU LIMITED) C:\Program Files\Fujitsu\FDM7\FdmDaemon.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Dropbox, Inc.) C:\Users\martin\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(FUJITSU LIMITED) C:\Program Files (x86)\Fujitsu\FUJ02E3\FUJ02E3.exe
(FUJITSU LIMITED) C:\Program Files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
() C:\Windows\system32\LFXGDIPO.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [PSUTility] - C:\Program Files\Fujitsu\PSUtility\TrayManager.exe [188264 2009-07-30] (FUJITSU LIMITED)
HKLM\...\Run: [FDM7] - C:\Program Files\Fujitsu\FDM7\FdmDaemon.exe [164712 2009-11-26] (FUJITSU LIMITED)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8312352 2009-10-28] (Realtek Semiconductor)
HKLM-x32\...\Run: [LoadFUJ02E3] - C:\Program Files (x86)\Fujitsu\FUJ02E3\FUJ02E3.exe [36712 2009-10-08] (FUJITSU LIMITED)
HKLM-x32\...\Run: [IndicatorUtility] - C:\Program Files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe [47976 2009-10-09] (FUJITSU LIMITED)
HKLM-x32\...\Run: [BCSSync] - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [PPort9reminder] - C:\Program Files (x86)\ScanSoft\PaperPort\WebEreg\Ereg.exe [729088 2004-10-27] (ScanSoft, Inc.)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-06] (Apple Inc.)
HKLM-x32\...\Run: [AppleSyncNotifier] - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [59240 2011-11-02] (Apple Inc.)
HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3854640 2014-03-29] (AVAST Software)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-4294004471-4141303439-88424932-1001\...\Run: [OfficeSyncProcess] - C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE [720064 2013-04-22] (Microsoft Corporation)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\LaunchCenter.lnk
ShortcutTarget: LaunchCenter.lnk -> C:\Program Files (x86)\Fujitsu\LaunchCenter\LaunchCenter.exe (Fujitsu Technology Solutions)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\LaunchCenter.lnk
ShortcutTarget: LaunchCenter.lnk -> C:\Program Files (x86)\Fujitsu\LaunchCenter\LaunchCenter.exe (Fujitsu Technology Solutions)
Startup: C:\Users\martin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\martin\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
==================== Internet (Whitelisted) ====================
ProxyServer: :0
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=FTSF&bmod=FTSF
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: af0.Adblock.BHO - {90EFF544-3981-4d46-85C9-C0361D0931D6} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM-x32 {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://eu.maxlite.mobi/dana-cached/sc/JuniperSetupClient.cab
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\martin\AppData\Roaming\Mozilla\Firefox\Profiles\6pvzp2xy.default
FF NewTab: hxxp://www.google.com/
FF SearchEngineOrder.1: Google
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.google.de
FF Keyword.URL: hxxp://www.google.com/search?btnG=Google+Search&q=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Delicious Bookmarks - C:\Users\martin\AppData\Roaming\Mozilla\Firefox\Profiles\6pvzp2xy.default\Extensions\{2fa4ed95-0317-4c6a-a74c-5f3e3912c1f9} [2012-10-18]
FF Extension: Bitdefender QuickScan - C:\Users\martin\AppData\Roaming\Mozilla\Firefox\Profiles\6pvzp2xy.default\Extensions\{e001c731-5e37-4538-a5cb-8168736a2360} [2012-10-18]
FF Extension: Adblock Plus - C:\Users\martin\AppData\Roaming\Mozilla\Firefox\Profiles\6pvzp2xy.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011-05-27]
Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (Google Wallet) - C:\Users\martin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]
==================== Services (Whitelisted) =================
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-03-29] (AVAST Software)
R2 PowerSavingUtilityService; C:\Program Files\Fujitsu\PSUtility\PSUService.exe [63336 2009-07-30] (FUJITSU LIMITED)
S3 TestHandler; C:\Program Files (x86)\Fujitsu\SystemDiagnostics\OnlineDiagnostic\TestManager\HaDTMan.exe [384792 2010-09-24] (Fujitsu Technology Solutions)
R2 VFPRadioSupportService; C:\Program Files\CSR\Bluetooth Feature Pack 5.0\VFPRadioSupportService.exe [145840 2009-12-24] (CSR, plc)
R2 WirelessSelectorService; C:\Program Files\Fujitsu\WirelessSelector\WSUService.exe [62312 2009-07-21] ()
==================== Drivers (Whitelisted) ====================
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-03-29] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-03-29] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-03-29] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-03-29] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-03-29] (AVAST Software)
R3 aswStm; C:\Windows\system32\drivers\aswStm.sys [84816 2014-03-29] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208928 2014-03-29] ()
R3 FUJ02B1; C:\Windows\System32\DRIVERS\FUJ02B1.sys [7808 2006-11-01] (FUJITSU LIMITED)
R3 FUJ02E3; C:\Windows\System32\DRIVERS\FUJ02E3.sys [7296 2006-11-01] (FUJITSU LIMITED)
R0 gfibto; C:\Windows\System32\drivers\gfibto.sys [14456 2013-07-04] (GFI Software)
S3 ONDAusbmdm6k; C:\Windows\System32\DRIVERS\ONDAusbmdm6k.sys [150656 2008-09-16] (ONDA Incorporated)
S3 ONDAusbnet; C:\Windows\System32\DRIVERS\ONDAusbnet.sys [167424 2008-09-16] (ONDA Corporation)
S3 ONDAusbnmea; C:\Windows\System32\DRIVERS\ONDAusbnmea.sys [150656 2008-09-16] (ONDA Incorporated)
S3 ONDAusbser6k; C:\Windows\System32\DRIVERS\ONDAusbser6k.sys [150656 2008-09-16] (ONDA Incorporated)
S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [27520 2007-05-14] (Research In Motion Limited)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [X]
S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-04-03 19:43 - 2014-04-03 19:43 - 00015353 _____ () C:\Users\martin\Desktop\FRST.txt
2014-04-03 18:54 - 2014-04-03 18:54 - 00000165 ____H () C:\Users\martin\Documents\~$Buchungen 2014.xlsx
2014-04-03 00:04 - 2014-04-03 08:07 - 00000112 _____ () C:\Windows\setupact.log
2014-04-03 00:04 - 2014-04-03 00:04 - 00000000 _____ () C:\Windows\setuperr.log
2014-04-02 22:58 - 2014-04-02 22:42 - 00024064 _____ () C:\Windows\zoek-delete.exe
2014-04-02 22:43 - 2014-04-02 23:01 - 00013468 _____ () C:\zoek-results.log
2014-04-02 22:42 - 2014-04-02 22:54 - 00000000 ____D () C:\zoek_backup
2014-04-02 22:42 - 2014-04-02 22:42 - 01285120 _____ () C:\Users\martin\Desktop\zoek.exe
2014-04-02 19:34 - 2014-04-02 19:34 - 00000000 ____D () C:\Windows\ERUNT
2014-04-02 19:32 - 2014-03-23 22:41 - 01038974 _____ (Thisisu) C:\Users\martin\Desktop\JRT_NEW.exe
2014-04-02 19:30 - 2014-04-02 19:30 - 01037734 _____ (Thisisu) C:\Users\martin\Downloads\JRT_6.1.2.exe
2014-04-02 19:27 - 2014-04-02 23:03 - 00020770 _____ () C:\Users\martin\Desktop\Protokoll.txt
2014-04-02 19:13 - 2014-04-02 19:23 - 00000000 ____D () C:\AdwCleaner
2014-04-02 19:11 - 2014-04-02 19:11 - 01426178 _____ () C:\Users\martin\Desktop\adwcleaner3023.exe
2014-04-02 18:43 - 2014-04-02 18:43 - 00000047 _____ () C:\Users\martin\AppData\Roaming\WB.CFG
2014-04-01 21:36 - 2014-04-01 21:36 - 00029685 _____ () C:\ComboFix.txt
2014-04-01 21:13 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-04-01 21:13 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-04-01 21:13 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-04-01 21:13 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-04-01 21:13 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-04-01 21:13 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-04-01 21:13 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-04-01 21:13 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-04-01 21:12 - 2014-04-01 21:36 - 00000000 ____D () C:\Qoobox
2014-04-01 21:11 - 2014-04-01 21:34 - 00000000 ____D () C:\Windows\erdnt
2014-04-01 21:03 - 2014-04-01 21:04 - 05192353 ____R (Swearware) C:\Users\martin\Desktop\ComboFix.exe
2014-04-01 15:05 - 2014-04-01 15:05 - 00001985 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk
2014-04-01 15:05 - 2014-04-01 15:05 - 00000000 ____D () C:\Users\martin\AppData\Roaming\Oracle
2014-04-01 15:04 - 2014-04-01 15:04 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-04-01 08:21 - 2014-04-01 21:28 - 00000000 ____D () C:\Program Files (x86)\Lavasoft
2014-04-01 08:21 - 2014-04-01 08:22 - 00000000 ____D () C:\ProgramData\Ad-Aware Browsing Protection
2014-04-01 08:19 - 2014-04-01 08:19 - 01727624 _____ () C:\Users\martin\Downloads\Adaware_Installer_11153540.exe
2014-04-01 08:18 - 2014-04-01 08:18 - 00003150 _____ () C:\Windows\System32\Tasks\{61C75910-2343-4DBA-9844-339F75661779}
2014-04-01 08:18 - 2014-04-01 08:18 - 00000000 ____D () C:\ProgramData\Lavasoft
2014-03-30 22:19 - 2014-03-30 22:19 - 00000000 ____D () C:\Users\martin\AppData\Roaming\Opera Software
2014-03-30 22:19 - 2014-03-30 22:19 - 00000000 ____D () C:\Users\martin\AppData\Local\Opera Software
2014-03-30 22:17 - 2014-04-02 19:44 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-03-30 22:16 - 2014-03-30 22:16 - 00001068 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-03-30 22:16 - 2014-03-30 22:16 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-03-30 22:16 - 2014-03-05 09:26 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-03-30 22:16 - 2014-03-05 09:26 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-03-30 22:16 - 2014-03-05 09:26 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-03-30 22:15 - 2014-03-30 23:25 - 00000000 ____D () C:\Program Files (x86)\Opera
2014-03-30 22:15 - 2014-03-30 22:15 - 00003258 _____ () C:\Windows\System32\Tasks\Opera D7
2014-03-30 22:15 - 2014-03-30 22:15 - 00003258 _____ () C:\Windows\System32\Tasks\Opera D6
2014-03-30 22:15 - 2014-03-30 22:15 - 00003258 _____ () C:\Windows\System32\Tasks\Opera D5
2014-03-30 22:15 - 2014-03-30 22:15 - 00003258 _____ () C:\Windows\System32\Tasks\Opera D4
2014-03-30 20:15 - 2014-03-30 20:15 - 00053000 _____ () C:\Users\martin\Downloads\Shortcut.txt
2014-03-30 20:13 - 2014-03-30 20:15 - 00035605 _____ () C:\Users\martin\Downloads\Addition.txt
2014-03-30 20:12 - 2014-04-03 19:43 - 00000000 ____D () C:\FRST
2014-03-30 20:12 - 2014-03-30 20:15 - 00069284 _____ () C:\Users\martin\Downloads\FRST.txt
2014-03-30 20:12 - 2014-03-30 20:12 - 02157056 _____ (Farbar) C:\Users\martin\Desktop\FRST64.exe
2014-03-30 09:53 - 2014-03-30 09:53 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-03-29 15:24 - 2014-03-29 15:24 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-03-29 14:51 - 2014-03-29 15:15 - 00000000 ____D () C:\Users\martin\AppData\Roaming\Security System 2
2014-03-29 14:51 - 2014-03-29 15:15 - 00000000 ____D () C:\Users\martin\AppData\Roaming\BupSystem
2014-03-25 10:01 - 2014-03-25 10:01 - 00001116 _____ () C:\Users\martin\Downloads\BAHN_Fahrplan_20140328.ics
2014-03-18 17:33 - 2014-03-18 17:43 - 91099924 _____ () C:\Users\martin\Downloads\wetransfer-8f3f18.zip
2014-03-18 13:37 - 2014-03-18 13:52 - 00000000 ____D () C:\Users\martin\Documents\wetransfer-e6941c
2014-03-18 10:28 - 2014-03-18 10:28 - 00079872 _____ () C:\Users\martin\Downloads\agency_occupancy_march17_2014.xls
2014-03-17 09:05 - 2014-01-09 04:22 - 05694464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-03-17 09:05 - 2014-01-04 00:44 - 06574592 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-03-17 00:07 - 2014-03-20 17:49 - 00000000 ____D () C:\Users\martin\Desktop\ebay-bilder
2014-03-16 16:03 - 2014-03-16 16:03 - 00001749 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-03-16 16:02 - 2014-03-16 16:03 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-03-16 16:02 - 2014-03-16 16:03 - 00000000 ____D () C:\Program Files\iTunes
2014-03-16 16:02 - 2014-03-16 16:03 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-03-16 16:02 - 2014-03-16 16:02 - 00000000 ____D () C:\Program Files\iPod
2014-03-16 15:55 - 2014-03-16 15:55 - 00001811 _____ () C:\Users\Public\Desktop\QuickTime Player.lnk
2014-03-16 15:55 - 2014-03-16 15:55 - 00000000 ____D () C:\Program Files (x86)\QuickTime
2014-03-15 10:02 - 2013-10-02 04:22 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys
2014-03-15 10:02 - 2013-10-02 04:11 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2014-03-15 10:02 - 2013-10-02 04:08 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2014-03-15 10:02 - 2013-10-02 03:48 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll
2014-03-15 10:02 - 2013-10-02 03:48 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll
2014-03-15 10:02 - 2013-10-02 03:29 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2014-03-15 10:02 - 2013-10-02 03:10 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll
2014-03-15 10:02 - 2013-10-02 02:15 - 01057280 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2014-03-15 10:02 - 2013-10-02 02:14 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll
2014-03-15 10:02 - 2013-10-02 02:14 - 00017920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll
2014-03-15 10:02 - 2013-10-02 02:08 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2014-03-15 10:02 - 2013-10-02 02:01 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2014-03-15 10:02 - 2013-10-02 01:58 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2014-03-15 10:02 - 2013-10-02 01:31 - 01147392 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2014-03-15 10:02 - 2013-10-02 01:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll
2014-03-15 10:02 - 2013-10-02 00:34 - 01068544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2014-03-15 09:54 - 2014-03-01 08:05 - 23133696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-15 09:54 - 2014-03-01 07:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-15 09:54 - 2014-03-01 07:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-03-15 09:54 - 2014-03-01 06:58 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-03-15 09:54 - 2014-03-01 06:52 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-03-15 09:54 - 2014-03-01 06:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-03-15 09:54 - 2014-03-01 06:42 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-03-15 09:54 - 2014-03-01 06:40 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-03-15 09:54 - 2014-03-01 06:37 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-03-15 09:54 - 2014-03-01 06:33 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-03-15 09:54 - 2014-03-01 06:33 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-03-15 09:54 - 2014-03-01 06:32 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-03-15 09:54 - 2014-03-01 06:30 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-03-15 09:54 - 2014-03-01 06:23 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-03-15 09:54 - 2014-03-01 06:17 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-03-15 09:54 - 2014-03-01 06:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-03-15 09:54 - 2014-03-01 06:02 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-03-15 09:54 - 2014-03-01 05:54 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-03-15 09:54 - 2014-03-01 05:52 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-03-15 09:54 - 2014-03-01 05:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-03-15 09:54 - 2014-03-01 05:47 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-03-15 09:54 - 2014-03-01 05:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-03-15 09:54 - 2014-03-01 05:43 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-03-15 09:54 - 2014-03-01 05:42 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-03-15 09:54 - 2014-03-01 05:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-03-15 09:54 - 2014-03-01 05:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-03-15 09:54 - 2014-03-01 05:37 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-03-15 09:54 - 2014-03-01 05:35 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-03-15 09:54 - 2014-03-01 05:18 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-03-15 09:54 - 2014-03-01 05:16 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-03-15 09:54 - 2014-03-01 05:14 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-03-15 09:54 - 2014-03-01 05:10 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-03-15 09:54 - 2014-03-01 05:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-03-15 09:54 - 2014-03-01 05:00 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-03-15 09:54 - 2014-03-01 04:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-03-15 09:54 - 2014-03-01 04:38 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-03-15 09:54 - 2014-03-01 04:32 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-03-15 09:54 - 2014-03-01 04:27 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-03-15 09:54 - 2014-03-01 04:25 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-03-15 09:54 - 2014-03-01 04:25 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-03-15 09:54 - 2014-02-07 03:23 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-03-15 09:54 - 2014-01-29 04:32 - 00484864 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2014-03-15 09:54 - 2014-01-29 04:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll
2014-03-15 09:54 - 2014-01-28 04:32 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2014-03-15 09:54 - 2013-09-25 04:23 - 01030144 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2014-03-15 09:54 - 2013-09-25 03:57 - 00792576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll
2014-03-15 09:53 - 2014-02-04 04:32 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-03-15 09:53 - 2014-02-04 04:32 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-03-15 09:53 - 2014-02-04 04:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-03-15 09:53 - 2014-02-04 04:04 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-03-15 06:04 - 2014-03-15 06:04 - 00005048 _____ () C:\Users\martin\Downloads\=_utf-8_B_RndkIFdHIFdJQ0hUSUcgZsO8ciBSZW50ZSBBbmVya2VubnVuZyB2b24genU=_= =_utf-8_B_cyBFcnppZWh1bmdzemVpdGVuIGJlaSBLaW5kZXJuIHZvciAxOTkyLnppcA==_=
2014-03-13 20:36 - 2014-03-14 00:09 - 00012496 _____ () C:\Users\martin\Downloads\Einladungsliste_ 2014_03_Rita_Geb 000 (1).xlsx
2014-03-12 19:20 - 2014-03-12 19:20 - 05777288 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-03-06 23:07 - 2014-03-06 23:07 - 04765152 _____ (Piriform Ltd) C:\Users\martin\Downloads\ccsetup411.exe
2014-03-06 14:19 - 2014-03-06 14:19 - 00272482 _____ () C:\Users\martin\Downloads\=_utf-8_B_SW1tb3dlbHQgVGVpbG5haG1lYmVzdMOkdGlndW5nIDU0MjQ5NC5wZGY=_=
2014-03-05 23:58 - 2013-12-21 11:53 - 00548864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-03-05 23:58 - 2013-12-21 10:56 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-03-05 23:55 - 2014-01-01 01:05 - 00420008 _____ () C:\Windows\SysWOW64\locale.nls
2014-03-05 23:55 - 2014-01-01 01:04 - 00420008 _____ () C:\Windows\system32\locale.nls
2014-03-05 23:55 - 2013-12-25 01:09 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-03-05 23:55 - 2013-12-25 00:48 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-03-05 23:55 - 2013-12-06 04:30 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-03-05 23:55 - 2013-12-06 04:30 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-03-05 23:55 - 2013-12-06 04:02 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-03-05 23:55 - 2013-12-06 04:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-03-05 23:55 - 2013-12-04 04:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll
2014-03-05 23:55 - 2013-12-04 04:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll
2014-03-05 23:55 - 2013-12-04 04:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll
2014-03-05 23:55 - 2013-12-04 04:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll
2014-03-05 23:55 - 2013-12-04 04:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll
2014-03-05 23:55 - 2013-12-04 04:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe
2014-03-05 23:55 - 2013-12-04 04:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe
2014-03-05 23:55 - 2013-12-04 04:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe
2014-03-05 23:55 - 2013-12-04 04:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe
2014-03-05 23:55 - 2013-12-04 04:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll
2014-03-05 23:55 - 2013-12-04 04:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll
2014-03-05 23:55 - 2013-12-04 04:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll
2014-03-05 23:55 - 2013-12-04 04:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll
2014-03-05 23:55 - 2013-12-04 04:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll
2014-03-05 23:55 - 2013-12-04 03:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe
2014-03-05 23:55 - 2013-12-04 03:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe
2014-03-05 23:55 - 2013-12-04 03:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe
2014-03-05 23:55 - 2013-12-04 03:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe
2014-03-05 23:55 - 2013-11-26 10:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2014-03-05 23:55 - 2013-11-23 00:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
==================== One Month Modified Files and Folders =======
2014-04-03 19:43 - 2014-04-03 19:43 - 00015353 _____ () C:\Users\martin\Desktop\FRST.txt
2014-04-03 19:43 - 2014-03-30 20:12 - 00000000 ____D () C:\FRST
2014-04-03 19:20 - 2013-02-25 20:09 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-03 18:59 - 2014-01-03 12:28 - 00036707 _____ () C:\Users\martin\Documents\Buchungen 2014.xlsx
2014-04-03 18:54 - 2014-04-03 18:54 - 00000165 ____H () C:\Users\martin\Documents\~$Buchungen 2014.xlsx
2014-04-03 18:51 - 2010-10-13 11:32 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-03 18:20 - 2013-12-14 14:17 - 01323690 _____ () C:\Windows\WindowsUpdate.log
2014-04-03 17:37 - 2010-11-30 17:50 - 00000436 _____ () C:\Windows\system32\Drivers\etc\hosts.ics
2014-04-03 16:51 - 2010-10-13 11:32 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-03 08:15 - 2009-07-14 06:45 - 00009920 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-03 08:15 - 2009-07-14 06:45 - 00009920 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-03 08:08 - 2011-10-27 12:29 - 00000000 ___RD () C:\Users\martin\Dropbox
2014-04-03 08:08 - 2011-10-27 12:26 - 00000000 ____D () C:\Users\martin\AppData\Roaming\Dropbox
2014-04-03 08:07 - 2014-04-03 00:04 - 00000112 _____ () C:\Windows\setupact.log
2014-04-03 08:07 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-03 00:04 - 2014-04-03 00:04 - 00000000 _____ () C:\Windows\setuperr.log
2014-04-02 23:03 - 2014-04-02 19:27 - 00020770 _____ () C:\Users\martin\Desktop\Protokoll.txt
2014-04-02 23:01 - 2014-04-02 22:43 - 00013468 _____ () C:\zoek-results.log
2014-04-02 22:54 - 2014-04-02 22:42 - 00000000 ____D () C:\zoek_backup
2014-04-02 22:42 - 2014-04-02 22:58 - 00024064 _____ () C:\Windows\zoek-delete.exe
2014-04-02 22:42 - 2014-04-02 22:42 - 01285120 _____ () C:\Users\martin\Desktop\zoek.exe
2014-04-02 22:30 - 2014-01-11 19:03 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-04-02 19:44 - 2014-03-30 22:17 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-02 19:34 - 2014-04-02 19:34 - 00000000 ____D () C:\Windows\ERUNT
2014-04-02 19:30 - 2014-04-02 19:30 - 01037734 _____ (Thisisu) C:\Users\martin\Downloads\JRT_6.1.2.exe
2014-04-02 19:23 - 2014-04-02 19:13 - 00000000 ____D () C:\AdwCleaner
2014-04-02 19:11 - 2014-04-02 19:11 - 01426178 _____ () C:\Users\martin\Desktop\adwcleaner3023.exe
2014-04-02 18:43 - 2014-04-02 18:43 - 00000047 _____ () C:\Users\martin\AppData\Roaming\WB.CFG
2014-04-01 22:00 - 2011-09-17 20:45 - 00000000 ____D () C:\Users\martin\AppData\Local\CrashDumps
2014-04-01 21:59 - 2012-02-26 17:31 - 00001381 _____ () C:\Users\martin\Desktop\Internet Explorer (64-bit).lnk
2014-04-01 21:36 - 2014-04-01 21:36 - 00029685 _____ () C:\ComboFix.txt
2014-04-01 21:36 - 2014-04-01 21:12 - 00000000 ____D () C:\Qoobox
2014-04-01 21:36 - 2010-10-13 11:34 - 00000000 ____D () C:\Users\TxR
2014-04-01 21:36 - 2010-10-13 11:34 - 00000000 ____D () C:\Users\systemprofile
2014-04-01 21:36 - 2010-10-13 11:34 - 00000000 ____D () C:\Users\RegBack
2014-04-01 21:36 - 2010-10-13 11:34 - 00000000 ____D () C:\Users\Journal
2014-04-01 21:36 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2014-04-01 21:34 - 2014-04-01 21:11 - 00000000 ____D () C:\Windows\erdnt
2014-04-01 21:34 - 2010-04-26 15:06 - 00700118 _____ () C:\Windows\system32\perfh007.dat
2014-04-01 21:34 - 2010-04-26 15:06 - 00149968 _____ () C:\Windows\system32\perfc007.dat
2014-04-01 21:34 - 2009-07-14 07:13 - 01622164 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-01 21:29 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-04-01 21:28 - 2014-04-01 08:21 - 00000000 ____D () C:\Program Files (x86)\Lavasoft
2014-04-01 21:04 - 2014-04-01 21:03 - 05192353 ____R (Swearware) C:\Users\martin\Desktop\ComboFix.exe
2014-04-01 15:05 - 2014-04-01 15:05 - 00001985 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk
2014-04-01 15:05 - 2014-04-01 15:05 - 00000000 ____D () C:\Users\martin\AppData\Roaming\Oracle
2014-04-01 15:05 - 2010-10-13 11:37 - 00000000 ____D () C:\Users\martin\AppData\Local\Adobe
2014-04-01 15:04 - 2014-04-01 15:04 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-04-01 15:04 - 2010-10-13 11:32 - 00000000 ____D () C:\ProgramData\Adobe
2014-04-01 08:22 - 2014-04-01 08:21 - 00000000 ____D () C:\ProgramData\Ad-Aware Browsing Protection
2014-04-01 08:19 - 2014-04-01 08:19 - 01727624 _____ () C:\Users\martin\Downloads\Adaware_Installer_11153540.exe
2014-04-01 08:18 - 2014-04-01 08:18 - 00003150 _____ () C:\Windows\System32\Tasks\{61C75910-2343-4DBA-9844-339F75661779}
2014-04-01 08:18 - 2014-04-01 08:18 - 00000000 ____D () C:\ProgramData\Lavasoft
2014-04-01 01:06 - 2010-11-12 23:00 - 00000000 ____D () C:\Users\martin\AppData\Roaming\QuickScan
2014-03-31 09:39 - 2012-05-13 19:49 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-03-30 23:25 - 2014-03-30 22:15 - 00000000 ____D () C:\Program Files (x86)\Opera
2014-03-30 22:19 - 2014-03-30 22:19 - 00000000 ____D () C:\Users\martin\AppData\Roaming\Opera Software
2014-03-30 22:19 - 2014-03-30 22:19 - 00000000 ____D () C:\Users\martin\AppData\Local\Opera Software
2014-03-30 22:16 - 2014-03-30 22:16 - 00001068 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-03-30 22:16 - 2014-03-30 22:16 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-03-30 22:16 - 2013-05-30 19:36 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-03-30 22:15 - 2014-03-30 22:15 - 00003258 _____ () C:\Windows\System32\Tasks\Opera D7
2014-03-30 22:15 - 2014-03-30 22:15 - 00003258 _____ () C:\Windows\System32\Tasks\Opera D6
2014-03-30 22:15 - 2014-03-30 22:15 - 00003258 _____ () C:\Windows\System32\Tasks\Opera D5
2014-03-30 22:15 - 2014-03-30 22:15 - 00003258 _____ () C:\Windows\System32\Tasks\Opera D4
2014-03-30 20:15 - 2014-03-30 20:15 - 00053000 _____ () C:\Users\martin\Downloads\Shortcut.txt
2014-03-30 20:15 - 2014-03-30 20:13 - 00035605 _____ () C:\Users\martin\Downloads\Addition.txt
2014-03-30 20:15 - 2014-03-30 20:12 - 00069284 _____ () C:\Users\martin\Downloads\FRST.txt
2014-03-30 20:12 - 2014-03-30 20:12 - 02157056 _____ (Farbar) C:\Users\martin\Desktop\FRST64.exe
2014-03-30 16:46 - 2010-10-13 11:32 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-03-30 16:46 - 2010-10-13 11:32 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-03-30 09:53 - 2014-03-30 09:53 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-03-29 15:57 - 2010-10-13 12:15 - 00002129 _____ () C:\Users\martin\Desktop\Google Chrome.lnk
2014-03-29 15:45 - 2010-10-13 19:49 - 01596444 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-03-29 15:34 - 2010-12-05 15:38 - 00000983 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-03-29 15:34 - 2010-10-13 12:01 - 00000000 ____D () C:\Program Files (x86)\CCleaner
2014-03-29 15:24 - 2014-03-29 15:24 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-03-29 15:24 - 2014-01-11 19:04 - 00001972 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-03-29 15:24 - 2014-01-11 19:03 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2014-03-29 15:24 - 2014-01-11 19:03 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2014-03-29 15:24 - 2014-01-11 19:03 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-03-29 15:24 - 2014-01-11 19:03 - 00208928 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-03-29 15:24 - 2014-01-11 19:03 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-03-29 15:24 - 2014-01-11 19:03 - 00084816 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2014-03-29 15:24 - 2014-01-11 19:03 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-03-29 15:24 - 2014-01-11 19:03 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-03-29 15:19 - 2010-10-13 20:37 - 00000000 ____D () C:\Windows\System32\Tasks\Games
2014-03-29 15:17 - 2010-10-13 11:37 - 00000000 ____D () C:\Users\martin
2014-03-29 15:16 - 2014-02-10 23:52 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-03-29 15:16 - 2012-02-26 14:30 - 00000000 ____D () C:\Users\Administrator
2014-03-29 15:16 - 2010-10-13 20:21 - 00000000 ____D () C:\Users\martin\AppData\Roaming\BOM
2014-03-29 15:16 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\AppCompat
2014-03-29 15:15 - 2014-03-29 14:51 - 00000000 ____D () C:\Users\martin\AppData\Roaming\Security System 2
2014-03-29 15:15 - 2014-03-29 14:51 - 00000000 ____D () C:\Users\martin\AppData\Roaming\BupSystem
2014-03-29 15:15 - 2012-02-26 17:34 - 00000000 ____D () C:\Users\martin\AppData\Local\Thunderbird
2014-03-29 15:15 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration
2014-03-29 15:14 - 2010-10-20 12:22 - 00000000 __RHD () C:\MSOCache
2014-03-25 14:37 - 2011-09-17 22:09 - 00000000 ____D () C:\Users\martin\Documents\Outlook-Dateien
2014-03-25 10:01 - 2014-03-25 10:01 - 00001116 _____ () C:\Users\martin\Downloads\BAHN_Fahrplan_20140328.ics
2014-03-23 22:41 - 2014-04-02 19:32 - 01038974 _____ (Thisisu) C:\Users\martin\Desktop\JRT_NEW.exe
2014-03-21 17:28 - 2012-09-17 14:08 - 00000000 ____D () C:\Users\martin\AppData\Roaming\TeamViewer
2014-03-20 17:49 - 2014-03-17 00:07 - 00000000 ____D () C:\Users\martin\Desktop\ebay-bilder
2014-03-20 09:43 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-03-18 17:43 - 2014-03-18 17:33 - 91099924 _____ () C:\Users\martin\Downloads\wetransfer-8f3f18.zip
2014-03-18 13:52 - 2014-03-18 13:37 - 00000000 ____D () C:\Users\martin\Documents\wetransfer-e6941c
2014-03-18 10:28 - 2014-03-18 10:28 - 00079872 _____ () C:\Users\martin\Downloads\agency_occupancy_march17_2014.xls
2014-03-17 18:09 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-03-16 16:03 - 2014-03-16 16:03 - 00001749 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-03-16 16:03 - 2014-03-16 16:02 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-03-16 16:03 - 2014-03-16 16:02 - 00000000 ____D () C:\Program Files\iTunes
2014-03-16 16:03 - 2014-03-16 16:02 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-03-16 16:02 - 2014-03-16 16:02 - 00000000 ____D () C:\Program Files\iPod
2014-03-16 15:55 - 2014-03-16 15:55 - 00001811 _____ () C:\Users\Public\Desktop\QuickTime Player.lnk
2014-03-16 15:55 - 2014-03-16 15:55 - 00000000 ____D () C:\Program Files (x86)\QuickTime
2014-03-15 10:27 - 2009-07-14 06:45 - 00431912 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-03-15 10:26 - 2013-03-13 23:50 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-03-15 10:25 - 2013-03-13 23:50 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-03-15 10:03 - 2011-02-25 11:49 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-03-15 10:01 - 2013-10-04 23:25 - 00000000 ____D () C:\Windows\system32\MRT
2014-03-15 09:59 - 2010-10-17 10:58 - 90015360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-03-15 06:04 - 2014-03-15 06:04 - 00005048 _____ () C:\Users\martin\Downloads\=_utf-8_B_RndkIFdHIFdJQ0hUSUcgZsO8ciBSZW50ZSBBbmVya2VubnVuZyB2b24genU=_= =_utf-8_B_cyBFcnppZWh1bmdzemVpdGVuIGJlaSBLaW5kZXJuIHZvciAxOTkyLnppcA==_=
2014-03-14 00:09 - 2014-03-13 20:36 - 00012496 _____ () C:\Users\martin\Downloads\Einladungsliste_ 2014_03_Rita_Geb 000 (1).xlsx
2014-03-12 19:20 - 2014-03-12 19:20 - 05777288 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-03-12 19:20 - 2013-02-25 20:09 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-03-12 19:20 - 2013-02-25 20:09 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-03-12 19:20 - 2011-07-28 10:08 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-03-06 23:07 - 2014-03-06 23:07 - 04765152 _____ (Piriform Ltd) C:\Users\martin\Downloads\ccsetup411.exe
2014-03-06 14:19 - 2014-03-06 14:19 - 00272482 _____ () C:\Users\martin\Downloads\=_utf-8_B_SW1tb3dlbHQgVGVpbG5haG1lYmVzdMOkdGlndW5nIDU0MjQ5NC5wZGY=_=
2014-03-05 23:59 - 2009-07-14 04:34 - 00000478 _____ () C:\Windows\win.ini
2014-03-05 09:26 - 2014-03-30 22:16 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-03-05 09:26 - 2014-03-30 22:16 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-03-05 09:26 - 2014-03-30 22:16 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-03-30 10:32
==================== End Of Log ============================
|
|
03.04.2014, 20:08
| #12 |
| /// TB-Ausbilder | Win32:Dropper-LTG (Drp) - Noch da oder nicht? Servus, Wir entfernen die letzten Reste und kontrollieren nochmal alles. ESET kann länger (> 2 h) dauern. Im Anschluss daran räumen wir auf und ich gebe dir noch ein paar Tipps mit auf den Weg. Schritt 1 Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter start
ProxyServer: :0
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
Task: {5036AD75-CCEA-4D8A-8FB4-31E1482142E6} - \Digital Sites No Task File
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{62155D33-3CE2-401E-8967-5A270628A3D5}" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{62155D33-3CE2-401E-8967-5A270628A3D5}" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ba20b5da-0f48-40c5-b8c9-2cda4ecf75c2}" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\Toolbar Cleaner uninstall_RASAPI32" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\Toolbar Cleaner uninstall_RASMANCS" /f
Reg: reg delete "HKEY_CURRENT_USER\S-1-5-21-4294004471-4141303439-88424932-1001\Software\adawaretb" /f
end
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Schritt 2 Downloade dir die passende Version von HitmanPro auf deinen Desktop: HitmanPro - 32 Bit | HitmanPro - 64 Bit.
Schritt 3 ESET Online Scanner
Schritt 4 Downloade Dir bitte  SecurityCheck und:
Bitte poste mit deiner nächsten Antwort
|
|
04.04.2014, 17:28
| #13 |
| | Win32:Dropper-LTG (Drp) - Noch da oder nicht? Servus, ich bin etwas verunsichert. Denn bei Schritt 3 ist der Rechner beim ESET Scan nach ca. 50 Minuten plötzlich abgeschmiert. Ich schicke dir mal FRST und Hitman und warte, was du sagst. Soll ich mit den Schritten 3 und 4 weitermachen? Viele Grüße. enterprise FRST: Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 13-03-2014
Ran by martin at 2014-04-03 21:17:08 Run:1
Running from C:\Users\martin\Desktop
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
start
ProxyServer: :0
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
Task: {5036AD75-CCEA-4D8A-8FB4-31E1482142E6} - \Digital Sites No Task File
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{62155D33-3CE2-401E-8967-5A270628A3D5}" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{62155D33-3CE2-401E-8967-5A270628A3D5}" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ba20b5da-0f48-40c5-b8c9-2cda4ecf75c2}" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\Toolbar Cleaner uninstall_RASAPI32" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\Toolbar Cleaner uninstall_RASMANCS" /f
Reg: reg delete "HKEY_CURRENT_USER\S-1-5-21-4294004471-4141303439-88424932-1001\Software\adawaretb" /f
end
*****************
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => Value deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key deleted successfully.
HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{5036AD75-CCEA-4D8A-8FB4-31E1482142E6} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5036AD75-CCEA-4D8A-8FB4-31E1482142E6} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Digital Sites => Key deleted successfully.
========= reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{62155D33-3CE2-401E-8967-5A270628A3D5}" /f =========
Der Vorgang wurde erfolgreich beendet.
========= End of Reg: =========
========= reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{62155D33-3CE2-401E-8967-5A270628A3D5}" /f =========
Der Vorgang wurde erfolgreich beendet.
========= End of Reg: =========
========= reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ba20b5da-0f48-40c5-b8c9-2cda4ecf75c2}" /f =========
Der Vorgang wurde erfolgreich beendet.
========= End of Reg: =========
========= reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\Toolbar Cleaner uninstall_RASAPI32" /f =========
Der Vorgang wurde erfolgreich beendet.
========= End of Reg: =========
========= reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\Toolbar Cleaner uninstall_RASMANCS" /f =========
Code:
ATTFilter HitmanPro 3.7.9.216
www.hitmanpro.com
Computer name . . . . : MARTIN-PC
Windows . . . . . . . : 6.1.1.7601.X64/4
User name . . . . . . : martin-PC\martin
UAC . . . . . . . . . : Enabled
License . . . . . . . : Free
Scan date . . . . . . : 2014-04-03 21:33:19
Scan mode . . . . . . : Normal
Scan duration . . . . : 6m 42s
Disk access mode . . : Direct disk access (SRB)
Cloud . . . . . . . . : Internet
Reboot . . . . . . . : No
Threats . . . . . . . : 0
Traces . . . . . . . : 24
Objects scanned . . . : 1.731.639
Files scanned . . . . : 53.652
Remnants scanned . . : 361.127 files / 1.316.860 keys
Cookies _____________________________________________________________________
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.adnet.de
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.yieldmanager.com
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.zanox.com
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads-lb.creative-serving.com
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies:adtech.de
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies:apmebf.com
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies:atdmt.com
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies:doubleclick.net
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies:eas.apm.emediate.eu
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies:invitemedia.com
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies:revsci.net
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies:smartadserver.com
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies:statse.webtrendslive.com
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies:tradedoubler.com
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies:ww251.smartadserver.com
C:\Users\martin\AppData\Roaming\Mozilla\Firefox\Profiles\6pvzp2xy.default\cookies.sqlite:ad.ad-srv.net
C:\Users\martin\AppData\Roaming\Mozilla\Firefox\Profiles\6pvzp2xy.default\cookies.sqlite:ad.dyntracker.com
C:\Users\martin\AppData\Roaming\Mozilla\Firefox\Profiles\6pvzp2xy.default\cookies.sqlite:ad.zanox.com
C:\Users\martin\AppData\Roaming\Mozilla\Firefox\Profiles\6pvzp2xy.default\cookies.sqlite:media6degrees.com
C:\Users\martin\AppData\Roaming\Mozilla\Firefox\Profiles\6pvzp2xy.default\cookies.sqlite:revsci.net
C:\Users\martin\AppData\Roaming\Mozilla\Firefox\Profiles\6pvzp2xy.default\cookies.sqlite:ru4.com
C:\Users\martin\AppData\Roaming\Mozilla\Firefox\Profiles\6pvzp2xy.default\cookies.sqlite:smartadserver.com
C:\Users\martin\AppData\Roaming\Mozilla\Firefox\Profiles\6pvzp2xy.default\cookies.sqlite:track.adform.net
C:\Users\martin\AppData\Roaming\Mozilla\Firefox\Profiles\6pvzp2xy.default\cookies.sqlite:www.googleadservices.com
Code:
ATTFilter HitmanPro 3.7.9.216
www.hitmanpro.com
Computer name . . . . : MARTIN-PC
Windows . . . . . . . : 6.1.1.7601.X64/4
User name . . . . . . : martin-PC\martin
UAC . . . . . . . . . : Enabled
License . . . . . . . : Free
Scan date . . . . . . : 2014-04-03 21:33:19
Scan mode . . . . . . : Normal
Scan duration . . . . : 6m 42s
Disk access mode . . : Direct disk access (SRB)
Cloud . . . . . . . . : Internet
Reboot . . . . . . . : No
Threats . . . . . . . : 0
Traces . . . . . . . : 24
Objects scanned . . . : 1.731.639
Files scanned . . . . : 53.652
Remnants scanned . . : 361.127 files / 1.316.860 keys
Cookies _____________________________________________________________________
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.adnet.de
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.yieldmanager.com
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.zanox.com
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads-lb.creative-serving.com
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies:adtech.de
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies:apmebf.com
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies:atdmt.com
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies:doubleclick.net
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies:eas.apm.emediate.eu
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies:invitemedia.com
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies:revsci.net
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies:smartadserver.com
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies:statse.webtrendslive.com
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies:tradedoubler.com
C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Cookies:ww251.smartadserver.com
C:\Users\martin\AppData\Roaming\Mozilla\Firefox\Profiles\6pvzp2xy.default\cookies.sqlite:ad.ad-srv.net
C:\Users\martin\AppData\Roaming\Mozilla\Firefox\Profiles\6pvzp2xy.default\cookies.sqlite:ad.dyntracker.com
C:\Users\martin\AppData\Roaming\Mozilla\Firefox\Profiles\6pvzp2xy.default\cookies.sqlite:ad.zanox.com
C:\Users\martin\AppData\Roaming\Mozilla\Firefox\Profiles\6pvzp2xy.default\cookies.sqlite:media6degrees.com
C:\Users\martin\AppData\Roaming\Mozilla\Firefox\Profiles\6pvzp2xy.default\cookies.sqlite:revsci.net
C:\Users\martin\AppData\Roaming\Mozilla\Firefox\Profiles\6pvzp2xy.default\cookies.sqlite:ru4.com
C:\Users\martin\AppData\Roaming\Mozilla\Firefox\Profiles\6pvzp2xy.default\cookies.sqlite:smartadserver.com
C:\Users\martin\AppData\Roaming\Mozilla\Firefox\Profiles\6pvzp2xy.default\cookies.sqlite:track.adform.net
C:\Users\martin\AppData\Roaming\Mozilla\Firefox\Profiles\6pvzp2xy.default\cookies.sqlite:www.googleadservices.com
Irgendwie ist der Wurm drin. Heute morgen hat Avast einen Virus Win32:Malware-gen gemeldet. Bei einem bootscan wurde die Datei gelöscht. Fundort war die zoek.exe auf meinem deskdop. Schon merkwürdigt, nachdem der Rechner gestern bei dem ESET-Scan plötzlich ausgegangen ist. Viele Grüße, enterprise Servus, ich bin etwas verunsichert. Denn bei Schritt 3 ist der Rechner beim ESET Scan nach ca. 50 Minuten plötzlich abgeschmiert. Ich schicke dir mal FRST und Hitman und warte, was du sagst. Soll ich mit den Schritten 3 und 4 weitermachen? Irgendwie ist der Wurm drin. Heute morgen hat Avast einen Virus Win32:Malware-gen gemeldet. Bei einem bootscan wurde die Datei gelöscht. Fundort war die zoek.exe auf meinem deskdop. Schon merkwürdigt, nachdem der Rechner gestern bei dem ESET-Scan plötzlich ausgegangen ist. Malwarebytes hat auch nichts mehr entdeckt. Viele Grüße. enterprise |
|
04.04.2014, 17:58
| #14 | |
| /// TB-Ausbilder | Win32:Dropper-LTG (Drp) - Noch da oder nicht? Servus, Zitat:
Zoek ist legitim, das haben wir benutzt. Weiter mit SecurityCheck bitte. |
|
04.04.2014, 20:05
| #15 |
| | Win32:Dropper-LTG (Drp) - Noch da oder nicht? Guten Abend, hier die Logdatei von Security Check. Viele Grüße, enterprse Code:
ATTFilter Results of screen317's Security Check version 0.99.80
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
avast! Antivirus
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
Java 7 Update 51
Adobe Flash Player 12.0.0.77
Adobe Reader XI
Mozilla Firefox (28.0)
Mozilla Thunderbird (24.3.0)
Google Chrome 33.0.1750.146
Google Chrome 33.0.1750.154
````````Process Check: objlist.exe by Laurent````````
AVAST Software Avast AvastSvc.exe
AVAST Software Avast AvastUI.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
|
|
| Themen zu Win32:Dropper-LTG (Drp) - Noch da oder nicht? |
| ad-aware, appdata, avast, bedrohung, bedrohung gefunden, datei, dropper, ergebnis, ergebnisse, fehler, gefunde, local, löschen, malwarebytes, meldung, problem, rechner, systemcheck, temp, trojaner, unsicher, users, versuch, virus, virus gefunden, win, win32 |
WARNUNG an die MITLESER: 
und 
und speichere die Logdatei auf Deinem Desktop.
Linear-Darstellung
