| |
| |||||||
Log-Analyse und Auswertung: Windows Vista: USB-Stick Ordner werden als Verknüpfungen angezeigtWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
13.04.2014, 14:33
| #1 |
 |  Windows Vista: USB-Stick Ordner werden als Verknüpfungen angezeigt Hallo liebe Trojaner-Board-User, seit gestern habe ich ein Problem mit USB-Sticks unter Windows Vista. Alle Ordner auf den Sticks werden nur als Verknüpfungen angezeigt. Wenn ich darauf klicke, gelange ich zwar zum Ordnerinhalt, dieser wird aber in einem neuen Fenster geöffnet. Ich glaube, es handelt sich um das gleiche Problem, das hier schon mehrmals gepostet wurde, z.B. hier http://www.trojaner-board.de/147308-...angezeigt.html Zwei Sticks und mein Rechner sind infiziert, die Logfiles habe ich erstellt und angehängt. Ich würde mich sehr freuen, wenn ihr mir weiterhelfen könntet. Vielen Dank und liebe Grüße Simon defogger_disable Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 13:45 on 13/04/2014 (*****)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
Unable to read sptd.sys
Unable to read sptd.sys
SPTD -> DisabledSPTD -> (Service running -> reboot required)
Already disabled (Service running -> reboot required)
-=E.O.F=-
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 12-04-2014 01
Ran by ***** (administrator) on *****S-LAPTOP on 13-04-2014 14:01:01
Running from C:\Users\*****\Desktop\Kampf gegen den Virus
Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 7
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\system32\atiesrxx.exe
(IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_827e372d\STacSV.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(Hewlett-Packard Company) C:\Windows\system32\Hpservice.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Cisco Systems, Inc.) C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Cisco Systems, Inc.) C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
(AnchorFree Inc.) C:\Program Files\Hotspot Shield\bin\cmw_srv.exe
() C:\Program Files\Hotspot Shield\bin\hsswd.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
(COMPANYVERS_NAME) C:\Program Files\RadioRage_4j\bar\1.bin\4jbarsvc.exe
() C:\Program Files\SMINST\BLService.exe
() C:\Program Files\CyberLink\Shared files\RichVideo.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe
(Telefónica I+D) C:\Program Files\o2\Mobile Connection Manager\ImpWiFiSvc.exe
() C:\Program Files\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray.exe
(SecureW2 B.V.) C:\Program Files\SecureW2\sw2_tray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
( ) C:\Program Files\RadioRage_4j\bar\1.bin\APPINTEGRATOR.EXE
(Mindspark) C:\Program Files\RadioRage_4j\bar\1.bin\4jSrchMn.exe
(Spotify Ltd) C:\Users\*****\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Microsoft Corporation) C:\Windows\System32\wscript.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE
(Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
() C:\Program Files\Hewlett-Packard\Shared\hpqToaster.exe
(Hewlett-Packard) c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner.exe
(Microsoft Corporation) C:\Windows\system32\wuauclt.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\system32\sdclt.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2299176 2011-10-14] (Synaptics Incorporated)
HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [WirelessAssistant] - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [432432 2008-12-08] (Hewlett-Packard)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray.exe [450652 2009-06-03] (IDT, Inc.)
HKLM\...\Run: [] - [X]
HKLM\...\Run: [SecureW2 Tray] - C:\Program Files\SecureW2\sw2_tray.exe [186792 2012-08-17] (SecureW2 B.V.)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-22] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [StartCCC] - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [641704 2012-07-04] (Advanced Micro Devices, Inc.)
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-1905073969-3418976898-3997351287-1000\...\Run: [Spotify Web Helper] - C:\Users\*****\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171000 2014-04-11] (Spotify Ltd)
HKU\S-1-5-21-1905073969-3418976898-3997351287-1000\...\Run: [BBuJUuKs] - wscript.exe //B "C:\Users\*****~1\AppData\Local\Temp\BBuJUuKs.vbs" <===== ATTENTION
HKU\S-1-5-21-1905073969-3418976898-3997351287-1000\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x00000000
HKU\S-1-5-21-1905073969-3418976898-3997351287-1000\...\MountPoints2: {073a23ce-6bc5-11df-8492-a56831e8e4b1} - "F:\WD SmartWare.exe" autoplay=true
HKU\S-1-5-21-1905073969-3418976898-3997351287-1000\...\MountPoints2: {0c85e89a-6dba-11e1-bbf7-b9b8e2458846} - G:\ZTE_Handset_USB_Driver.exe
HKU\S-1-5-21-1905073969-3418976898-3997351287-1000\...\MountPoints2: {12e9ead7-cd2b-11de-a895-00269e0cf51f} - WD_Windows_Tools\Setup.exe
HKU\S-1-5-21-1905073969-3418976898-3997351287-1000\...\MountPoints2: {57d292f9-ffe6-11e1-8a06-8b3079f4bd5b} - F:\setup_vmc_lite.exe /checkApplicationPresence
HKU\S-1-5-21-1905073969-3418976898-3997351287-1000\...\MountPoints2: {72abdfc7-11d0-11e2-940c-bef78f8eb721} - F:\setup_vmc_lite.exe /checkApplicationPresence
HKU\S-1-5-21-1905073969-3418976898-3997351287-1000\...\MountPoints2: {b25d0878-18ae-11e0-bbaa-c8a8ad3ade5b} - F:\AutoRun.exe
HKU\S-1-5-21-1905073969-3418976898-3997351287-1000\...\MountPoints2: {b25d0888-18ae-11e0-bbaa-9fd27449ea5b} - F:\AutoRun.exe
HKU\S-1-5-21-1905073969-3418976898-3997351287-1000\...\MountPoints2: {b25d0893-18ae-11e0-bbaa-f058a7cd0102} - F:\AutoRun.exe
Startup: C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BBuJUuKs.vbs ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=91&bd=Pavilion&pf=cnnb
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=91&bd=Pavilion&pf=cnnb
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=91&bd=Pavilion&pf=cnnb
URLSearchHook: HKCU - UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
SearchScopes: HKLM - DefaultScope {09EECF31-D086-4C6A-88ED-D417D57B6D2F} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcnnbie7-de-de
SearchScopes: HKLM - {09EECF31-D086-4C6A-88ED-D417D57B6D2F} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcnnbie7-de-de
SearchScopes: HKLM - {22CD1C1C-62E4-4A08-937E-DF510DD637A1} URL = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
SearchScopes: HKLM - {E89AE38C-AB97-41DF-84E8-78E332833273} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008
SearchScopes: HKCU - DefaultScope {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-3&o=APN10395&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=^ABT&apn_dtid=^YYYYYY^YY^DE&apn_uid=cd88b661-3383-42e6-b12e-81b159a50c7a&apn_sauid=FC2E8AEE-DEC4-4142-A085-54D38A270E0A
SearchScopes: HKCU - {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-3&o=APN10395&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=^ABT&apn_dtid=^YYYYYY^YY^DE&apn_uid=cd88b661-3383-42e6-b12e-81b159a50c7a&apn_sauid=FC2E8AEE-DEC4-4142-A085-54D38A270E0A
SearchScopes: HKCU - {E89AE38C-AB97-41DF-84E8-78E332833273} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: SwissAcademic.Citavi.Picker.IEPicker - {609D670F-B735-4da7-AC6D-F3BD358E325E} - C:\Windows\system32\mscoree.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Evernote extension - {92EF2EAD-A7CE-4424-B0DB-499CF856608E} - C:\Program Files\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO: Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO: Download Accelerator Plus Integration - {FF6C3CF0-4B15-11D1-ABED-709549C10000} - C:\Program Files\DAP\dapieloader.dll (SpeedBit Ltd.)
Toolbar: HKLM - Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
Toolbar: HKCU - No Name - {32099AAC-C132-4136-9E9A-4E364A424E17} - No File
Toolbar: HKCU - Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_38-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0038-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_38-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_38-windows-i586.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\cherrytomato\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default
FF user.js: detected! => C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\user.js
FF SearchEngineOrder.1: Ask.com
FF Keyword.URL: hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=AVR-3&o=APN10395&locale=de_DE&apn_uid=cd88b661-3383-42e6-b12e-81b159a50c7a&apn_ptnrs=%5EABT&apn_sauid=FC2E8AEE-DEC4-4142-A085-54D38A270E0A&apn_dtid=%5EYYYYYY%5EYY%5EDE&&q=
FF NetworkProxy: "http", "127.0.0.1"
FF NetworkProxy: "http_port", 8555
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\npPDFXCviewNPPlugin.dll No File
FF Plugin: @java.com/DTPlugin,version=1.6.0_38 - C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @RadioRage_4j.com/Plugin - C:\Program Files\RadioRage_4j\bar\1.bin\NP4jStub.dll (Mindspark)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin: yaxmpb@yahoo.com/YahooActiveXPluginBridge;version=1.0.0.1 - C:\Program Files\Mozilla Firefox\plugins\npyaxmpb.dll (Yahoo! Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101753.dll (Amazon.com, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np32neur.dll (SumTotal Systems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npwachk.dll (Nullsoft, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npyaxmpb.dll (Yahoo! Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\*****\AppData\Roaming\mozilla\plugins\npatgpc.dll (Cisco WebEx LLC)
FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\searchplugins\askcom.xml
FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\searchplugins\duden-online.xml
FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\searchplugins\urban-dictionary.xml
FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\searchplugins\youtube-videosuche.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: RadioRage - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\4jffxtbr@RadioRage_4j.com [2014-04-11]
FF Extension: DoNotTrackMe - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\donottrackplus@abine.com [2013-08-19]
FF Extension: Pocket - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\isreaditlater@ideashower.com [2013-06-28]
FF Extension: Avira SearchFree Toolbar plus Web Protection - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\toolbar@ask.com [2012-08-22]
FF Extension: TV-Fox - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\{2f17f610-5e97-4fed-828f-9940b7b577a4} [2013-03-30]
FF Extension: WOT - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2013-11-26]
FF Extension: HP Detect - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\{ab91efd4-6975-4081-8552-1b3922ed79e2} [2012-08-26]
FF Extension: DownloadHelper - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-03-25]
FF Extension: Evernote Web Clipper - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\{E0B8C461-F8FB-49b4-8373-FE32E9252800} [2013-12-18]
FF Extension: feedly - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\feedly@devhd.xpi [2011-07-07]
FF Extension: Cruxlight - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\jid1-45thW542wORoTw@jetpack.xpi [2013-03-12]
FF Extension: storeTab - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\nicktco@gmail.com.xpi [2014-02-02]
FF Extension: LeechBlock - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\{a95d8332-e4b4-6e7f-98ac-20b733364387}.xpi [2011-10-18]
FF Extension: StumbleUpon - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\{AE93811A-5C9A-4d34-8462-F7B864FC4696}.xpi [2011-05-26]
FF Extension: Adblock Plus - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011-05-14]
FF Extension: FoxTab - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\{ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}.xpi [2011-06-29]
FF Extension: Hotspot Shield Helper (Please allow this installation) - C:\Program Files\Mozilla Firefox\extensions\afurladvisor@anchorfree.com [2014-03-18]
FF Extension: Skype extension for Firefox - C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2014-03-18]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2014-03-18]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2014-03-18]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0038-ABCDEFFEDCBA} [2014-03-18]
FF Extension: Hotspot Shield Extension - C:\Program Files\Mozilla Firefox\browser\extensions\afproxy@anchorfree.com [2014-04-12]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []
FF HKLM\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2011-03-13]
FF HKLM\...\Thunderbird\Extensions: [{857610fe-b36c-47f2-b4fa-6b7affe0cf5a}] - C:\Program Files\Mobile Master\ext\1\
FF Extension: Mobile Master Add-In - C:\Program Files\Mobile Master\ext\1\ []
FF HKCU\...\Firefox\Extensions: [{F17C1572-C9EC-4e5c-A542-D05CBB5C5A08}] - C:\Program Files\DAP\DAPFireFox
FF Extension: Download Accelerator Plus (DAP) extension - C:\Program Files\DAP\DAPFireFox [2009-12-04]
Chrome:
=======
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\32.0.1700.107\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\32.0.1700.107\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\32.0.1700.107\pdf.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft® Windows Media Player Firefox Plugin) - C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll (Microsoft Corporation)
CHR Plugin: (NEURON) - C:\Program Files\Mozilla Firefox\plugins\np32neur.dll (SumTotal Systems, Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll No File
CHR Plugin: (Winamp Application Detector) - C:\Program Files\Mozilla Firefox\plugins\npwachk.dll (Nullsoft, Inc.)
CHR Plugin: (Yahoo! activeX Plug-in Bridge) - C:\Program Files\Mozilla Firefox\plugins\npyaxmpb.dll (Yahoo! Inc.)
CHR Plugin: (ActiveTouch General Plugin Container) - C:\Users\*****\AppData\Roaming\Mozilla\plugins\npatgpc.dll (Cisco WebEx LLC)
CHR Plugin: (AmazonMP3DownloaderPlugin) - C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101753.dll (Amazon.com, Inc.)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U38) - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (iTunes Application Detector) - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_6_602_171.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.380.5) - C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File
CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Extension: (Google Docs) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-02-28]
CHR Extension: (Google Drive) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-02-28]
CHR Extension: (YouTube) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-02-28]
CHR Extension: (Google-Suche) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-02-28]
CHR Extension: (Google Wallet) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-02]
CHR Extension: (Google Mail) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-02-28]
========================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440400 2014-02-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-22] (Avira Operations GmbH & Co. KG)
R2 CVPND; C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe [1528608 2008-04-17] (Cisco Systems, Inc.)
R2 HP Health Check Service; c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [94208 2008-10-09] (Hewlett-Packard)
R2 hshld; C:\Program Files\Hotspot Shield\bin\cmw_srv.exe [944424 2014-01-15] (AnchorFree Inc.)
S3 HssTrayService; C:\Program Files\Hotspot Shield\bin\HssTrayService.EXE [78512 2014-01-15] ()
R2 HssWd; C:\Program Files\Hotspot Shield\bin\hsswd.exe [555304 2014-01-15] ()
R2 RadioRage_4jService; C:\Program Files\RadioRage_4j\bar\1.bin\4jbarsvc.exe [88648 2014-04-11] (COMPANYVERS_NAME)
R2 Recovery Service for Windows; C:\Program Files\SMINST\BLService.exe [365952 2008-12-17] ()
R2 RichVideo; C:\Program Files\CyberLink\Shared files\RichVideo.exe [241734 2008-09-15] ()
R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_827e372d\STacSV.exe [217170 2009-06-03] (IDT, Inc.)
R2 TGCM_ImportWiFiSvc; C:\Program Files\o2\Mobile Connection Manager\ImpWiFiSvc.exe [199600 2010-08-02] (Telefónica I+D)
R2 TVCapSvc; C:\Program Files\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe [296320 2008-11-26] ()
S3 TVSched; C:\Program Files\Hewlett-Packard\Media\TV\Kernel\TV\TVSched.exe [116096 2008-11-26] ()
R2 vpnagent; C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe [557968 2013-06-19] (Cisco Systems, Inc.)
==================== Drivers (Whitelisted) ====================
S3 61883; C:\Windows\System32\DRIVERS\61883.sys [45696 2008-01-21] (Microsoft Corporation)
S3 acsint; C:\Windows\System32\DRIVERS\acsint.sys [39888 2013-06-19] (Cisco Systems, Inc.)
S3 acsmux; C:\Windows\System32\DRIVERS\acsmux.sys [58320 2013-06-19] (Cisco Systems, Inc.)
R3 Afc; C:\Windows\System32\drivers\Afc.sys [11776 2005-02-23] (Arcsoft, Inc.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135648 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-26] (Avira Operations GmbH & Co. KG)
S3 CVirtA; C:\Windows\System32\DRIVERS\CVirtA.sys [5275 2007-01-18] (Cisco Systems, Inc.)
R2 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306299 2008-04-17] (Cisco Systems, Inc.)
S3 DCamUSBEMPIA; C:\Windows\System32\DRIVERS\emDevice.sys [171136 2007-06-21] (eMPIA Technology, Inc.)
R3 DNE; C:\Windows\System32\DRIVERS\dne2000.sys [125328 2008-03-29] (Deterministic Networks, Inc.)
S3 emAudio; C:\Windows\System32\drivers\emAudio.sys [24448 2007-10-26] (eMPIA Technology, Inc.)
S3 FiltUSBEMPIA; C:\Windows\System32\DRIVERS\emFilter.sys [5248 2007-06-21] (eMPIA Technology, Inc.)
R1 HssDRV6; C:\Windows\System32\DRIVERS\hssdrv6.sys [39624 2014-01-15] (AnchorFree Inc.)
S3 KORGUMDS; C:\Windows\System32\Drivers\KORGUMDS.SYS [24056 2011-03-30] (KORG INC.)
S3 NUMARK_OMNICONTROL; C:\Windows\System32\Drivers\nkc2_usb.sys [367104 2008-07-17] (Ploytec GmbH)
S3 NUMARK_OMNICONTROL_MIDI; C:\Windows\System32\drivers\nkc2midi.sys [28160 2008-07-17] (Numark)
S3 NUMARK_OMNICONTROL_WDM; C:\Windows\System32\drivers\nkc2_wdm.sys [33792 2008-07-17] (Numark)
S3 NvnUsbAudio; C:\Windows\System32\DRIVERS\nvnusbaudio.sys [41944 2011-10-05] (Novation DMS Ltd.)
R3 pfc; C:\Windows\System32\drivers\pfc.sys [10368 2004-04-01] (Padus, Inc.)
S3 PPJoyBus; C:\Windows\System32\DRIVERS\PPJoyBus.sys [15936 2009-11-04] (Deon van der Westhuysen)
S3 PPortJoystick; C:\Windows\System32\DRIVERS\PPortJoy.sys [31808 2009-11-04] (Deon van der Westhuysen)
S3 ScanUSBEMPIA; C:\Windows\System32\DRIVERS\emScan.sys [5120 2007-06-21] (eMPIA Technology, Inc.)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [691696 2010-06-27] (Duplex Secure Ltd.)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
R3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [37064 2014-01-15] (Anchorfree Inc.)
R2 {55662437-DA8C-40c0-AADA-2C816A897A49}; C:\Program Files\Hewlett-Packard\Media\DVD\000.fcl [87536 2008-11-28] (CyberLink Corp.)
S2 adfs; No ImagePath
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 jswmidin; \??\C:\Users\*****~1\AppData\Local\Temp\jswmidin.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 taphss; system32\DRIVERS\taphss.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-04-13 14:00 - 2014-04-13 14:01 - 00000000 ____D () C:\FRST
2014-04-13 13:51 - 2014-04-13 14:01 - 00000000 ____D () C:\Users\*****\Desktop\Kampf gegen den Virus
2014-04-13 13:45 - 2014-04-13 13:45 - 00000020 _____ () C:\Users\*****\defogger_reenable
2014-04-13 12:54 - 2014-04-13 12:54 - 00143312 _____ () C:\Windows\Minidump\Mini041314-01.dmp
2014-04-12 23:06 - 2013-12-27 13:05 - 103422302 _____ () C:\Users\*****\Desktop\*****_*****_001.psd
2014-04-12 14:33 - 2014-04-12 14:35 - 00000000 ____D () C:\ProgramData\Hotspot Shield
2014-04-12 14:31 - 2014-04-12 14:35 - 00000000 ____D () C:\Program Files\Hotspot Shield
2014-04-12 14:31 - 2014-01-15 00:45 - 00039624 _____ (AnchorFree Inc.) C:\Windows\system32\Drivers\hssdrv6.sys
2014-04-12 02:06 - 2014-04-12 02:07 - 100054996 _____ () C:\Users\*****\Desktop\Snakeman Show.wav
2014-04-12 01:49 - 2014-04-12 02:08 - 00000000 ____D () C:\Users\*****\Desktop\Tokio Recordings
2014-04-11 20:10 - 2014-04-11 20:10 - 00000000 ____D () C:\Program Files\RadioRage_4j
2014-04-11 20:07 - 2014-04-11 20:07 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Hotspot Shield
2014-04-07 10:40 - 2014-04-07 10:41 - 42767668 _____ () C:\Users\*****\Downloads\High On You Mama (Ole Smokey Edit).wav
2014-03-27 10:47 - 2014-03-27 10:48 - 00000000 ____D () C:\Users\*****\Desktop\4. Stock
2014-03-23 11:31 - 2014-03-23 15:44 - 00000000 ____D () C:\Program Files\Mozilla Thunderbird
2014-03-22 23:43 - 2014-04-12 20:34 - 00000000 ____D () C:\Users\*****\Desktop\im bett mit
2014-03-22 23:31 - 2014-03-22 23:31 - 00000000 ____D () C:\Users\*****\Downloads\creampuff
2014-03-22 23:26 - 2014-03-22 23:26 - 00031775 _____ () C:\Users\*****\Downloads\creampuff.zip
2014-03-18 22:05 - 2014-03-18 22:05 - 00000000 ____D () C:\Program Files\Mozilla Firefox
==================== One Month Modified Files and Folders =======
2014-04-13 14:01 - 2014-04-13 14:00 - 00000000 ____D () C:\FRST
2014-04-13 14:01 - 2014-04-13 13:51 - 00000000 ____D () C:\Users\*****\Desktop\Kampf gegen den Virus
2014-04-13 13:55 - 2006-11-02 12:33 - 01445546 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-13 13:53 - 2009-07-20 02:24 - 02046305 _____ () C:\Windows\WindowsUpdate.log
2014-04-13 13:49 - 2009-11-30 11:51 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-13 13:48 - 2006-11-02 15:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-13 13:48 - 2006-11-02 14:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-13 13:48 - 2006-11-02 14:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-13 13:46 - 2006-11-02 15:01 - 00032554 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-04-13 13:45 - 2014-04-13 13:45 - 00000020 _____ () C:\Users\*****\defogger_reenable
2014-04-13 13:45 - 2009-09-18 14:10 - 00000000 ____D () C:\Users\*****
2014-04-13 13:32 - 2012-04-11 11:26 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-13 12:54 - 2014-04-13 12:54 - 00143312 _____ () C:\Windows\Minidump\Mini041314-01.dmp
2014-04-13 12:54 - 2009-11-19 15:51 - 322871239 _____ () C:\Windows\MEMORY.DMP
2014-04-13 12:54 - 2009-11-19 15:51 - 00000000 ____D () C:\Windows\Minidump
2014-04-13 12:48 - 2009-11-30 11:51 - 00001114 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-12 23:00 - 2006-11-02 14:52 - 00364678 _____ () C:\Windows\setupact.log
2014-04-12 20:34 - 2014-03-22 23:43 - 00000000 ____D () C:\Users\*****\Desktop\im bett mit
2014-04-12 19:17 - 2010-03-07 02:45 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Mp3tag
2014-04-12 15:19 - 2010-01-16 09:34 - 00054110 _____ () C:\Users\*****\Desktop\songs.txt
2014-04-12 14:35 - 2014-04-12 14:33 - 00000000 ____D () C:\ProgramData\Hotspot Shield
2014-04-12 14:35 - 2014-04-12 14:31 - 00000000 ____D () C:\Program Files\Hotspot Shield
2014-04-12 14:31 - 2012-07-20 20:45 - 00012591 _____ () C:\Windows\certutil.log
2014-04-12 14:27 - 2010-06-25 15:43 - 00000000 ___RD () C:\Users\*****\Documents\My Dropbox
2014-04-12 13:24 - 2009-09-20 15:01 - 00000000 ____D () C:\Users\*****\AppData\Roaming\vlc
2014-04-12 12:25 - 2010-06-25 15:42 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Dropbox
2014-04-12 11:36 - 2009-09-20 11:05 - 00155136 _____ () C:\Users\*****\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-04-12 11:33 - 2010-06-25 15:42 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-04-12 10:43 - 2009-09-23 00:47 - 00000000 ____D () C:\Users\*****\Downloads\mp3
2014-04-12 03:17 - 2012-06-13 22:09 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Spotify
2014-04-12 02:23 - 2012-06-13 22:10 - 00000000 ____D () C:\Users\*****\AppData\Local\Spotify
2014-04-12 02:08 - 2014-04-12 01:49 - 00000000 ____D () C:\Users\*****\Desktop\Tokio Recordings
2014-04-12 02:07 - 2014-04-12 02:06 - 100054996 _____ () C:\Users\*****\Desktop\Snakeman Show.wav
2014-04-11 20:13 - 2008-01-21 04:47 - 00464626 _____ () C:\Windows\PFRO.log
2014-04-11 20:10 - 2014-04-11 20:10 - 00000000 ____D () C:\Program Files\RadioRage_4j
2014-04-11 20:10 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\Resources
2014-04-11 20:07 - 2014-04-11 20:07 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Hotspot Shield
2014-04-07 10:41 - 2014-04-07 10:40 - 42767668 _____ () C:\Users\*****\Downloads\High On You Mama (Ole Smokey Edit).wav
2014-03-31 09:35 - 2009-11-19 10:12 - 00231584 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-03-27 10:48 - 2014-03-27 10:47 - 00000000 ____D () C:\Users\*****\Desktop\4. Stock
2014-03-25 01:39 - 2009-10-08 15:19 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Skype
2014-03-25 01:07 - 2009-10-08 15:21 - 00000000 ____D () C:\Users\*****\AppData\Roaming\skypePM
2014-03-23 21:38 - 2012-04-26 19:06 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-03-23 15:44 - 2014-03-23 11:31 - 00000000 ____D () C:\Program Files\Mozilla Thunderbird
2014-03-23 10:55 - 2009-09-18 14:17 - 00086504 _____ () C:\Users\*****\AppData\Local\GDIPFONTCACHEV1.DAT
2014-03-23 10:53 - 2006-11-02 14:47 - 02270584 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-03-22 23:31 - 2014-03-22 23:31 - 00000000 ____D () C:\Users\*****\Downloads\creampuff
2014-03-22 23:26 - 2014-03-22 23:26 - 00031775 _____ () C:\Users\*****\Downloads\creampuff.zip
2014-03-22 22:02 - 2014-02-08 13:40 - 00000000 ____D () C:\Users\*****\Desktop\Filme
2014-03-18 22:05 - 2014-03-18 22:05 - 00000000 ____D () C:\Program Files\Mozilla Firefox
Files to move or delete:
====================
C:\Users\*****\AppData\Roaming\desktop.ini
C:\Users\Public\Mobile_Connection_Manager_RC4.5.exe
Some content of TEMP:
====================
C:\Users\*****\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-04-13 13:55
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 12-04-2014 01
Ran by ***** at 2014-04-13 14:01:51
Running from C:\Users\*****\Desktop\Kampf gegen den Virus
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
Ableton Live 9 Trial (HKLM\...\{D78A9F97-5168-4EB2-B82F-0ACEBDE13583}) (Version: 9.0.0.0 - Ableton)
Adobe Audition 3.0 (HKLM\...\Adobe Audition 3.0) (Version: 3.0 - Adobe Systems Incorporated)
Adobe Audition 3.0 (Version: 3.0 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 12 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 12.0.0.77 - Adobe Systems Incorporated)
Adobe Reader X (10.1.6) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.6 - Adobe Systems Incorporated)
Apple Application Support (HKLM\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{0592EF96-69D8-4E4B-9CC9-88F58EA86F01}) (Version: 7.0.0.117 - Apple Inc.)
Ask Toolbar (HKLM\...\{86D4B82A-ABED-442A-BE86-96357B70F4FE}) (Version: 1.15.26.0 - Ask.com) <==== ATTENTION
Avira SearchFree Toolbar plus Web Protection Updater (HKCU\...\{79A765E1-C399-405B-85AF-466F52E918B0}) (Version: 1.3.0.23930 - Ask.com) <==== ATTENTION
Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
Canon MG5100 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG5100_series) (Version: - )
Cisco AnyConnect Secure Mobility Client (HKLM\...\Cisco AnyConnect Secure Mobility Client) (Version: 3.1.04059 - Cisco Systems, Inc.)
Cisco AnyConnect Secure Mobility Client (Version: 3.1.04059 - Cisco Systems, Inc.) Hidden
Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Defraggler (HKLM\...\Defraggler) (Version: 2.13 - Piriform)
Dropbox (HKCU\...\Dropbox) (Version: 2.4.11 - Dropbox, Inc.)
EVEREST Home Edition v2.20 (HKLM\...\EVEREST Home Edition_is1) (Version: 2.20 - Lavalys Inc)
Evernote v. 4.6.6 (HKLM\...\{6146B9DC-C33D-11E2-BDE1-984BE15F174E}) (Version: 4.6.6.8360 - Evernote Corp.)
FormatFactory 3.0.1 (HKLM\...\FormatFactory) (Version: 3.0.1 - Free Time)
Google Chrome (HKLM\...\Google Chrome) (Version: 34.0.1847.116 - Google Inc.)
Google Update Helper (Version: 1.3.23.9 - Google Inc.) Hidden
GPL Ghostscript (HKLM\...\GPL Ghostscript 9.07) (Version: 9.07 - Artifex Software Inc.)
Hotline Miami (HKLM\...\GOGPACKHOTLINEMIAMI_is1) (Version: 2.0.0.4 - GOG.com)
Hotspot Shield 3.32 (HKLM\...\HotspotShield) (Version: 3.32 - AnchorFree Inc.)
iTunes (HKLM\...\{C197BC08-3D82-4651-8886-E68C21578A38}) (Version: 11.1.3.8 - Apple Inc.)
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Office Home and Student 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.20913.0 - Microsoft Corporation)
Mozilla Firefox 28.0 (x86 de) (HKLM\...\Mozilla Firefox 28.0 (x86 de)) (Version: 28.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 24.4.0 - Mozilla)
Mozilla Thunderbird 24.4.0 (x86 de) (HKLM\...\Mozilla Thunderbird 24.4.0 (x86 de)) (Version: 24.4.0 - Mozilla)
Mp3tag v2.58 (HKLM\...\Mp3tag) (Version: v2.58 - Florian Heidenreich)
PDF24 Creator 5.6.0 (HKLM\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org)
QuickTime (HKLM\...\{B67BAFBA-4C9F-48FA-9496-933E3B255044}) (Version: 7.74.80.86 - Apple Inc.)
Revo Uninstaller 1.94 (HKLM\...\Revo Uninstaller) (Version: 1.94 - VS Revo Group)
Skype™ 4.2 (HKLM\...\{D103C4BA-F905-437A-8049-DB24763BBE36}) (Version: - )
Spotify (HKCU\...\Spotify) (Version: 0.9.8.296.g91f68827 - Spotify AB)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (HKLM\...\{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2468871) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (HKLM\...\{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2533523) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (HKLM\...\{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2600217) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (HKLM\...\{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2836939) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (HKLM\...\{3C3901C5-3455-3E0A-A214-0B093A5070A6}.KB2836939v3) (Version: 3 - Microsoft Corporation)
WebEx (HKCU\...\ActiveTouchMeetingClient) (Version: - Cisco WebEx LLC)
Winamp Detector Plug-in (HKCU\...\Winamp Detect) (Version: 1.0.0.1 - Nullsoft, Inc)
XMedia Recode Version 3.1.7.7 (HKLM\...\{DDA3C325-47B2-4730-9672-BF3771C08799}_is1) (Version: 3.1.7.7 - XMedia Recode)
==================== Restore Points =========================
09-03-2014 11:59:54 Geplanter Prüfpunkt
10-03-2014 08:18:44 Geplanter Prüfpunkt
11-03-2014 18:20:45 Geplanter Prüfpunkt
12-03-2014 08:05:06 Geplanter Prüfpunkt
13-03-2014 22:44:05 Geplanter Prüfpunkt
15-03-2014 15:04:26 Geplanter Prüfpunkt
16-03-2014 00:35:39 Windows Update
16-03-2014 13:08:51 Geplanter Prüfpunkt
18-03-2014 21:35:46 Geplanter Prüfpunkt
21-03-2014 18:26:37 Windows Update
22-03-2014 12:12:14 Geplanter Prüfpunkt
24-03-2014 07:56:28 Geplanter Prüfpunkt
26-03-2014 07:31:27 Geplanter Prüfpunkt
26-03-2014 20:02:15 Geplanter Prüfpunkt
27-03-2014 08:41:50 Windows Update
07-04-2014 07:53:07 Windows Update
10-04-2014 19:15:50 Geplanter Prüfpunkt
11-04-2014 18:03:59 Gerätetreiber-Paketinstallation: Anchorfree HSS VPN Adapter Netzwerkadapter
12-04-2014 00:27:47 Windows Update
12-04-2014 12:31:41 Gerätetreiber-Paketinstallation: Anchorfree Inc Netzwerkdienst
12-04-2014 12:33:47 Gerätetreiber-Paketinstallation: Anchorfree HSS VPN Adapter Netzwerkadapter
13-04-2014 11:37:29 Removed Ableton Live 9 Trial
==================== Hosts content: ==========================
2006-11-02 12:23 - 2006-09-18 23:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
::1 localhost
==================== Scheduled Tasks (whitelisted) =============
Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {26F767FD-1CBA-40D1-ACF5-35D8969607A9} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2006-11-02] (Microsoft Corporation)
Task: {320124A7-D70F-41DE-A9D1-D5E8E19D5D91} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {33D134EF-E187-411A-87A2-B36075EFE0A9} - System32\Tasks\Microsoft\Windows\WindowsCalendar\Reminders - ***** => C:\Program Files\Windows Calendar\WinCal.exe [2009-04-11] (Microsoft Corporation)
Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-21] (Microsoft Corporation)
Task: {658BB1C4-E1F5-4E24-B50A-8AEBCA65D12C} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2009-11-30] (Google Inc.)
Task: {7DE65F70-88B4-43D8-94EB-CD275FC32E83} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files\Ask.com\UpdateTask.exe [2013-04-30] () <==== ATTENTION
Task: {B0E740B9-7CD6-485D-A6CE-8284BCED0C07} - System32\Tasks\{2B87BFFC-1509-4587-9F68-DE0B8A4D7536} => C:\Program Files\Skype\Phone\Skype.exe [2010-05-13] (Skype Technologies S.A.)
Task: {C676113B-D817-4AEE-9511-7EA8FE7EBE7F} - System32\Tasks\SecureW2 Task => C:\Program Files\SecureW2\sw2_tray.exe [2012-08-17] (SecureW2 B.V.)
Task: {CCFE9C73-CAB3-435A-B958-52AD5C05CC5E} - System32\Tasks\HP Health Check => c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [2008-10-09] (Hewlett-Packard)
Task: {D297BFE1-A17A-4E05-B98D-89C563152B2C} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {E42A5F45-1874-4403-8A75-EA229F715AE2} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2009-11-30] (Google Inc.)
Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-21] ()
Task: {ED7BB00E-D568-41F3-96F4-53CD93AC7229} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-03-11] (Adobe Systems Incorporated)
Task: {F56426E3-2573-4E93-8442-D1BC09BB47D4} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2013-06-19 17:00 - 2013-06-19 17:00 - 00063376 _____ () C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\zlib1.dll
2012-10-18 00:28 - 2012-09-19 19:17 - 00397088 _____ () C:\Program Files\Avira\AntiVir Desktop\sqlite3.dll
2011-09-27 09:23 - 2011-09-27 09:23 - 00087912 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2011-09-27 09:22 - 2011-09-27 09:22 - 01242472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2008-04-17 09:08 - 2008-04-17 09:08 - 00197408 _____ () C:\Windows\system32\vpnapi.dll
2014-01-15 01:23 - 2014-01-15 01:23 - 00937768 _____ () C:\Program Files\Hotspot Shield\bin\af_proxy.dll
2014-01-15 01:30 - 2014-01-15 01:30 - 00514344 _____ () C:\Program Files\Hotspot Shield\bin\HssRep.dll
2014-01-15 01:29 - 2014-01-15 01:29 - 00555304 _____ () C:\Program Files\Hotspot Shield\bin\hsswd.exe
2009-01-23 06:01 - 2008-12-17 17:11 - 00365952 _____ () C:\Program Files\SMINST\BLService.exe
2009-01-23 06:01 - 2008-12-17 17:11 - 00132480 _____ () C:\Program Files\SMINST\STWmiM.dll
2009-01-23 05:53 - 2008-09-15 16:13 - 00241734 _____ () C:\Program Files\CyberLink\Shared files\RichVideo.exe
2008-11-26 17:13 - 2008-11-26 17:13 - 00296320 ____N () C:\Program Files\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe
2008-11-26 17:13 - 2008-11-26 17:13 - 00263560 ____N () C:\Program Files\Hewlett-Packard\Media\TV\Kernel\TV\CLCapEngine.dll
2012-07-04 07:09 - 2012-07-04 07:09 - 00037376 _____ () C:\Windows\system32\atitmpxx.dll
2009-10-31 18:13 - 2009-08-16 18:06 - 00141312 _____ () C:\Program Files\WinRAR\rarext.dll
2012-12-30 00:08 - 2012-12-30 00:08 - 00043520 _____ () C:\Windows\system32\CmdLineExt03.dll
2012-07-04 01:16 - 2012-07-04 01:16 - 00369152 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2008-10-22 11:32 - 2008-10-22 11:32 - 00628016 _____ () C:\Program Files\Hewlett-Packard\Shared\hpqToaster.exe
2010-10-27 21:40 - 2010-10-27 21:40 - 00028672 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll
2014-03-18 22:05 - 2014-03-18 22:05 - 03642480 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\ProgramData\Temp:2B11E0DF
AlternateDataStreams: C:\ProgramData\Temp:553CA6CA
AlternateDataStreams: C:\ProgramData\Temp:D74B6CF5
AlternateDataStreams: C:\Users\Public\.apdisk:com.apple.quarantine
AlternateDataStreams: C:\Users\Public\.DS_Store:AFP_AfpInfo
AlternateDataStreams: C:\Users\Public\.TemporaryItems:AFP_AfpInfo
AlternateDataStreams: C:\Users\Public\.TemporaryItems:com.apple.quarantine
AlternateDataStreams: C:\Users\Public\Documents\.DS_Store:AFP_AfpInfo
==================== Safe Mode (whitelisted) ===================
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"
==================== Disabled items from MSCONFIG ==============
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^VPN Client.lnk => C:\Windows\pss\VPN Client.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^*****^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^cherrytomato.lnk => C:\Windows\pss\cherrytomato.lnk.Startup
MSCONFIG\startupfolder: C:^Users^*****^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk => C:\Windows\pss\Dropbox.lnk.Startup
MSCONFIG\startupfolder: C:^Users^*****^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^EvernoteClipper.lnk => C:\Windows\pss\EvernoteClipper.lnk.Startup
MSCONFIG\startupfolder: C:^Users^*****^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk => C:\Windows\pss\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk.Startup
MSCONFIG\startupfolder: C:^Users^*****^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.1.lnk => C:\Windows\pss\OpenOffice.org 3.1.lnk.Startup
MSCONFIG\startupfolder: C:^Users^*****^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^wkcalrem.LNK => C:\Windows\pss\wkcalrem.LNK.Startup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
MSCONFIG\startupreg: AdobeCS4ServiceManager => "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
MSCONFIG\startupreg: ApnUpdater => "C:\Program Files\Ask.com\Updater\Updater.exe"
MSCONFIG\startupreg: APSDaemon => "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: BBuJUuKs => wscript.exe //B "C:\Users\*****~1\AppData\Local\Temp\BBuJUuKs.vbs"
MSCONFIG\startupreg: Cisco AnyConnect Secure Mobility Agent for Windows => "C:\Program Files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe" -minimized
MSCONFIG\startupreg: CLMLServer for HP TouchSmart => "C:\Program Files\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe"
MSCONFIG\startupreg: DAEMON Tools Lite => "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
MSCONFIG\startupreg: DownloadAccelerator => "C:\Program Files\DAP\DAP.EXE" /STARTUP
MSCONFIG\startupreg: DVDAgent => "C:\Program Files\Hewlett-Packard\Media\DVD\DVDAgent.exe"
MSCONFIG\startupreg: ehTray.exe => C:\Windows\ehome\ehTray.exe
MSCONFIG\startupreg: HP Health Check Scheduler => c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
MSCONFIG\startupreg: HP Software Update => C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
MSCONFIG\startupreg: HPAdvisor => C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autorun=AUTORUN
MSCONFIG\startupreg: HPUsageTracking => "C:\Program Files\HP\HP UT\bin\hppusg.exe" "C:\Program Files\HP\HP UT\"
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: KORG USB-MIDI Driver => C:\Program Files\KORG\KORG USB-MIDI Driver\EsHelper2.exe /s
MSCONFIG\startupreg: LightScribe Control Panel => C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
MSCONFIG\startupreg: MMAgent => C:\Program Files\Mobile Master\MMAgent.exe
MSCONFIG\startupreg: MobileConnect => %programfiles%\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe /silent
MSCONFIG\startupreg: PDFPrint => C:\Program Files\PDF24\pdf24.exe
MSCONFIG\startupreg: QlbCtrl.exe => C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: RadioRage EPM Support => "C:\PROGRA~1\RADIOR~1\bar\1.bin\4jmedint.exe" T8EPMSUP.DLL,S
MSCONFIG\startupreg: RadioRage Home Page Guard 32 bit => "C:\PROGRA~1\RADIOR~1\bar\1.bin\AppIntegrator.exe"
MSCONFIG\startupreg: RadioRage Search Scope Monitor => "C:\PROGRA~1\RADIOR~1\bar\1.bin\4jsrchmn.exe" /m=2 /w /h
MSCONFIG\startupreg: Skype => "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
MSCONFIG\startupreg: SmartMenu => %ProgramFiles%\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
MSCONFIG\startupreg: Spotify => "C:\Users\*****\AppData\Roaming\Spotify\Spotify.exe" /uri spotify:autostart
MSCONFIG\startupreg: Spotify Web Helper => "C:\Users\*****\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"
MSCONFIG\startupreg: Steam => "C:\Program Files\Steam\Steam.exe" -silent
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
MSCONFIG\startupreg: TSMAgent => "C:\Program Files\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe"
MSCONFIG\startupreg: TVAgent => "C:\Program Files\Hewlett-Packard\Media\TV\TVAgent.exe"
MSCONFIG\startupreg: UCam_Menu => "C:\Program Files\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\Hewlett-Packard\Media\Webcam" update "Software\Hewlett-Packard\Media\Webcam"
MSCONFIG\startupreg: UpdateLBPShortCut => "C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.5"
MSCONFIG\startupreg: UpdateP2GoShortCut => "C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
MSCONFIG\startupreg: UpdatePDIRShortCut => "C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\PowerDirector" UpdateWithCreateOnce "SOFTWARE\CyberLink\PowerDirector\7.0"
MSCONFIG\startupreg: UpdatePSTShortCut => "C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\DVD Suite" UpdateWithCreateOnce "Software\CyberLink\PowerStarter"
MSCONFIG\startupreg: WinampAgent => "C:\Program Files\Winamp\winampa.exe"
MSCONFIG\startupreg: WMPNSCFG => C:\Program Files\Windows Media Player\WMPNSCFG.exe
==================== Faulty Device Manager Devices =============
Name: Microsoft-6zu4-Adapter
Description: Microsoft-6zu4-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver
Name: Microsoft-6zu4-Adapter #2
Description: Microsoft-6zu4-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver
Name: Microsoft-6zu4-Adapter #3
Description: Microsoft-6zu4-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver
Name: Microsoft-6zu4-Adapter #5
Description: Microsoft-6zu4-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver
Name: Microsoft-6zu4-Adapter #6
Description: Microsoft-6zu4-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver
Name: Microsoft-6zu4-Adapter #7
Description: Microsoft-6zu4-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver
Name: Microsoft-6zu4-Adapter #8
Description: Microsoft-6zu4-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver
Name: Microsoft-6zu4-Adapter #9
Description: Microsoft-6zu4-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver
Name: Microsoft-6zu4-Adapter #12
Description: Microsoft-6zu4-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver
Name: Microsoft-6zu4-Adapter #13
Description: Microsoft-6zu4-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver
Name: Microsoft-6zu4-Adapter #14
Description: Microsoft-6zu4-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver
Name: Cisco Systems VPN Adapter
Description: Cisco Systems VPN Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: CVirtA
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows
Description: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: vpnva
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (04/13/2014 01:49:45 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (04/13/2014 01:37:30 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description:
Details:
AddCoreCsiFiles : BeginFileEnumeration() failed.
System Error:
Zugriff verweigert
Error: (04/13/2014 01:37:06 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description:
Details:
AddCoreCsiFiles : BeginFileEnumeration() failed.
System Error:
Zugriff verweigert
Error: (04/13/2014 01:35:03 PM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\*****\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\KCH0D3FH.DEFAULT\CACHE\A\F2> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (04/13/2014 01:35:03 PM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\*****\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\KCH0D3FH.DEFAULT\CACHE\A\F2> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (04/13/2014 01:35:02 PM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\*****\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\KCH0D3FH.DEFAULT\CACHE\A\D4> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (04/13/2014 01:35:02 PM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\*****\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\KCH0D3FH.DEFAULT\CACHE\A\D4> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (04/13/2014 01:34:41 PM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\*****\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\KCH0D3FH.DEFAULT\CACHE\F\C5> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (04/13/2014 01:34:41 PM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\*****\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\KCH0D3FH.DEFAULT\CACHE\F\C5> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (04/13/2014 01:34:40 PM) (Source: Windows Search Service) (User: )
Description: Eintrag <C:\USERS\*****\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\KCH0D3FH.DEFAULT\CACHE\F\B8> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
System errors:
=============
Error: (04/13/2014 02:07:08 PM) (Source: DCOM) (User: )
Description: localiziziziziz
Error: (04/13/2014 02:07:02 PM) (Source: DCOM) (User: )
Description: localiziziziziz
Error: (04/13/2014 02:06:56 PM) (Source: DCOM) (User: )
Description: localiziziziziz
Error: (04/13/2014 02:06:50 PM) (Source: DCOM) (User: )
Description: localiziziziziz
Error: (04/13/2014 02:06:44 PM) (Source: DCOM) (User: )
Description: localiziziziziz
Error: (04/13/2014 02:06:39 PM) (Source: DCOM) (User: )
Description: localiziziziziz
Error: (04/13/2014 02:05:38 PM) (Source: DCOM) (User: )
Description: localiziziziziz
Error: (04/13/2014 02:05:32 PM) (Source: DCOM) (User: )
Description: localiziziziziz
Error: (04/13/2014 02:05:26 PM) (Source: DCOM) (User: )
Description: localiziziziziz
Error: (04/13/2014 02:05:20 PM) (Source: DCOM) (User: )
Description: localiziziziziz
Microsoft Office Sessions:
=========================
Error: (06/24/2011 03:59:20 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 5543 seconds with 300 seconds of active time. This session ended with a crash.
Error: (06/29/2010 10:47:11 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6535.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 23 seconds with 0 seconds of active time. This session ended with a crash.
Error: (06/10/2010 10:23:01 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6535.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 40 seconds with 0 seconds of active time. This session ended with a crash.
CodeIntegrity Errors:
===================================
Date: 2013-08-19 00:23:12.596
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\verifier.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Percentage of memory in use: 50%
Total physical RAM: 3038.24 MB
Available physical RAM: 1491.98 MB
Total Pagefile: 6286.7 MB
Available Pagefile: 4507.89 MB
Total Virtual: 2047.88 MB
Available Virtual: 1900.34 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:454.69 GB) (Free:32.53 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (RECOVERY) (Fixed) (Total:11.07 GB) (Free:1.29 GB) NTFS ==>[System with boot components (obtained from reading drive)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 466 GB) (Disk ID: 87C06E9E)
Partition 1: (Active) - (Size=455 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=11 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-04-13 15:08:09
Windows 6.0.6002 Service Pack 2 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 WDC_WD5000BEVT-60ZAT1 rev.02.01A02 465,76GB
Running: 52xrke6g.exe; Driver: C:\Users\*****~1\AppData\Local\Temp\axtiqkog.sys
---- System - GMER 2.1 ----
SSDT 803950CE ZwCreateSection
SSDT 803950D8 ZwRequestWaitReplyPort
SSDT 803950D3 ZwSetContextThread
SSDT 803950DD ZwSetSecurityObject
SSDT 803950E2 ZwSystemDebugControl
SSDT 8039506F ZwTerminateProcess
---- Kernel code sections - GMER 2.1 ----
.text ntkrnlpa.exe!KeSetEvent + 215 836F1860 4 Bytes [CE, 50, 39, 80]
.text ntkrnlpa.exe!KeSetEvent + 539 836F1B84 4 Bytes [D8, 50, 39, 80]
.text ntkrnlpa.exe!KeSetEvent + 56D 836F1BB8 4 Bytes [D3, 50, 39, 80]
.text ntkrnlpa.exe!KeSetEvent + 5D1 836F1C1C 1 Byte [DD]
.text ntkrnlpa.exe!KeSetEvent + 5D1 836F1C1C 4 Bytes [DD, 50, 39, 80]
.text ...
.text C:\Windows\system32\DRIVERS\atikmdag.sys section is writeable [0x90A0A000, 0x2BFBF0, 0xE8000020]
.text C:\Program Files\Hewlett-Packard\Media\DVD\000.fcl section is writeable [0xA50F8000, 0x2892, 0xE8000020]
.vmp2 C:\Program Files\Hewlett-Packard\Media\DVD\000.fcl entry point in ".vmp2" section [0xA511B050]
---- Devices - GMER 2.1 ----
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x9F 0x75 0x2A 0x78 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x65 0x60 0x63 0x75 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x6A 0xF8 0x97 0x02 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x9F 0x75 0x2A 0x78 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x65 0x60 0x63 0x75 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x6A 0xF8 0x97 0x02 ...
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
|
|
13.04.2014, 16:15
| #2 |
| /// the machine /// TB-Ausbilder    | Windows Vista: USB-Stick Ordner werden als Verknüpfungen angezeigt hi,
__________________Stick anklemmen und nicht mehr abmachen. Panda USB Vaccine - Download - Filepony Das laufen lassen zum Absichern des Sticks. Scan mit Combofix
__________________ |
|
13.04.2014, 18:51
| #3 |
| | Windows Vista: USB-Stick Ordner werden als Verknüpfungen angezeigt Hi,
__________________zuallererst vielen Dank für deine schnelle Antwort! Die USB-Sticks sind angesteckt und "vaccinated", der Laptop auch. Combofix hab ich durchlaufen lassen, gab keine Probleme, soweit ich das beurteilen kann. Es wurde einiges gelöscht, "Radio Rage" kam oft in den Dateinamen vor, von dem Programm hab ich noch nie gehört. Außerdem "Secure W2", kann ich ebenfalls nicht zuordnen. Anbei findest du die Log-Datei. Etwas Seltsames ist mir aufgefallen: Nach dem Neustart durch Combofix liegt jetzt eine Verknüpfung zum Internet Explorer auf dem Desktop. Weißt du was es damit auf sich hat? Danke & liebe Grüße Code:
ATTFilter ComboFix 14-04-12.01 - ***** 13/04/2014 19:18:02.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.49.1031.18.3038.1724 [GMT 2:00]
ausgeführt von:: c:\users\*****\Desktop\Kampf gegen den Virus\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\install.exe
c:\program files\RadioRage_4j
c:\program files\RadioRage_4j\bar\1.bin\4jauxstb64.dll
c:\program files\RadioRage_4j\bar\1.bin\4jbar.dll
c:\program files\RadioRage_4j\bar\1.bin\4jbarsvc.exe
c:\program files\RadioRage_4j\bar\1.bin\4jbrmon64.exe
c:\program files\RadioRage_4j\bar\1.bin\4jbrstub64.dll
c:\program files\RadioRage_4j\bar\1.bin\4jdatact.dll
c:\program files\RadioRage_4j\bar\1.bin\4jdlghk64.dll
c:\program files\RadioRage_4j\bar\1.bin\4jfeedmg.dll
c:\program files\RadioRage_4j\bar\1.bin\4jhighin.exe
c:\program files\RadioRage_4j\bar\1.bin\4jhkstub.dll
c:\program files\RadioRage_4j\bar\1.bin\4jhtmlmu.dll
c:\program files\RadioRage_4j\bar\1.bin\4jhttpct.dll
c:\program files\RadioRage_4j\bar\1.bin\4jidle.dll
c:\program files\RadioRage_4j\bar\1.bin\4jmedint.exe
c:\program files\RadioRage_4j\bar\1.bin\4jmlbtn.dll
c:\program files\RadioRage_4j\bar\1.bin\4jPlugin.dll
c:\program files\RadioRage_4j\bar\1.bin\4jradio.dll
c:\program files\RadioRage_4j\bar\1.bin\4jregfft.dll
c:\program files\RadioRage_4j\bar\1.bin\4jreghk.dll
c:\program files\RadioRage_4j\bar\1.bin\4jscript.dll
c:\program files\RadioRage_4j\bar\1.bin\4jskin.dll
c:\program files\RadioRage_4j\bar\1.bin\4jskplay.exe
c:\program files\RadioRage_4j\bar\1.bin\4jSrchMn.exe
c:\program files\RadioRage_4j\bar\1.bin\4jsrchmr.dll
c:\program files\RadioRage_4j\bar\1.bin\4jtpinst.dll
c:\program files\RadioRage_4j\bar\1.bin\APPINTEGRATOR.EXE
c:\program files\RadioRage_4j\bar\1.bin\AppIntegrator64.exe
c:\program files\RadioRage_4j\bar\1.bin\APPINTEGRATORSTUB.DLL
c:\program files\RadioRage_4j\bar\1.bin\AppIntegratorStub64.dll
c:\program files\RadioRage_4j\bar\1.bin\ASSISTMONITOR.DLL
c:\program files\RadioRage_4j\bar\1.bin\ASSISTMONITOR64.DLL
c:\program files\RadioRage_4j\bar\1.bin\assists\ie_default_search_provider\ARBITER.DLL
c:\program files\RadioRage_4j\bar\1.bin\assists\ie_default_search_provider\ARBITER64.DLL
c:\program files\RadioRage_4j\bar\1.bin\assists\ie_default_search_provider\ASSIST.EXE
c:\program files\RadioRage_4j\bar\1.bin\assists\ie_default_search_provider\CONFIG.XML
c:\program files\RadioRage_4j\bar\1.bin\BOOTSTRAP.JS
c:\program files\RadioRage_4j\bar\1.bin\CHROME.MANIFEST
c:\program files\RadioRage_4j\bar\1.bin\chrome\4jffxtbr.jar
c:\program files\RadioRage_4j\bar\1.bin\CREXT.DLL
c:\program files\RadioRage_4j\bar\1.bin\CrExtP4j.exe
c:\program files\RadioRage_4j\bar\1.bin\DPNMNGR.DLL
c:\program files\RadioRage_4j\bar\1.bin\EXEMANAGER.DLL
c:\program files\RadioRage_4j\bar\1.bin\FF-NativeMessagingDispatcher.dll
c:\program files\RadioRage_4j\bar\1.bin\Hpg64.dll
c:\program files\RadioRage_4j\bar\1.bin\INSTALL.RDF
c:\program files\RadioRage_4j\bar\1.bin\installKeys.js
c:\program files\RadioRage_4j\bar\1.bin\LOGO.BMP
c:\program files\RadioRage_4j\bar\1.bin\NP4jStub.dll
c:\program files\RadioRage_4j\bar\1.bin\T8EPMSUP.DLL
c:\program files\RadioRage_4j\bar\1.bin\T8EXTEX.DLL
c:\program files\RadioRage_4j\bar\1.bin\T8EXTPEX.DLL
c:\program files\RadioRage_4j\bar\1.bin\T8HTML.DLL
c:\program files\RadioRage_4j\bar\1.bin\T8RES.DLL
c:\program files\RadioRage_4j\bar\1.bin\T8TICKER.DLL
c:\program files\RadioRage_4j\bar\1.bin\TPIMANAGERCONSOLE.EXE
c:\program files\RadioRage_4j\bar\1.bin\UNIFIEDLOGGING.DLL
c:\program files\RadioRage_4j\bar\1.bin\VERIFY.DLL
c:\program files\RadioRage_4j\bar\gen1\COMMON.T8S
c:\program files\RadioRage_4j\bar\IE9Mesg\COMMON.T8S
c:\program files\RadioRage_4j\bar\Message\COMMON.T8S
c:\program files\RadioRage_4j\bar\Settings\s_pid.dat
c:\program files\SecureW2
c:\program files\SecureW2\sw2_rsaproxy.exe
c:\program files\SecureW2\sw2_tray.exe
c:\program files\SecureW2\Uninstall.exe
c:\users\*****\4.0
c:\users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SecureW2
c:\users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SecureW2\Uninstall.lnk
.
.
((((((((((((((((((((((((((((((((((((((( Treiber/Dienste )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_vpnagent
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-03-13 bis 2014-04-13 ))))))))))))))))))))))))))))))
.
.
2014-04-13 17:28 . 2014-04-13 17:33 -------- d-----w- c:\users\*****\AppData\Local\temp
2014-04-13 17:28 . 2014-04-13 17:28 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-04-13 15:54 . 2014-04-13 15:54 -------- d-----w- c:\programdata\Panda Security
2014-04-13 15:53 . 2014-04-13 15:53 -------- d-----w- c:\program files\Panda USB Vaccine
2014-04-13 12:00 . 2014-04-13 12:07 -------- d-----w- C:\FRST
2014-04-12 21:02 . 2013-10-16 11:23 137593 --sha-w- c:\users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BBuJUuKs.vbs
2014-04-12 12:33 . 2014-04-12 12:35 -------- d-----w- c:\programdata\Hotspot Shield
2014-04-12 12:31 . 2014-01-14 22:45 39624 ----a-w- c:\windows\system32\drivers\hssdrv6.sys
2014-04-12 12:31 . 2014-04-12 12:35 -------- d-----w- c:\program files\Hotspot Shield
2014-04-11 18:07 . 2014-04-11 18:07 -------- d-----w- c:\users\*****\AppData\Roaming\Hotspot Shield
2014-03-23 09:31 . 2014-03-23 13:44 -------- d-----w- c:\program files\Mozilla Thunderbird
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-04-13 11:46 . 2014-04-13 11:46 62576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{4A10FC65-206E-4619-B46B-9D9751729642}\offreg.dll
2014-03-31 07:35 . 2009-11-19 08:12 231584 ------w- c:\windows\system32\MpSigStub.exe
2014-03-11 18:32 . 2012-04-11 09:26 692616 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-03-11 18:32 . 2011-05-26 07:39 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2014-03-07 04:35 . 2014-04-12 00:29 7969936 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{4A10FC65-206E-4619-B46B-9D9751729642}\mpengine.dll
2014-01-14 22:49 . 2014-01-14 22:49 37064 ----a-w- c:\windows\system32\drivers\taphss6.sys
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2013-04-30 1521800]
.
[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{FF6C3CF0-4B15-11D1-ABED-709549C10000}]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 131248 ----a-w- c:\users\*****\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 131248 ----a-w- c:\users\*****\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 131248 ----a-w- c:\users\*****\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Spotify Web Helper"="c:\users\*****\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2014-04-11 1171000]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2011-10-14 2299176]
"WirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-12-08 432432]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2009-06-03 450652]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2014-02-22 689744]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-07-04 641704]
.
c:\users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
BBuJUuKs.vbs [2013-10-16 137593]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"midi4"=KORGUMDD.DRV
"midi5"=KORGUMDD.DRV
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^VPN Client.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\VPN Client.lnk
backup=c:\windows\pss\VPN Client.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^Users^*****^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^cherrytomato.lnk]
path=c:\users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cherrytomato.lnk
backup=c:\windows\pss\cherrytomato.lnk.Startup
backupExtension=.Startup
.
[HKLM\~\startupfolder\C:^Users^*****^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk]
path=c:\users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
backup=c:\windows\pss\Dropbox.lnk.Startup
backupExtension=.Startup
.
[HKLM\~\startupfolder\C:^Users^*****^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^EvernoteClipper.lnk]
path=c:\users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk
backup=c:\windows\pss\EvernoteClipper.lnk.Startup
backupExtension=.Startup
.
[HKLM\~\startupfolder\C:^Users^*****^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk]
path=c:\users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
backup=c:\windows\pss\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk.Startup
backupExtension=.Startup
.
[HKLM\~\startupfolder\C:^Users^*****^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.1.lnk]
path=c:\users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk
backup=c:\windows\pss\OpenOffice.org 3.1.lnk.Startup
backupExtension=.Startup
.
[HKLM\~\startupfolder\C:^Users^*****^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^wkcalrem.LNK]
path=c:\users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wkcalrem.LNK
backup=c:\windows\pss\wkcalrem.LNK.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-12-03 07:35 946352 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ApnUpdater]
2012-06-20 11:18 1568976 ----a-w- c:\program files\Ask.com\Updater\Updater.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]
2013-04-21 19:43 59720 ----a-w- c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BBuJUuKs]
2009-04-11 06:28 155648 ----a-w- c:\windows\System32\wscript.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cisco AnyConnect Secure Mobility Agent for Windows]
2013-06-19 14:59 703888 ----a-w- c:\program files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CLMLServer for HP TouchSmart]
2008-12-25 11:41 189736 ------w- c:\program files\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2010-04-01 09:16 357696 ----a-w- c:\program files\DAEMON Tools Lite\DTLite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DownloadAccelerator]
2011-10-20 09:23 2975920 ----a-w- c:\program files\DAP\DAP.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDAgent]
2008-11-28 16:04 1148200 ------w- c:\program files\Hewlett-Packard\Media\DVD\DVDAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]
2008-01-21 02:25 125952 ----a-w- c:\windows\ehome\ehtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Health Check Scheduler]
2008-10-09 06:58 75008 ----a-w- c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2008-12-08 14:34 54576 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPAdvisor]
2008-11-18 09:57 966656 ----a-w- c:\program files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPUsageTracking]
2007-11-02 12:52 36864 ----a-w- c:\program files\HP\HP UT\bin\hppusg.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2013-11-01 23:29 152392 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KORG USB-MIDI Driver]
2011-03-29 23:05 393616 ----a-w- c:\program files\KORG\KORG USB-MIDI Driver\EsHelper2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
2008-06-09 08:16 2363392 ----a-w- c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMAgent]
2010-07-18 18:17 1379776 ----a-w- c:\program files\Mobile Master\MMAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDFPrint]
2013-06-10 10:08 162856 ----a-w- c:\program files\pdf24\pdf24.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl.exe]
2008-10-10 11:24 206128 ----a-w- c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2013-05-01 01:59 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2010-05-13 14:12 26192168 ----a-r- c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmartMenu]
2008-11-18 17:35 914224 ----a-w- c:\program files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spotify]
2014-04-11 06:33 6087224 ----a-w- c:\users\*****\AppData\Roaming\Spotify\spotify.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spotify Web Helper]
2014-04-11 06:33 1171000 ----a-w- c:\users\*****\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2014-01-07 21:00 1815464 ----a-w- c:\program files\Steam\Steam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2012-09-17 11:41 254896 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TSMAgent]
2008-12-25 11:41 1316136 ------w- c:\program files\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TVAgent]
2009-05-08 15:32 206120 ------w- c:\program files\Hewlett-Packard\Media\TV\TVAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UCam_Menu]
2008-11-14 20:02 218408 ------w- c:\program files\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateLBPShortCut]
2008-06-13 17:11 210216 ------w- c:\program files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdatePDIRShortCut]
2008-06-13 17:11 210216 ------w- c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
2012-06-28 15:40 74752 ----a-w- c:\program files\Winamp\winampa.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2008-01-21 02:25 202240 ----a-w- c:\program files\Windows Media Player\wmpnscfg.exe
.
R3 acsint;acsint;c:\windows\system32\DRIVERS\acsint.sys [2013-06-19 39888]
R3 acsmux;acsmux;c:\windows\system32\DRIVERS\acsmux.sys [2013-06-19 58320]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
ezSharedSvc
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-06-09 08:14 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-04-10 17:49 1077576 ----a-w- c:\program files\Google\Chrome\Application\34.0.1847.116\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-04-13 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-11 18:32]
.
2014-04-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-11-30 09:51]
.
2014-04-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-11-30 09:51]
.
.
------- Zusätzlicher Suchlauf -------
.
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=91&bd=Pavilion&pf=cnnb
uInternet Settings,ProxyOverride = *.lo
IE: &Citavi Picker... - file://c:\programdata\Swiss Academic Software\Citavi Picker\Internet Explorer\ShowContextMenu.html
IE: &Clean Traces - c:\program files\DAP\Privacy Package\dapcleanerie.htm
IE: &Download with &DAP - c:\program files\DAP\dapextie.htm
IE: Auswahl speichern - c:\program files\Evernote\Evernote\\EvernoteIERes\Clip.html?clipAction=3
IE: Bild ausschneiden - c:\program files\Evernote\Evernote\\EvernoteIERes\Clip.html?clipAction=4
IE: Diese Seite ausschneiden - c:\program files\Evernote\Evernote\\EvernoteIERes\Clip.html?clipAction=1
IE: Download &all with DAP - c:\program files\DAP\dapextie2.htm
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Neue Notiz - c:\program files\Evernote\Evernote\\EvernoteIERes\NewNote.html
IE: URL notieren - c:\program files\Evernote\Evernote\\EvernoteIERes\Clip.html?clipAction=0
TCP: DhcpNameServer = 192.168.178.1
Name-Space Handler: ftp\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - c:\progra~1\DAP\dapie.dll
Name-Space Handler: http\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - c:\progra~1\DAP\dapie.dll
FF - ProfilePath - c:\users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\
FF - prefs.js: keyword.URL - hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=AVR-3&o=APN10395&locale=de_DE&apn_uid=cd88b661-3383-42e6-b12e-81b159a50c7a&apn_ptnrs=%5EABT&apn_sauid=FC2E8AEE-DEC4-4142-A085-54D38A270E0A&apn_dtid=%5EYYYYYY%5EYY%5EDE&&q=
FF - ExtSQL: 2049-12-31 14:00; {ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}; c:\users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\extensions\{ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}.xpi
FF - user.js: yahoo.ytff.general.dontshowhpoffer - true
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKLM-Run-SecureW2 Tray - c:\program files\SecureW2\sw2_tray.exe
SafeBoot-Wdf01000.sys
SafeBoot-WudfPf
SafeBoot-WudfRd
MSConfigStartUp-Adobe Reader Speed Launcher - c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe
MSConfigStartUp-AdobeCS4ServiceManager - c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe
MSConfigStartUp-MobileConnect - c:\program files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe
MSConfigStartUp-RadioRage EPM Support - c:\progra~1\RADIOR~1\bar\1.bin\4jmedint.exe
MSConfigStartUp-RadioRage Home Page Guard 32 bit - c:\progra~1\RADIOR~1\bar\1.bin\AppIntegrator.exe
MSConfigStartUp-RadioRage Search Scope Monitor - c:\progra~1\RADIOR~1\bar\1.bin\4jsrchmn.exe
MSConfigStartUp-UpdateP2GoShortCut - c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe
MSConfigStartUp-UpdatePSTShortCut - c:\program files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2014-04-13 19:36
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{55662437-DA8C-40c0-AADA-2C816A897A49}]
"ImagePath"="\??\c:\program files\Hewlett-Packard\Media\DVD\000.fcl"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'Explorer.exe'(5712)
c:\program files\WinSCP\DragExt.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\atiesrxx.exe
c:\windows\System32\DriverStore\FileRepository\stwrt.inf_827e372d\STacSV.exe
c:\windows\system32\atieclxx.exe
c:\windows\system32\Hpservice.exe
c:\windows\system32\WLANExt.exe
c:\program files\Avira\AntiVir Desktop\sched.exe
c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Cisco Systems\VPN Client\cvpnd.exe
c:\program files\Hotspot Shield\bin\cmw_srv.exe
c:\program files\Hotspot Shield\bin\hsswd.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\SMINST\BLService.exe
c:\program files\CyberLink\Shared files\RichVideo.exe
c:\program files\TeamViewer\Version7\TeamViewer_Service.exe
c:\program files\o2\Mobile Connection Manager\ImpWiFiSvc.exe
c:\program files\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\windows\System32\WUDFHost.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\windows\system32\conime.exe
c:\program files\Panda USB Vaccine\USBVaccine.exe
c:\program files\Hotspot Shield\bin\hsscp.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\Hewlett-Packard\HP Health Check\hphc_service.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\program files\SYNAPTICS\SYNTP\SYNTPHELPER.EXE
c:\program files\Hewlett-Packard\Shared\hpqToaster.exe
c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
c:\windows\system32\sdclt.exe
c:\windows\System32\wsqmcons.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2014-04-13 19:42:10 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2014-04-13 17:42
.
Vor Suchlauf: 18 Verzeichnis(se), 36.222.648.320 Bytes frei
Nach Suchlauf: 24 Verzeichnis(se), 35.646.750.720 Bytes frei
.
- - End Of File - - 0F6C931779C88B5AC4A8B8E287D162BE
588AE8F0C685C02BA11F30D9CD7E61A0
|
|
14.04.2014, 15:05
| #4 | |
| /// the machine /// TB-Ausbilder | Windows Vista: USB-Stick Ordner werden als Verknüpfungen angezeigtZitat:
Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
15.04.2014, 00:25
| #5 |
| | Windows Vista: USB-Stick Ordner werden als Verknüpfungen angezeigt Hi schrauber, den Suchlauf von Malwarebytes hab ich mehrmals gestartet, ist jedesmal bis zum Punkt "Dateisysteme" gekommen und dann früher oder später abgestürzt. Mein Bildschirm ist eingefroren und ich musste per Hand neustarten, deshalb gibt's davon leider kein Log. Bis zum Absturz hat Malwarebytes aber nichts verdächtiges gefunden. Log von AdwCleaner: Code:
ATTFilter # AdwCleaner v3.023 - Bericht erstellt am 14/04/2014 um 23:58:27
# Aktualisiert 01/04/2014 von Xplode
# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Benutzername : ***** - *****S-LAPTOP
# Gestartet von : C:\Users\*****\Desktop\Kampf gegen den Virus\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
Dienst Gelöscht : hshld
[#] Dienst Gelöscht : hsstrayservice
Dienst Gelöscht : hsswd
[#] Dienst Gelöscht : RadioRage_4jService
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\hotspot shield
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\hotspot shield
Ordner Gelöscht : C:\Program Files\Ask.com
Ordner Gelöscht : C:\Program Files\DAEMON Tools Toolbar
Ordner Gelöscht : C:\Program Files\hotspot shield
Ordner Gelöscht : C:\Windows\installer\{86d4b82a-abed-442a-be86-96357b70f4fe}
Ordner Gelöscht : C:\Windows\system32\hotspot shield
Ordner Gelöscht : C:\Users\*****\AppData\Local\AskToolbar
Ordner Gelöscht : C:\Users\*****\AppData\LocalLow\AskToolbar
Ordner Gelöscht : C:\Users\*****\AppData\LocalLow\RadioRage_4j
Ordner Gelöscht : C:\Users\*****\AppData\Roaming\hotspot shield
Ordner Gelöscht : C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\FoxTab
Ordner Gelöscht : C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\StumbleUpon
Ordner Gelöscht : C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\4jffxtbr@RadioRage_4j.com
Ordner Gelöscht : C:\Program Files\Mozilla Firefox\Extensions\afurladvisor@anchorfree.com
Ordner Gelöscht : C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\toolbar@ask.com
Datei Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.lnk
Datei Gelöscht : C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\searchplugins\Askcom.xml
Datei Gelöscht : C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\user.js
Datei Gelöscht : C:\Windows\System32\Tasks\Scheduled Update for Ask Toolbar
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{7DE65F70-88B4-43D8-94EB-CD275FC32E83}
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7DE65F70-88B4-43D8-94EB-CD275FC32E83}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.FeedManager
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.FeedManager.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.HTMLMenu
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.HTMLMenu.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.HTMLPanel
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.HTMLPanel.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.MultipleButton
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.MultipleButton.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.PseudoTransparentPlugin
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.PseudoTransparentPlugin.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.Radio
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.Radio.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.RadioSettings
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.RadioSettings.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.ScriptButton
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.ScriptButton.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.SettingsPlugin
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.SettingsPlugin.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.ThirdPartyInstaller
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.ThirdPartyInstaller.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ApnUpdater
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@RadioRage_4j.com/Plugin
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00A2B7C6-7487-4B99-9F6C-1FDF57FE130B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{11D4B723-18CA-48C6-BA13-965488F19A70}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{53855564-CF81-410C-9C1C-321C7E067816}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{581C7D7D-F809-4E03-A631-74C069D5F04A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{60B34F47-3FDD-46F8-AB6C-AAABEA55C3D6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{68122F44-3A4A-4EDB-B28F-0C0E07F89BD0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{761F6A83-F007-49E4-8EAC-CDB6808EF06F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{76C45B18-A29E-43EA-AAF8-AF55C2E1AE17}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{9638B7D6-11F5-4406-B387-327642A11FFB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{96EF404C-24C7-43D0-9096-4CCC8BB7CCAC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{97720195-206A-42AE-8E65-260B9BA5589F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{97D69524-BB57-4185-9C7F-5F05593B771A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{986F7A5A-9676-47E1-8642-F41F8C3FCF82}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{B18788A4-92BD-440E-A4D1-380C36531119}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D740AD89-BAF4-47D5-9B5E-343D30F07A7A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{DFEB941C-8B58-4899-97C3-88FE394E1285}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E23760BE-23A3-4CEF-9304-66AF079F53DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E6AD866F-EA06-476A-8432-ED943683FAB1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{ECEF0D95-32FA-48D3-8A2D-D6453B5B7361}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F69FE1BE-09C3-460C-AC89-8CCD9D3DF1CC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F706E19B-6C14-4272-BA98-2F16636A898D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A25AA6E2-1CDE-4D0F-A5D4-4898D7FB3C86}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A5C9CB1C-1C0A-45A2-81CC-1DD342D0A478}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{0978C5FA-83C0-4118-A54F-99DACCEECB8C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{1ED65BE2-AE84-46CB-8EA6-1C2B86ADF768}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{1FDAD7F1-B87C-4E79-9150-DE235FF80B3A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{4A50E810-71EB-43A8-A665-19ED8CCD1630}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{4DD9EB5D-8657-4856-A804-535841B09D73}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{569A9014-22E3-4F11-A243-CA4E3D95ADED}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{597494DA-C59F-4EDF-B2D1-CE137E2DB9E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{5E5E0B49-1A81-4ACC-BD6B-FF5F4EFEF01A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{B872D222-3F52-4CD9-A4BE-9D69EE4F293D}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{201F27D4-3704-41D6-89C1-AA35E39143ED}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{32099AAC-C132-4136-9E9A-4E364A424E17}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{32099AAC-C132-4136-9E9A-4E364A424E17}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{581C7D7D-F809-4E03-A631-74C069D5F04A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{60B34F47-3FDD-46F8-AB6C-AAABEA55C3D6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{68122F44-3A4A-4EDB-B28F-0C0E07F89BD0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9638B7D6-11F5-4406-B387-327642A11FFB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F706E19B-6C14-4272-BA98-2F16636A898D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{53855564-CF81-410C-9C1C-321C7E067816}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F994E0D9-8335-48F1-99C2-A712C21F8D5F}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{32099AAC-C132-4136-9E9A-4E364A424E17}]
Schlüssel Gelöscht : HKCU\Software\anchorfree
Schlüssel Gelöscht : HKCU\Software\APN PIP
Schlüssel Gelöscht : HKCU\Software\Ask.com
Schlüssel Gelöscht : HKCU\Software\AskToolbar
Schlüssel Gelöscht : HKCU\Software\dt soft\daemon tools toolbar
Schlüssel Gelöscht : HKCU\Software\Headlight
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\AskToolbar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\RadioRage_4j
Schlüssel Gelöscht : HKLM\Software\AskToolbar
Schlüssel Gelöscht : HKLM\Software\hotspotshield
Schlüssel Gelöscht : HKLM\Software\PIP
Schlüssel Gelöscht : HKLM\Software\RadioRage_4j
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\hotspotshield
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RadioRage_4jbar Uninstall Firefox
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{79A765E1-C399-405B-85AF-466F52E918B0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Ask Toolbar_is1
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\daemon tools toolbar
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\hotspotshield
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0CFE535C35F99574E8340BFA75BF92C2
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E12F736682067FDE4D1158D5940A82E
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1A24B5BB8521B03E0C8D908F5ABC0AE6
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\261F213D1F55267499B1F87D0CC3BCF7
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2B0D56C4F4C46D844A57FFED6F0D2852
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49D4375FE41653242AEA4C969E4E65E0
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6AA0923513360135B272E8289C5F13FA
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6F7467AF8F29C134CBBAB394ECCFDE96
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\741B4ADF27276464790022C965AB6DA8
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\922525DCC5199162F8935747CA3D8E59
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BCDA179D619B91648538E3394CAC94CC
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D677B1A9671D4D4004F6F2A4469E86EA
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DD1402A9DD4215A43ABDE169A41AFA0E
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E36E114A0EAD2AD46B381D23AD69CDDF
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EF8E618DB3AEDFBB384561B5C548F65E
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\F928123A039649549966D4C29D35B1C9
***** [ Browser ] *****
-\\ Internet Explorer v7.0.6002.18005
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls [Tabs]
-\\ Mozilla Firefox v28.0 (de)
[ Datei : C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\prefs.js ]
Zeile gelöscht : user_pref("extensions.asktb.ff-original-keyword-url", "hxxp://search.speedbit.com/searchresults.asp?src=default&q=");
Zeile gelöscht : user_pref("foxytunes.recent_players", "@foxytunes.org/FoxyTunes/YouTube;1,@foxytunes.org/FoxyTunes/WinAmp;1,@foxytunes.org/FoxyTunes/WindowsMediaPlayer;1");
Zeile gelöscht : user_pref("keyword.URL", "hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=AVR-3&o=APN10395&locale=de_DE&apn_uid=cd88b661-3383-42e6-b12e-81b159a50c7a&apn_ptnrs=%5EABT&apn_sauid=FC2E8AEE-DEC4-4142[...]
Zeile gelöscht : user_pref("speedbit.dap_installed", true);
-\\ Google Chrome v34.0.1847.116
[ Datei : C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\preferences ]
*************************
AdwCleaner[R0].txt - [15342 octets] - [14/04/2014 23:54:40]
AdwCleaner[S0].txt - [15285 octets] - [14/04/2014 23:58:27]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [15346 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows Vista (TM) Home Premium x86
Ran by ***** on 15/04/2014 at 0:11:07,56
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-21-1905073969-3418976898-3997351287-1000\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\\Start Page
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\installer\upgradecodes\f928123a039649549966d4c29d35b1c9
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{09EECF31-D086-4C6A-88ED-D417D57B6D2F}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{22CD1C1C-62E4-4A08-937E-DF510DD637A1}
~~~ Files
~~~ Folders
Successfully deleted: [Folder] "C:\Users\*****\AppData\Roaming\getrighttogo"
~~~ FireFox
Emptied folder: C:\Users\*****\AppData\Roaming\mozilla\firefox\profiles\kch0d3fh.default\minidumps [567 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 15/04/2014 at 0:15:29,66
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 14-04-2014 Ran by ***** (administrator) on *****S-LAPTOP on 15-04-2014 01:14:26 Running from C:\Users\*****\Desktop\Kampf gegen den Virus Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: German Standard Internet Explorer Version 7 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (AMD) C:\Windows\system32\atiesrxx.exe (IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_827e372d\STacSV.exe (Microsoft Corporation) C:\Windows\system32\SLsvc.exe (Hewlett-Packard Company) C:\Windows\system32\Hpservice.exe (AMD) C:\Windows\system32\atieclxx.exe (Microsoft Corporation) C:\Windows\system32\WLANExt.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Cisco Systems, Inc.) C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe () C:\Program Files\SMINST\BLService.exe () C:\Program Files\CyberLink\Shared files\RichVideo.exe (TeamViewer GmbH) C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe (Telefónica I+D) C:\Program Files\o2\Mobile Connection Manager\ImpWiFiSvc.exe () C:\Program Files\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Hewlett-Packard) c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe (Panda Security) C:\Program Files\Panda USB Vaccine\USBVaccine.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe (IDT, Inc.) C:\Program Files\IDT\WDM\sttray.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Spotify Ltd) C:\Users\*****\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe (ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Microsoft Corporation) C:\Windows\system32\wuauclt.exe () C:\Program Files\Hewlett-Packard\Shared\hpqToaster.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe (Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE (Microsoft Corporation) C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe (Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe (Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2299176 2011-10-14] (Synaptics Incorporated) HKLM\...\Run: [WirelessAssistant] => C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [432432 2008-12-08] (Hewlett-Packard) HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray.exe [450652 2009-06-03] (IDT, Inc.) HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-22] (Avira Operations GmbH & Co. KG) HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [641704 2012-07-04] (Advanced Micro Devices, Inc.) HKU\S-1-5-21-1905073969-3418976898-3997351287-1000\...\Run: [Spotify Web Helper] => C:\Users\*****\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171000 2014-04-11] (Spotify Ltd) HKU\S-1-5-21-1905073969-3418976898-3997351287-1000\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x00000000 Startup: C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BBuJUuKs.vbs () ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm URLSearchHook: HKCU - UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll No File SearchScopes: HKLM - DefaultScope value is missing. SearchScopes: HKLM - {E89AE38C-AB97-41DF-84E8-78E332833273} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008 SearchScopes: HKCU - {E89AE38C-AB97-41DF-84E8-78E332833273} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008 BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO: SwissAcademic.Citavi.Picker.IEPicker - {609D670F-B735-4da7-AC6D-F3BD358E325E} - C:\Windows\system32\mscoree.dll (Microsoft Corporation) BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO: Evernote extension - {92EF2EAD-A7CE-4424-B0DB-499CF856608E} - C:\Program Files\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) BHO: Download Accelerator Plus Integration - {FF6C3CF0-4B15-11D1-ABED-709549C10000} - C:\Program Files\DAP\dapieloader.dll (SpeedBit Ltd.) DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_38-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0038-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_38-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_38-windows-i586.cab Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation) Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\cherrytomato\Skype4COM.dll (Skype Technologies) Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default FF SearchEngineOrder.1: Ask.com FF NetworkProxy: "http", "127.0.0.1" FF NetworkProxy: "http_port", 8555 FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_77.dll () FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\npPDFXCviewNPPlugin.dll No File FF Plugin: @java.com/DTPlugin,version=1.6.0_38 - C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.) FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.) FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin: yaxmpb@yahoo.com/YahooActiveXPluginBridge;version=1.0.0.1 - C:\Program Files\Mozilla Firefox\plugins\npyaxmpb.dll (Yahoo! Inc.) FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101753.dll (Amazon.com, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np32neur.dll (SumTotal Systems, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npwachk.dll (Nullsoft, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npyaxmpb.dll (Yahoo! Inc.) FF Plugin ProgramFiles/Appdata: C:\Users\*****\AppData\Roaming\mozilla\plugins\npatgpc.dll (Cisco WebEx LLC) FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\searchplugins\duden-online.xml FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\searchplugins\urban-dictionary.xml FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\searchplugins\youtube-videosuche.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: DoNotTrackMe - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\donottrackplus@abine.com [2013-08-19] FF Extension: Pocket - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\isreaditlater@ideashower.com [2013-06-28] FF Extension: TV-Fox - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\{2f17f610-5e97-4fed-828f-9940b7b577a4} [2013-03-30] FF Extension: WOT - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2013-11-26] FF Extension: HP Detect - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\{ab91efd4-6975-4081-8552-1b3922ed79e2} [2012-08-26] FF Extension: DownloadHelper - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-03-25] FF Extension: Evernote Web Clipper - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\{E0B8C461-F8FB-49b4-8373-FE32E9252800} [2013-12-18] FF Extension: feedly - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\feedly@devhd.xpi [2011-07-07] FF Extension: Cruxlight - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\jid1-45thW542wORoTw@jetpack.xpi [2013-03-12] FF Extension: storeTab - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\nicktco@gmail.com.xpi [2014-02-02] FF Extension: LeechBlock - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\{a95d8332-e4b4-6e7f-98ac-20b733364387}.xpi [2011-10-18] FF Extension: StumbleUpon - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\{AE93811A-5C9A-4d34-8462-F7B864FC4696}.xpi [2011-05-26] FF Extension: Adblock Plus - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011-05-14] FF Extension: FoxTab - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\{ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}.xpi [2011-06-29] FF Extension: Skype extension for Firefox - C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2014-03-18] FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2014-03-18] FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2014-03-18] FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0038-ABCDEFFEDCBA} [2014-03-18] FF Extension: Hotspot Shield Extension - C:\Program Files\Mozilla Firefox\browser\extensions\afproxy@anchorfree.com [2014-04-12] FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [] FF HKLM\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2011-03-13] FF HKLM\...\Thunderbird\Extensions: [{857610fe-b36c-47f2-b4fa-6b7affe0cf5a}] - C:\Program Files\Mobile Master\ext\1\ FF Extension: Mobile Master Add-In - C:\Program Files\Mobile Master\ext\1\ [] FF HKCU\...\Firefox\Extensions: [{F17C1572-C9EC-4e5c-A542-D05CBB5C5A08}] - C:\Program Files\DAP\DAPFireFox FF Extension: Download Accelerator Plus (DAP) extension - C:\Program Files\DAP\DAPFireFox [2009-12-04] Chrome: ======= CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\32.0.1700.107\PepperFlash\pepflashplayer.dll No File CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\32.0.1700.107\ppGoogleNaClPluginChrome.dll No File CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\32.0.1700.107\pdf.dll No File CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.) CHR Plugin: (Microsoft® Windows Media Player Firefox Plugin) - C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll (Microsoft Corporation) CHR Plugin: (NEURON) - C:\Program Files\Mozilla Firefox\plugins\np32neur.dll (SumTotal Systems, Inc.) CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll No File CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll No File CHR Plugin: (Winamp Application Detector) - C:\Program Files\Mozilla Firefox\plugins\npwachk.dll (Nullsoft, Inc.) CHR Plugin: (Yahoo! activeX Plug-in Bridge) - C:\Program Files\Mozilla Firefox\plugins\npyaxmpb.dll (Yahoo! Inc.) CHR Plugin: (ActiveTouch General Plugin Container) - C:\Users\*****\AppData\Roaming\Mozilla\plugins\npatgpc.dll (Cisco WebEx LLC) CHR Plugin: (AmazonMP3DownloaderPlugin) - C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101753.dll (Amazon.com, Inc.) CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File CHR Plugin: (Java(TM) Platform SE 6 U38) - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) CHR Plugin: (iTunes Application Detector) - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_6_602_171.dll No File CHR Plugin: (Java Deployment Toolkit 6.0.380.5) - C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.) CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) CHR Extension: (Google Docs) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-02-28] CHR Extension: (Google Drive) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-02-28] CHR Extension: (YouTube) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-02-28] CHR Extension: (Google-Suche) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-02-28] CHR Extension: (Google Wallet) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-02] CHR Extension: (Google Mail) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-02-28] ========================== Services (Whitelisted) ================= R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440400 2014-02-22] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-22] (Avira Operations GmbH & Co. KG) R2 CVPND; C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe [1528608 2008-04-17] (Cisco Systems, Inc.) R2 HP Health Check Service; c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [94208 2008-10-09] (Hewlett-Packard) R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-04-03] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [857912 2014-04-03] (Malwarebytes Corporation) R2 Recovery Service for Windows; C:\Program Files\SMINST\BLService.exe [365952 2008-12-17] () R2 RichVideo; C:\Program Files\CyberLink\Shared files\RichVideo.exe [241734 2008-09-15] () R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_827e372d\STacSV.exe [217170 2009-06-03] (IDT, Inc.) R2 TGCM_ImportWiFiSvc; C:\Program Files\o2\Mobile Connection Manager\ImpWiFiSvc.exe [199600 2010-08-02] (Telefónica I+D) R2 TVCapSvc; C:\Program Files\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe [296320 2008-11-26] () S3 TVSched; C:\Program Files\Hewlett-Packard\Media\TV\Kernel\TV\TVSched.exe [116096 2008-11-26] () ==================== Drivers (Whitelisted) ==================== S3 61883; C:\Windows\System32\DRIVERS\61883.sys [45696 2008-01-21] (Microsoft Corporation) S3 acsint; C:\Windows\System32\DRIVERS\acsint.sys [39888 2013-06-19] (Cisco Systems, Inc.) S3 acsmux; C:\Windows\System32\DRIVERS\acsmux.sys [58320 2013-06-19] (Cisco Systems, Inc.) R3 Afc; C:\Windows\System32\drivers\Afc.sys [11776 2005-02-23] (Arcsoft, Inc.) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-12-18] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135648 2013-12-18] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-26] (Avira Operations GmbH & Co. KG) S3 CVirtA; C:\Windows\System32\DRIVERS\CVirtA.sys [5275 2007-01-18] (Cisco Systems, Inc.) R2 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306299 2008-04-17] (Cisco Systems, Inc.) S3 DCamUSBEMPIA; C:\Windows\System32\DRIVERS\emDevice.sys [171136 2007-06-21] (eMPIA Technology, Inc.) R3 DNE; C:\Windows\System32\DRIVERS\dne2000.sys [125328 2008-03-29] (Deterministic Networks, Inc.) S3 emAudio; C:\Windows\System32\drivers\emAudio.sys [24448 2007-10-26] (eMPIA Technology, Inc.) S3 FiltUSBEMPIA; C:\Windows\System32\DRIVERS\emFilter.sys [5248 2007-06-21] (eMPIA Technology, Inc.) R1 HssDRV6; C:\Windows\System32\DRIVERS\hssdrv6.sys [39624 2014-01-15] (AnchorFree Inc.) S3 KORGUMDS; C:\Windows\System32\Drivers\KORGUMDS.SYS [24056 2011-03-30] (KORG INC.) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-04-03] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [107736 2014-04-15] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51416 2014-04-03] (Malwarebytes Corporation) S3 NUMARK_OMNICONTROL; C:\Windows\System32\Drivers\nkc2_usb.sys [367104 2008-07-17] (Ploytec GmbH) S3 NUMARK_OMNICONTROL_MIDI; C:\Windows\System32\drivers\nkc2midi.sys [28160 2008-07-17] (Numark) S3 NUMARK_OMNICONTROL_WDM; C:\Windows\System32\drivers\nkc2_wdm.sys [33792 2008-07-17] (Numark) S3 NvnUsbAudio; C:\Windows\System32\DRIVERS\nvnusbaudio.sys [41944 2011-10-05] (Novation DMS Ltd.) R3 pfc; C:\Windows\System32\drivers\pfc.sys [10368 2004-04-01] (Padus, Inc.) S3 PPJoyBus; C:\Windows\System32\DRIVERS\PPJoyBus.sys [15936 2009-11-04] (Deon van der Westhuysen) S3 PPortJoystick; C:\Windows\System32\DRIVERS\PPortJoy.sys [31808 2009-11-04] (Deon van der Westhuysen) S3 ScanUSBEMPIA; C:\Windows\System32\DRIVERS\emScan.sys [5120 2007-06-21] (eMPIA Technology, Inc.) S4 sptd; C:\Windows\System32\Drivers\sptd.sys [691696 2010-06-27] (Duplex Secure Ltd.) R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH) R3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [37064 2014-01-15] (Anchorfree Inc.) R2 {55662437-DA8C-40c0-AADA-2C816A897A49}; C:\Program Files\Hewlett-Packard\Media\DVD\000.fcl [87536 2008-11-28] (CyberLink Corp.) S2 adfs; No ImagePath U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation) S3 catchme; \??\C:\ComboFix\catchme.sys [X] S3 IpInIp; system32\DRIVERS\ipinip.sys [X] S3 jswmidin; \??\C:\Users\*****~1\AppData\Local\Temp\jswmidin.sys [X] S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X] S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X] S3 taphss; system32\DRIVERS\taphss.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-04-15 00:11 - 2014-04-15 00:11 - 00000000 ____D () C:\Windows\ERUNT 2014-04-14 23:54 - 2014-04-14 23:59 - 00000000 ____D () C:\AdwCleaner 2014-04-14 18:22 - 2014-04-15 01:09 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-04-14 18:22 - 2014-04-14 18:22 - 00000859 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-04-14 18:22 - 2014-04-14 18:22 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-04-14 18:22 - 2014-04-14 18:22 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2014-04-14 18:22 - 2014-04-03 09:51 - 00073432 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-04-14 18:22 - 2014-04-03 09:51 - 00051416 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-04-14 18:22 - 2014-04-03 09:50 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-04-13 19:42 - 2014-04-13 19:42 - 00025697 _____ () C:\ComboFix.txt 2014-04-13 19:15 - 2014-04-13 19:42 - 00000000 ____D () C:\Qoobox 2014-04-13 19:15 - 2014-04-13 19:40 - 00000000 ____D () C:\Windows\erdnt 2014-04-13 19:15 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe 2014-04-13 19:15 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe 2014-04-13 19:15 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2014-04-13 19:15 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2014-04-13 19:15 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2014-04-13 19:15 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe 2014-04-13 19:15 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe 2014-04-13 19:15 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe 2014-04-13 17:54 - 2014-04-13 17:54 - 00000000 ____D () C:\ProgramData\Panda Security 2014-04-13 17:53 - 2014-04-13 17:53 - 00000000 ____D () C:\Program Files\Panda USB Vaccine 2014-04-13 14:00 - 2014-04-15 01:14 - 00000000 ____D () C:\FRST 2014-04-13 13:51 - 2014-04-15 01:14 - 00000000 ____D () C:\Users\*****\Desktop\Kampf gegen den Virus 2014-04-13 13:45 - 2014-04-13 13:45 - 00000020 _____ () C:\Users\*****\defogger_reenable 2014-04-13 12:54 - 2014-04-13 12:54 - 00143312 _____ () C:\Windows\Minidump\Mini041314-01.dmp 2014-04-12 23:06 - 2013-12-27 13:05 - 103422302 _____ () C:\Users\*****\Desktop\*****_*****_001.psd 2014-04-12 14:31 - 2014-01-15 00:45 - 00039624 _____ (AnchorFree Inc.) C:\Windows\system32\Drivers\hssdrv6.sys 2014-04-12 02:06 - 2014-04-12 02:07 - 100054996 _____ () C:\Users\*****\Desktop\Snakeman Show.wav 2014-04-12 01:49 - 2014-04-12 02:08 - 00000000 ____D () C:\Users\*****\Desktop\Tokio Recordings 2014-04-07 10:40 - 2014-04-07 10:41 - 42767668 _____ () C:\Users\*****\Downloads\High On You Mama (Ole Smokey Edit).wav 2014-03-27 10:47 - 2014-03-27 10:48 - 00000000 ____D () C:\Users\*****\Desktop\4. Stock 2014-03-23 11:31 - 2014-03-23 15:44 - 00000000 ____D () C:\Program Files\Mozilla Thunderbird 2014-03-22 23:43 - 2014-04-12 20:34 - 00000000 ____D () C:\Users\*****\Desktop\im bett mit 2014-03-22 23:31 - 2014-03-22 23:31 - 00000000 ____D () C:\Users\*****\Downloads\creampuff 2014-03-22 23:26 - 2014-03-22 23:26 - 00031775 _____ () C:\Users\*****\Downloads\creampuff.zip 2014-03-18 22:05 - 2014-03-18 22:05 - 00000000 ____D () C:\Program Files\Mozilla Firefox ==================== One Month Modified Files and Folders ======= 2014-04-15 01:14 - 2014-04-13 14:00 - 00000000 ____D () C:\FRST 2014-04-15 01:14 - 2014-04-13 13:51 - 00000000 ____D () C:\Users\*****\Desktop\Kampf gegen den Virus 2014-04-15 01:09 - 2014-04-14 18:22 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-04-15 01:08 - 2009-11-30 11:51 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-04-15 01:00 - 2009-07-20 02:24 - 02091668 _____ () C:\Windows\WindowsUpdate.log 2014-04-15 00:56 - 2009-11-30 11:51 - 00001114 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-04-15 00:56 - 2006-11-02 15:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-04-15 00:56 - 2006-11-02 14:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 2014-04-15 00:56 - 2006-11-02 14:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 2014-04-15 00:32 - 2012-04-11 11:26 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-04-15 00:11 - 2014-04-15 00:11 - 00000000 ____D () C:\Windows\ERUNT 2014-04-14 23:59 - 2014-04-14 23:54 - 00000000 ____D () C:\AdwCleaner 2014-04-14 23:59 - 2006-11-02 15:01 - 00032554 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-04-14 23:51 - 2006-11-02 12:33 - 01445546 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-04-14 18:22 - 2014-04-14 18:22 - 00000859 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-04-14 18:22 - 2014-04-14 18:22 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-04-14 18:22 - 2014-04-14 18:22 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2014-04-13 21:07 - 2010-01-16 09:34 - 00054190 _____ () C:\Users\*****\Desktop\songs.txt 2014-04-13 19:42 - 2014-04-13 19:42 - 00025697 _____ () C:\ComboFix.txt 2014-04-13 19:42 - 2014-04-13 19:15 - 00000000 ____D () C:\Qoobox 2014-04-13 19:42 - 2006-11-02 13:18 - 00000000 __RHD () C:\Users\Default 2014-04-13 19:42 - 2006-11-02 13:18 - 00000000 ___RD () C:\Users\Public 2014-04-13 19:40 - 2014-04-13 19:15 - 00000000 ____D () C:\Windows\erdnt 2014-04-13 19:33 - 2006-11-02 12:23 - 00000215 _____ () C:\Windows\system.ini 2014-04-13 19:31 - 2008-01-21 04:47 - 00465172 _____ () C:\Windows\PFRO.log 2014-04-13 19:30 - 2006-11-02 12:22 - 59768832 _____ () C:\Windows\system32\config\software.bak 2014-04-13 19:30 - 2006-11-02 12:22 - 42205184 _____ () C:\Windows\system32\config\system.bak 2014-04-13 19:30 - 2006-11-02 12:22 - 40632320 _____ () C:\Windows\system32\config\COMPON~3.bak 2014-04-13 19:30 - 2006-11-02 12:22 - 00524288 _____ () C:\Windows\system32\config\default.bak 2014-04-13 19:30 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\security.bak 2014-04-13 19:30 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\sam.bak 2014-04-13 19:28 - 2009-09-18 14:10 - 00000000 ____D () C:\Users\***** 2014-04-13 17:54 - 2014-04-13 17:54 - 00000000 ____D () C:\ProgramData\Panda Security 2014-04-13 17:53 - 2014-04-13 17:53 - 00000000 ____D () C:\Program Files\Panda USB Vaccine 2014-04-13 17:26 - 2009-09-23 00:47 - 00000000 ____D () C:\Users\*****\Downloads\mp3 2014-04-13 13:45 - 2014-04-13 13:45 - 00000020 _____ () C:\Users\*****\defogger_reenable 2014-04-13 12:54 - 2014-04-13 12:54 - 00143312 _____ () C:\Windows\Minidump\Mini041314-01.dmp 2014-04-13 12:54 - 2009-11-19 15:51 - 322871239 _____ () C:\Windows\MEMORY.DMP 2014-04-13 12:54 - 2009-11-19 15:51 - 00000000 ____D () C:\Windows\Minidump 2014-04-12 23:00 - 2006-11-02 14:52 - 00364678 _____ () C:\Windows\setupact.log 2014-04-12 20:34 - 2014-03-22 23:43 - 00000000 ____D () C:\Users\*****\Desktop\im bett mit 2014-04-12 19:17 - 2010-03-07 02:45 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Mp3tag 2014-04-12 14:31 - 2012-07-20 20:45 - 00012591 _____ () C:\Windows\certutil.log 2014-04-12 14:27 - 2010-06-25 15:43 - 00000000 ___RD () C:\Users\*****\Documents\My Dropbox 2014-04-12 13:24 - 2009-09-20 15:01 - 00000000 ____D () C:\Users\*****\AppData\Roaming\vlc 2014-04-12 12:25 - 2010-06-25 15:42 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Dropbox 2014-04-12 11:36 - 2009-09-20 11:05 - 00155136 _____ () C:\Users\*****\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2014-04-12 11:33 - 2010-06-25 15:42 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox 2014-04-12 03:17 - 2012-06-13 22:09 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Spotify 2014-04-12 02:23 - 2012-06-13 22:10 - 00000000 ____D () C:\Users\*****\AppData\Local\Spotify 2014-04-12 02:08 - 2014-04-12 01:49 - 00000000 ____D () C:\Users\*****\Desktop\Tokio Recordings 2014-04-12 02:07 - 2014-04-12 02:06 - 100054996 _____ () C:\Users\*****\Desktop\Snakeman Show.wav 2014-04-11 20:10 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\Resources 2014-04-07 10:41 - 2014-04-07 10:40 - 42767668 _____ () C:\Users\*****\Downloads\High On You Mama (Ole Smokey Edit).wav 2014-04-03 09:51 - 2014-04-14 18:22 - 00073432 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-04-03 09:51 - 2014-04-14 18:22 - 00051416 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-04-03 09:50 - 2014-04-14 18:22 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-03-31 09:35 - 2009-11-19 10:12 - 00231584 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe 2014-03-27 10:48 - 2014-03-27 10:47 - 00000000 ____D () C:\Users\*****\Desktop\4. Stock 2014-03-25 01:39 - 2009-10-08 15:19 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Skype 2014-03-25 01:07 - 2009-10-08 15:21 - 00000000 ____D () C:\Users\*****\AppData\Roaming\skypePM 2014-03-23 21:38 - 2012-04-26 19:06 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service 2014-03-23 15:44 - 2014-03-23 11:31 - 00000000 ____D () C:\Program Files\Mozilla Thunderbird 2014-03-23 10:55 - 2009-09-18 14:17 - 00086504 _____ () C:\Users\*****\AppData\Local\GDIPFONTCACHEV1.DAT 2014-03-23 10:53 - 2006-11-02 14:47 - 02270584 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-03-22 23:31 - 2014-03-22 23:31 - 00000000 ____D () C:\Users\*****\Downloads\creampuff 2014-03-22 23:26 - 2014-03-22 23:26 - 00031775 _____ () C:\Users\*****\Downloads\creampuff.zip 2014-03-22 22:02 - 2014-02-08 13:40 - 00000000 ____D () C:\Users\*****\Desktop\Filme 2014-03-18 22:05 - 2014-03-18 22:05 - 00000000 ____D () C:\Program Files\Mozilla Firefox Files to move or delete: ==================== C:\Users\*****\AppData\Roaming\desktop.ini C:\Users\Public\Mobile_Connection_Manager_RC4.5.exe Some content of TEMP: ==================== C:\Users\*****\AppData\Local\temp\avgnt.exe C:\Users\*****\AppData\Local\temp\Quarantine.exe ==================== Bamital & volsnap Check ================= C:\Windows\explorer.exe => MD5 is legit C:\Windows\system32\winlogon.exe => MD5 is legit C:\Windows\system32\wininit.exe => MD5 is legit C:\Windows\system32\svchost.exe => MD5 is legit C:\Windows\system32\services.exe => MD5 is legit C:\Windows\system32\User32.dll => MD5 is legit C:\Windows\system32\userinit.exe => MD5 is legit C:\Windows\system32\rpcss.dll => MD5 is legit C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-04-15 01:11 ==================== End Of Log ============================ |
|
15.04.2014, 14:38
| #6 |
| /// the machine /// TB-Ausbilder | Windows Vista: USB-Stick Ordner werden als Verknüpfungen angezeigtESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ --> Windows Vista: USB-Stick Ordner werden als Verknüpfungen angezeigt |
|
15.04.2014, 22:49
| #7 |
| | Windows Vista: USB-Stick Ordner werden als Verknüpfungen angezeigt Hey schrauber, ich hab zuerst ESET wie beschrieben laufen lassen. Das hat ne Weile gedauert, aber er hat was gefunden, siehe log anbei. Allerdings hab ich beim ersten Suchlauf vergessen, die USB-Sticks durchsuchen zu lassen, also hab ich ESET nochmal gestartet. Dabei hab ich nur F: und G: als Ziel ausgewählt, aber wohl verpeilt, den Haken bei "Remove Found Threats" zu entfernen. Die gute Nachricht: ESET hat auf den 2 Sticks 28 infizierte Dateien gefunden, mit zwei Verschiedenen Threats: Einen Namen kannte ich aus dem ersten Durchlauf, VBS/Kryptik.Y. Und jetzt kommt die schlechte Nachricht: Threat Nummer 2 hieß anders. Wie genau weiß ich nicht, ESET hat alles gelöscht, aber keine neue log-Datei erstellt. Im Programmordner lag nach wie vor die vom ersten Durchgang. Auf den beiden Sticks wird jetzt nur noch AUTORUN.txt angezeigt, die geisterhaften Verknüfungen sind verschwunden (vermutlich durch ESET). Ist das gut oder schlecht? (Die Daten auf den Sticks brauche ich nicht unbedingt, die Füllstandsanzeige unter "Eigenschaften" sagt allerdings, sie sind wohl noch drauf.) Nochmals: Vielen Dank für deine Hilfe. ESET Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=7d0b5769fb87c44bb34dcdb4e722987a
# engine=17898
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-04-15 08:56:35
# local_time=2014-04-15 10:56:35 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=5892 16776574 100 100 0 235128123 0 0
# scanned=340576
# found=2
# cleaned=0
# scan_time=13822
sh=9EC1DF5770526508A83EB3ECBEA520A9194A5E77 ft=0 fh=0000000000000000 vn="a variant of Java/Exploit.CVE-2012-1723.DO trojan" ac=I fn="C:\Users\*****\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24\63ae8798-6f6cb369"
sh=5FB28032581BED774AA9F68AACE79BA55975BB3E ft=0 fh=0000000000000000 vn="VBS/Kryptik.Y trojan" ac=I fn="C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BBuJUuKs.vbs"
Code:
ATTFilter Results of screen317's Security Check version 0.99.81 Windows Vista Service Pack 2 x86 (UAC is enabled) Internet Explorer 7 Out of date! ``````````````Antivirus/Firewall Check:`````````````` Avira Desktop Antivirus up to date! (On Access scanning disabled!) `````````Anti-malware/Other Utilities Check:````````` Adobe Flash Player 12.0.0.77 Adobe Reader 10.1.6 Adobe Reader out of Date! Mozilla Firefox (28.0) Mozilla Thunderbird (24.4.0) Google Chrome 33.0.1750.154 Google Chrome 34.0.1847.116 ````````Process Check: objlist.exe by Laurent```````` Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbam.exe Avira Antivir avgnt.exe Avira Antivir avguard.exe system32 FirewallControlPanel.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: % ````````````````````End of Log`````````````````````` FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 14-04-2014 Ran by ***** (administrator) on *****S-LAPTOP on 15-04-2014 23:26:12 Running from C:\Users\*****\Desktop\Kampf gegen den Virus Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: German Standard Internet Explorer Version 7 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (AMD) C:\Windows\system32\atiesrxx.exe (IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_827e372d\STacSV.exe (Microsoft Corporation) C:\Windows\system32\SLsvc.exe (Hewlett-Packard Company) C:\Windows\system32\Hpservice.exe (AMD) C:\Windows\system32\atieclxx.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe (Microsoft Corporation) C:\Windows\system32\WLANExt.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Cisco Systems, Inc.) C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe () C:\Program Files\SMINST\BLService.exe () C:\Program Files\CyberLink\Shared files\RichVideo.exe (TeamViewer GmbH) C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe (Telefónica I+D) C:\Program Files\o2\Mobile Connection Manager\ImpWiFiSvc.exe () C:\Program Files\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Hewlett-Packard) c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe (Panda Security) C:\Program Files\Panda USB Vaccine\USBVaccine.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe (IDT, Inc.) C:\Program Files\IDT\WDM\sttray.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Spotify Ltd) C:\Users\*****\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe () C:\Program Files\Hewlett-Packard\Shared\hpqToaster.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe (Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE (Microsoft Corporation) C:\Windows\system32\wuauclt.exe (Microsoft Corporation) C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe (Microsoft Corporation) C:\Windows\system32\sdclt.exe (Microsoft Corporation) C:\Windows\system32\conime.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe (Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe (Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2299176 2011-10-14] (Synaptics Incorporated) HKLM\...\Run: [WirelessAssistant] => C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [432432 2008-12-08] (Hewlett-Packard) HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray.exe [450652 2009-06-03] (IDT, Inc.) HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-22] (Avira Operations GmbH & Co. KG) HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [641704 2012-07-04] (Advanced Micro Devices, Inc.) HKU\S-1-5-21-1905073969-3418976898-3997351287-1000\...\Run: [Spotify Web Helper] => C:\Users\*****\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171000 2014-04-11] (Spotify Ltd) HKU\S-1-5-21-1905073969-3418976898-3997351287-1000\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\system32\Macromed\Flash\FlashUtil32_12_0_0_77_Plugin.exe [841096 2014-03-11] (Adobe Systems Incorporated) HKU\S-1-5-21-1905073969-3418976898-3997351287-1000\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x00000000 Startup: C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BBuJUuKs.vbs () ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm URLSearchHook: HKCU - UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll No File SearchScopes: HKLM - DefaultScope value is missing. SearchScopes: HKLM - {E89AE38C-AB97-41DF-84E8-78E332833273} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008 SearchScopes: HKCU - {E89AE38C-AB97-41DF-84E8-78E332833273} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008 BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO: SwissAcademic.Citavi.Picker.IEPicker - {609D670F-B735-4da7-AC6D-F3BD358E325E} - C:\Windows\system32\mscoree.dll (Microsoft Corporation) BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO: Evernote extension - {92EF2EAD-A7CE-4424-B0DB-499CF856608E} - C:\Program Files\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) BHO: Download Accelerator Plus Integration - {FF6C3CF0-4B15-11D1-ABED-709549C10000} - C:\Program Files\DAP\dapieloader.dll (SpeedBit Ltd.) DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_38-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0038-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_38-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_38-windows-i586.cab Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation) Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\cherrytomato\Skype4COM.dll (Skype Technologies) Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default FF SearchEngineOrder.1: Ask.com FF NetworkProxy: "http", "127.0.0.1" FF NetworkProxy: "http_port", 8555 FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_77.dll () FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\npPDFXCviewNPPlugin.dll No File FF Plugin: @java.com/DTPlugin,version=1.6.0_38 - C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.) FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.) FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin: yaxmpb@yahoo.com/YahooActiveXPluginBridge;version=1.0.0.1 - C:\Program Files\Mozilla Firefox\plugins\npyaxmpb.dll (Yahoo! Inc.) FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101753.dll (Amazon.com, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np32neur.dll (SumTotal Systems, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npwachk.dll (Nullsoft, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npyaxmpb.dll (Yahoo! Inc.) FF Plugin ProgramFiles/Appdata: C:\Users\*****\AppData\Roaming\mozilla\plugins\npatgpc.dll (Cisco WebEx LLC) FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\searchplugins\duden-online.xml FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\searchplugins\urban-dictionary.xml FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\searchplugins\youtube-videosuche.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: DoNotTrackMe - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\donottrackplus@abine.com [2013-08-19] FF Extension: Pocket - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\isreaditlater@ideashower.com [2013-06-28] FF Extension: TV-Fox - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\{2f17f610-5e97-4fed-828f-9940b7b577a4} [2013-03-30] FF Extension: WOT - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2013-11-26] FF Extension: HP Detect - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\{ab91efd4-6975-4081-8552-1b3922ed79e2} [2012-08-26] FF Extension: DownloadHelper - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-03-25] FF Extension: Evernote Web Clipper - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\{E0B8C461-F8FB-49b4-8373-FE32E9252800} [2013-12-18] FF Extension: feedly - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\feedly@devhd.xpi [2011-07-07] FF Extension: Cruxlight - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\jid1-45thW542wORoTw@jetpack.xpi [2013-03-12] FF Extension: storeTab - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\nicktco@gmail.com.xpi [2014-02-02] FF Extension: LeechBlock - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\{a95d8332-e4b4-6e7f-98ac-20b733364387}.xpi [2011-10-18] FF Extension: StumbleUpon - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\{AE93811A-5C9A-4d34-8462-F7B864FC4696}.xpi [2011-05-26] FF Extension: Adblock Plus - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011-05-14] FF Extension: FoxTab - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\kch0d3fh.default\Extensions\{ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}.xpi [2011-06-29] FF Extension: Skype extension for Firefox - C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2014-03-18] FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2014-03-18] FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2014-03-18] FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0038-ABCDEFFEDCBA} [2014-03-18] FF Extension: Hotspot Shield Extension - C:\Program Files\Mozilla Firefox\browser\extensions\afproxy@anchorfree.com [2014-04-12] FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [] FF HKLM\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2011-03-13] FF HKLM\...\Thunderbird\Extensions: [{857610fe-b36c-47f2-b4fa-6b7affe0cf5a}] - C:\Program Files\Mobile Master\ext\1\ FF Extension: Mobile Master Add-In - C:\Program Files\Mobile Master\ext\1\ [] FF HKCU\...\Firefox\Extensions: [{F17C1572-C9EC-4e5c-A542-D05CBB5C5A08}] - C:\Program Files\DAP\DAPFireFox FF Extension: Download Accelerator Plus (DAP) extension - C:\Program Files\DAP\DAPFireFox [2009-12-04] Chrome: ======= CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\32.0.1700.107\PepperFlash\pepflashplayer.dll No File CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\32.0.1700.107\ppGoogleNaClPluginChrome.dll No File CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\32.0.1700.107\pdf.dll No File CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.) CHR Plugin: (Microsoft® Windows Media Player Firefox Plugin) - C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll (Microsoft Corporation) CHR Plugin: (NEURON) - C:\Program Files\Mozilla Firefox\plugins\np32neur.dll (SumTotal Systems, Inc.) CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll No File CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll No File CHR Plugin: (Winamp Application Detector) - C:\Program Files\Mozilla Firefox\plugins\npwachk.dll (Nullsoft, Inc.) CHR Plugin: (Yahoo! activeX Plug-in Bridge) - C:\Program Files\Mozilla Firefox\plugins\npyaxmpb.dll (Yahoo! Inc.) CHR Plugin: (ActiveTouch General Plugin Container) - C:\Users\*****\AppData\Roaming\Mozilla\plugins\npatgpc.dll (Cisco WebEx LLC) CHR Plugin: (AmazonMP3DownloaderPlugin) - C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101753.dll (Amazon.com, Inc.) CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File CHR Plugin: (Java(TM) Platform SE 6 U38) - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) CHR Plugin: (iTunes Application Detector) - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_6_602_171.dll No File CHR Plugin: (Java Deployment Toolkit 6.0.380.5) - C:\Windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.) CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) CHR Extension: (Google Docs) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-02-28] CHR Extension: (Google Drive) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-02-28] CHR Extension: (YouTube) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-02-28] CHR Extension: (Google-Suche) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-02-28] CHR Extension: (Google Wallet) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-02] CHR Extension: (Google Mail) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-02-28] ========================== Services (Whitelisted) ================= R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440400 2014-02-22] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-22] (Avira Operations GmbH & Co. KG) R2 CVPND; C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe [1528608 2008-04-17] (Cisco Systems, Inc.) R2 HP Health Check Service; c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [94208 2008-10-09] (Hewlett-Packard) R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-04-03] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [857912 2014-04-03] (Malwarebytes Corporation) R2 Recovery Service for Windows; C:\Program Files\SMINST\BLService.exe [365952 2008-12-17] () R2 RichVideo; C:\Program Files\CyberLink\Shared files\RichVideo.exe [241734 2008-09-15] () R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_827e372d\STacSV.exe [217170 2009-06-03] (IDT, Inc.) R2 TGCM_ImportWiFiSvc; C:\Program Files\o2\Mobile Connection Manager\ImpWiFiSvc.exe [199600 2010-08-02] (Telefónica I+D) R2 TVCapSvc; C:\Program Files\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe [296320 2008-11-26] () S3 TVSched; C:\Program Files\Hewlett-Packard\Media\TV\Kernel\TV\TVSched.exe [116096 2008-11-26] () ==================== Drivers (Whitelisted) ==================== S3 61883; C:\Windows\System32\DRIVERS\61883.sys [45696 2008-01-21] (Microsoft Corporation) S3 acsint; C:\Windows\System32\DRIVERS\acsint.sys [39888 2013-06-19] (Cisco Systems, Inc.) S3 acsmux; C:\Windows\System32\DRIVERS\acsmux.sys [58320 2013-06-19] (Cisco Systems, Inc.) R3 Afc; C:\Windows\System32\drivers\Afc.sys [11776 2005-02-23] (Arcsoft, Inc.) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-12-18] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135648 2013-12-18] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-26] (Avira Operations GmbH & Co. KG) S3 CVirtA; C:\Windows\System32\DRIVERS\CVirtA.sys [5275 2007-01-18] (Cisco Systems, Inc.) R2 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306299 2008-04-17] (Cisco Systems, Inc.) S3 DCamUSBEMPIA; C:\Windows\System32\DRIVERS\emDevice.sys [171136 2007-06-21] (eMPIA Technology, Inc.) R3 DNE; C:\Windows\System32\DRIVERS\dne2000.sys [125328 2008-03-29] (Deterministic Networks, Inc.) S3 emAudio; C:\Windows\System32\drivers\emAudio.sys [24448 2007-10-26] (eMPIA Technology, Inc.) S3 FiltUSBEMPIA; C:\Windows\System32\DRIVERS\emFilter.sys [5248 2007-06-21] (eMPIA Technology, Inc.) R1 HssDRV6; C:\Windows\System32\DRIVERS\hssdrv6.sys [39624 2014-01-15] (AnchorFree Inc.) S3 KORGUMDS; C:\Windows\System32\Drivers\KORGUMDS.SYS [24056 2011-03-30] (KORG INC.) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-04-03] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [107736 2014-04-15] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51416 2014-04-03] (Malwarebytes Corporation) S3 NUMARK_OMNICONTROL; C:\Windows\System32\Drivers\nkc2_usb.sys [367104 2008-07-17] (Ploytec GmbH) S3 NUMARK_OMNICONTROL_MIDI; C:\Windows\System32\drivers\nkc2midi.sys [28160 2008-07-17] (Numark) S3 NUMARK_OMNICONTROL_WDM; C:\Windows\System32\drivers\nkc2_wdm.sys [33792 2008-07-17] (Numark) S3 NvnUsbAudio; C:\Windows\System32\DRIVERS\nvnusbaudio.sys [41944 2011-10-05] (Novation DMS Ltd.) R3 pfc; C:\Windows\System32\drivers\pfc.sys [10368 2004-04-01] (Padus, Inc.) S3 PPJoyBus; C:\Windows\System32\DRIVERS\PPJoyBus.sys [15936 2009-11-04] (Deon van der Westhuysen) S3 PPortJoystick; C:\Windows\System32\DRIVERS\PPortJoy.sys [31808 2009-11-04] (Deon van der Westhuysen) S3 ScanUSBEMPIA; C:\Windows\System32\DRIVERS\emScan.sys [5120 2007-06-21] (eMPIA Technology, Inc.) S4 sptd; C:\Windows\System32\Drivers\sptd.sys [691696 2010-06-27] (Duplex Secure Ltd.) R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH) R3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [37064 2014-01-15] (Anchorfree Inc.) R2 {55662437-DA8C-40c0-AADA-2C816A897A49}; C:\Program Files\Hewlett-Packard\Media\DVD\000.fcl [87536 2008-11-28] (CyberLink Corp.) S2 adfs; No ImagePath U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation) S3 catchme; \??\C:\ComboFix\catchme.sys [X] S3 IpInIp; system32\DRIVERS\ipinip.sys [X] S3 jswmidin; \??\C:\Users\*****~1\AppData\Local\Temp\jswmidin.sys [X] S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X] S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X] S3 taphss; system32\DRIVERS\taphss.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-04-15 23:15 - 2014-04-15 23:15 - 00987448 _____ () C:\Users\*****\Desktop\SecurityCheck.exe 2014-04-15 00:11 - 2014-04-15 00:11 - 00000000 ____D () C:\Windows\ERUNT 2014-04-14 23:54 - 2014-04-14 23:59 - 00000000 ____D () C:\AdwCleaner 2014-04-14 18:22 - 2014-04-15 22:38 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-04-14 18:22 - 2014-04-14 18:22 - 00000859 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-04-14 18:22 - 2014-04-14 18:22 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-04-14 18:22 - 2014-04-14 18:22 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2014-04-14 18:22 - 2014-04-03 09:51 - 00073432 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-04-14 18:22 - 2014-04-03 09:51 - 00051416 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-04-14 18:22 - 2014-04-03 09:50 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-04-13 19:42 - 2014-04-13 19:42 - 00025697 _____ () C:\ComboFix.txt 2014-04-13 19:15 - 2014-04-13 19:42 - 00000000 ____D () C:\Qoobox 2014-04-13 19:15 - 2014-04-13 19:40 - 00000000 ____D () C:\Windows\erdnt 2014-04-13 19:15 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe 2014-04-13 19:15 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe 2014-04-13 19:15 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2014-04-13 19:15 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2014-04-13 19:15 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2014-04-13 19:15 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe 2014-04-13 19:15 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe 2014-04-13 19:15 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe 2014-04-13 17:54 - 2014-04-13 17:54 - 00000000 ____D () C:\ProgramData\Panda Security 2014-04-13 17:53 - 2014-04-13 17:53 - 00000000 ____D () C:\Program Files\Panda USB Vaccine 2014-04-13 14:00 - 2014-04-15 23:26 - 00000000 ____D () C:\FRST 2014-04-13 13:51 - 2014-04-15 23:26 - 00000000 ____D () C:\Users\*****\Desktop\Kampf gegen den Virus 2014-04-13 13:45 - 2014-04-13 13:45 - 00000020 _____ () C:\Users\*****\defogger_reenable 2014-04-13 12:54 - 2014-04-13 12:54 - 00143312 _____ () C:\Windows\Minidump\Mini041314-01.dmp 2014-04-12 23:06 - 2013-12-27 13:05 - 103422302 _____ () C:\Users\*****\Desktop\*****_*****_001.psd 2014-04-12 14:31 - 2014-01-15 00:45 - 00039624 _____ (AnchorFree Inc.) C:\Windows\system32\Drivers\hssdrv6.sys 2014-04-12 02:06 - 2014-04-12 02:07 - 100054996 _____ () C:\Users\*****\Desktop\Snakeman Show.wav 2014-04-12 01:49 - 2014-04-12 02:08 - 00000000 ____D () C:\Users\*****\Desktop\Tokio Recordings 2014-04-07 10:40 - 2014-04-07 10:41 - 42767668 _____ () C:\Users\*****\Downloads\High On You Mama (Ole Smokey Edit).wav 2014-03-27 10:47 - 2014-03-27 10:48 - 00000000 ____D () C:\Users\*****\Desktop\4. Stock 2014-03-23 11:31 - 2014-03-23 15:44 - 00000000 ____D () C:\Program Files\Mozilla Thunderbird 2014-03-22 23:43 - 2014-04-12 20:34 - 00000000 ____D () C:\Users\*****\Desktop\im bett mit 2014-03-22 23:31 - 2014-03-22 23:31 - 00000000 ____D () C:\Users\*****\Downloads\creampuff 2014-03-22 23:26 - 2014-03-22 23:26 - 00031775 _____ () C:\Users\*****\Downloads\creampuff.zip 2014-03-18 22:05 - 2014-03-18 22:05 - 00000000 ____D () C:\Program Files\Mozilla Firefox ==================== One Month Modified Files and Folders ======= 2014-04-15 23:26 - 2014-04-13 14:00 - 00000000 ____D () C:\FRST 2014-04-15 23:26 - 2014-04-13 13:51 - 00000000 ____D () C:\Users\*****\Desktop\Kampf gegen den Virus 2014-04-15 23:24 - 2012-06-13 22:09 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Spotify 2014-04-15 23:15 - 2014-04-15 23:15 - 00987448 _____ () C:\Users\*****\Desktop\SecurityCheck.exe 2014-04-15 22:52 - 2010-01-16 09:34 - 00054702 _____ () C:\Users\*****\Desktop\songs.txt 2014-04-15 22:51 - 2006-11-02 14:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 2014-04-15 22:51 - 2006-11-02 14:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 2014-04-15 22:48 - 2009-11-30 11:51 - 00001114 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-04-15 22:38 - 2014-04-14 18:22 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-04-15 22:35 - 2012-06-13 22:10 - 00000000 ____D () C:\Users\*****\AppData\Local\Spotify 2014-04-15 22:32 - 2012-04-11 11:26 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-04-15 20:17 - 2009-07-20 02:24 - 01068148 _____ () C:\Windows\WindowsUpdate.log 2014-04-15 18:53 - 2009-11-30 11:51 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-04-15 18:50 - 2006-11-02 15:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-04-15 01:31 - 2006-11-02 15:01 - 00032554 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-04-15 00:11 - 2014-04-15 00:11 - 00000000 ____D () C:\Windows\ERUNT 2014-04-14 23:59 - 2014-04-14 23:54 - 00000000 ____D () C:\AdwCleaner 2014-04-14 23:51 - 2006-11-02 12:33 - 01445546 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-04-14 18:22 - 2014-04-14 18:22 - 00000859 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-04-14 18:22 - 2014-04-14 18:22 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-04-14 18:22 - 2014-04-14 18:22 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2014-04-13 19:42 - 2014-04-13 19:42 - 00025697 _____ () C:\ComboFix.txt 2014-04-13 19:42 - 2014-04-13 19:15 - 00000000 ____D () C:\Qoobox 2014-04-13 19:42 - 2006-11-02 13:18 - 00000000 __RHD () C:\Users\Default 2014-04-13 19:42 - 2006-11-02 13:18 - 00000000 ___RD () C:\Users\Public 2014-04-13 19:40 - 2014-04-13 19:15 - 00000000 ____D () C:\Windows\erdnt 2014-04-13 19:33 - 2006-11-02 12:23 - 00000215 _____ () C:\Windows\system.ini 2014-04-13 19:31 - 2008-01-21 04:47 - 00465172 _____ () C:\Windows\PFRO.log 2014-04-13 19:30 - 2006-11-02 12:22 - 59768832 _____ () C:\Windows\system32\config\software.bak 2014-04-13 19:30 - 2006-11-02 12:22 - 42205184 _____ () C:\Windows\system32\config\system.bak 2014-04-13 19:30 - 2006-11-02 12:22 - 40632320 _____ () C:\Windows\system32\config\COMPON~3.bak 2014-04-13 19:30 - 2006-11-02 12:22 - 00524288 _____ () C:\Windows\system32\config\default.bak 2014-04-13 19:30 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\security.bak 2014-04-13 19:30 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\sam.bak 2014-04-13 19:28 - 2009-09-18 14:10 - 00000000 ____D () C:\Users\***** 2014-04-13 17:54 - 2014-04-13 17:54 - 00000000 ____D () C:\ProgramData\Panda Security 2014-04-13 17:53 - 2014-04-13 17:53 - 00000000 ____D () C:\Program Files\Panda USB Vaccine 2014-04-13 17:26 - 2009-09-23 00:47 - 00000000 ____D () C:\Users\*****\Downloads\mp3 2014-04-13 13:45 - 2014-04-13 13:45 - 00000020 _____ () C:\Users\*****\defogger_reenable 2014-04-13 12:54 - 2014-04-13 12:54 - 00143312 _____ () C:\Windows\Minidump\Mini041314-01.dmp 2014-04-13 12:54 - 2009-11-19 15:51 - 322871239 _____ () C:\Windows\MEMORY.DMP 2014-04-13 12:54 - 2009-11-19 15:51 - 00000000 ____D () C:\Windows\Minidump 2014-04-12 23:00 - 2006-11-02 14:52 - 00364678 _____ () C:\Windows\setupact.log 2014-04-12 20:34 - 2014-03-22 23:43 - 00000000 ____D () C:\Users\*****\Desktop\im bett mit 2014-04-12 19:17 - 2010-03-07 02:45 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Mp3tag 2014-04-12 14:31 - 2012-07-20 20:45 - 00012591 _____ () C:\Windows\certutil.log 2014-04-12 14:27 - 2010-06-25 15:43 - 00000000 ___RD () C:\Users\*****\Documents\My Dropbox 2014-04-12 13:24 - 2009-09-20 15:01 - 00000000 ____D () C:\Users\*****\AppData\Roaming\vlc 2014-04-12 12:25 - 2010-06-25 15:42 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Dropbox 2014-04-12 11:36 - 2009-09-20 11:05 - 00155136 _____ () C:\Users\*****\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2014-04-12 11:33 - 2010-06-25 15:42 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox 2014-04-12 02:08 - 2014-04-12 01:49 - 00000000 ____D () C:\Users\*****\Desktop\Tokio Recordings 2014-04-12 02:07 - 2014-04-12 02:06 - 100054996 _____ () C:\Users\*****\Desktop\Snakeman Show.wav 2014-04-11 20:10 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\Resources 2014-04-07 10:41 - 2014-04-07 10:40 - 42767668 _____ () C:\Users\*****\Downloads\High On You Mama (Ole Smokey Edit).wav 2014-04-03 09:51 - 2014-04-14 18:22 - 00073432 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-04-03 09:51 - 2014-04-14 18:22 - 00051416 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-04-03 09:50 - 2014-04-14 18:22 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-03-31 09:35 - 2009-11-19 10:12 - 00231584 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe 2014-03-27 10:48 - 2014-03-27 10:47 - 00000000 ____D () C:\Users\*****\Desktop\4. Stock 2014-03-25 01:39 - 2009-10-08 15:19 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Skype 2014-03-25 01:07 - 2009-10-08 15:21 - 00000000 ____D () C:\Users\*****\AppData\Roaming\skypePM 2014-03-23 21:38 - 2012-04-26 19:06 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service 2014-03-23 15:44 - 2014-03-23 11:31 - 00000000 ____D () C:\Program Files\Mozilla Thunderbird 2014-03-23 10:55 - 2009-09-18 14:17 - 00086504 _____ () C:\Users\*****\AppData\Local\GDIPFONTCACHEV1.DAT 2014-03-23 10:53 - 2006-11-02 14:47 - 02270584 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-03-22 23:31 - 2014-03-22 23:31 - 00000000 ____D () C:\Users\*****\Downloads\creampuff 2014-03-22 23:26 - 2014-03-22 23:26 - 00031775 _____ () C:\Users\*****\Downloads\creampuff.zip 2014-03-22 22:02 - 2014-02-08 13:40 - 00000000 ____D () C:\Users\*****\Desktop\Filme 2014-03-18 22:05 - 2014-03-18 22:05 - 00000000 ____D () C:\Program Files\Mozilla Firefox Files to move or delete: ==================== C:\Users\*****\AppData\Roaming\desktop.ini C:\Users\Public\Mobile_Connection_Manager_RC4.5.exe Some content of TEMP: ==================== C:\Users\*****\AppData\Local\temp\avgnt.exe C:\Users\*****\AppData\Local\temp\Quarantine.exe ==================== Bamital & volsnap Check ================= C:\Windows\explorer.exe => MD5 is legit C:\Windows\system32\winlogon.exe => MD5 is legit C:\Windows\system32\wininit.exe => MD5 is legit C:\Windows\system32\svchost.exe => MD5 is legit C:\Windows\system32\services.exe => MD5 is legit C:\Windows\system32\User32.dll => MD5 is legit C:\Windows\system32\userinit.exe => MD5 is legit C:\Windows\system32\rpcss.dll => MD5 is legit C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-04-15 18:59 ==================== End Of Log ============================ |
|
16.04.2014, 19:18
| #8 |
| /// the machine /// TB-Ausbilder | Windows Vista: USB-Stick Ordner werden als Verknüpfungen angezeigt Adobe updaten. Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter Startup: C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BBuJUuKs.vbs ()
FF NetworkProxy: "http", "127.0.0.1"
FF NetworkProxy: "http_port", 8555
C:\Users\*****\AppData\Roaming\desktop.ini
C:\Users\Public\Mobile_Connection_Manager_RC4.5.exe
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Ich möchte prüfen, ob bestimmte Dateien noch auf Deinem System sind, dazu bitte den Text aus der Codebox: Code:
ATTFilter @echo off
set log="%userprofile%\Desktop\files.txt"
if exist %log% del %log%
for %%d in (c d e f g h i j k l m n o p q r s t u v w x y z) do (
if exist %%d:\ (
%%d:
cd \
dir *.vbs;autorun.inf;boot.com /s
dir *.vbs;autorun.inf;boot.com /ah /s
attrib
)
) >> %log%
start notepad %log%
Sollte es während der Ausführung des Skriptes zu einer Fehlermeldung "Windows kein Datenträger" kommen, kannst Du beruhigt auf "Weiter" klicken. Das liegt daran, dass ein Datenträger (z. B. ein Kartenlesegerät) leer ist.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
16.04.2014, 23:45
| #9 |
| | Windows Vista: USB-Stick Ordner werden als Verknüpfungen angezeigt Das Adobe-Update hab ich eben installiert. Fixlog.txt Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 17-04-2014
Ran by ***** at 2014-04-17 00:28:46 Run:1
Running from C:\Users\*****\Desktop\Kampf gegen den Virus
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
Startup: C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BBuJUuKs.vbs ()
FF NetworkProxy: "http", "127.0.0.1"
FF NetworkProxy: "http_port", 8555
C:\Users\*****\AppData\Roaming\desktop.ini
C:\Users\Public\Mobile_Connection_Manager_RC4.5.exe
*****************
C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BBuJUuKs.vbs => Moved successfully.
Firefox Proxy settings were reset.
Firefox Proxy settings were reset.
C:\Users\*****\AppData\Roaming\desktop.ini => Moved successfully.
C:\Users\Public\Mobile_Connection_Manager_RC4.5.exe => Moved successfully.
==== End of Fixlog ====
Code:
ATTFilter Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: 0751-9EBA
Verzeichnis von C:\Program Files\Common Files\Motorola Shared\MotPCSDrivers\Binaries
27/06/2002 14:22 11.729 _svdir.VBS
1 Datei(en), 11.729 Bytes
Verzeichnis von C:\Program Files\HP\HP LaserJet M1120 MFP Series
08/08/2008 05:06 133 Autorun.inf
1 Datei(en), 133 Bytes
Verzeichnis von C:\Program Files\HP\HP LaserJet M1120 MFP Series\HP\HP LaserJet M1120 MFP Series
08/08/2008 05:06 133 Autorun.inf
1 Datei(en), 133 Bytes
Verzeichnis von C:\Program Files\HP\HP LaserJet M1120 MFP Series\HP\HP LaserJet M1120 MFP Series\HP\HP LaserJet M1120 MFP Series
08/08/2008 05:06 133 Autorun.inf
1 Datei(en), 133 Bytes
Verzeichnis von C:\Program Files\HP\HP LaserJet M1120 MFP Series\HP\HP LaserJet M1120 MFP Series\HP\HP LaserJet M1120 MFP Series\HP\HP LaserJet M1120 MFP Series
08/08/2008 05:06 133 Autorun.inf
1 Datei(en), 133 Bytes
Verzeichnis von C:\Program Files\HP\HP LaserJet M1120 MFP Series\HP\HP LaserJet M1120 MFP Series\HP\HP LaserJet M1120 MFP Series\HP\HP LaserJet M1120 MFP Series\HP\HP LaserJet M1120 MFP Series
08/08/2008 05:06 133 Autorun.inf
1 Datei(en), 133 Bytes
Verzeichnis von C:\Program Files\HP\HP LaserJet M1120 MFP Series\HP\HP LaserJet M1120 MFP Series\HP\HP LaserJet M1120 MFP Series\HP\HP LaserJet M1120 MFP Series\HP\HP LaserJet M1120 MFP Series\HP\HP LaserJet M1120 MFP Series
08/08/2008 05:06 133 Autorun.inf
1 Datei(en), 133 Bytes
Verzeichnis von C:\Program Files\HP\HP LaserJet M1120 MFP Series\HP\HP LaserJet M1120 MFP Series\HP\HP LaserJet M1120 MFP Series\HP\HP LaserJet M1120 MFP Series\HP\HP LaserJet M1120 MFP Series\HP\HP LaserJet M1120 MFP Series\HP\HP LaserJet M1120 MFP Series
08/08/2008 05:06 133 Autorun.inf
1 Datei(en), 133 Bytes
Verzeichnis von C:\Program Files\o2\Mobile Connection Manager\config
08/07/2010 13:41 3.021 user.vbs
1 Datei(en), 3.021 Bytes
Verzeichnis von C:\Program Files\o2\Mobile Connection Manager\PCMCIAs\Option
08/07/2010 13:41 127 autorun.inf
1 Datei(en), 127 Bytes
Verzeichnis von C:\Program Files\Realtek\VISTA_8169
06/08/2008 18:26 181 disable.vbs
06/08/2008 18:26 182 enable.vbs
2 Datei(en), 363 Bytes
Verzeichnis von C:\Program Files\Steam\steam\backup\english
15/06/2013 01:49 49 autorun.inf
1 Datei(en), 49 Bytes
Verzeichnis von C:\Program Files\Steam\steam\backup\french
15/06/2013 01:49 49 autorun.inf
1 Datei(en), 49 Bytes
Verzeichnis von C:\Program Files\Steam\steam\backup\german
15/06/2013 01:49 49 autorun.inf
1 Datei(en), 49 Bytes
Verzeichnis von C:\Program Files\Steam\steam\backup\italian
15/06/2013 01:49 49 autorun.inf
1 Datei(en), 49 Bytes
Verzeichnis von C:\Program Files\Steam\steam\backup\japanese
15/06/2013 01:49 49 autorun.inf
1 Datei(en), 49 Bytes
Verzeichnis von C:\Program Files\Steam\steam\backup\korean
15/06/2013 01:49 49 autorun.inf
1 Datei(en), 49 Bytes
Verzeichnis von C:\Program Files\Steam\steam\backup\portuguese
15/06/2013 01:49 49 autorun.inf
1 Datei(en), 49 Bytes
Verzeichnis von C:\Program Files\Steam\steam\backup\russian
15/06/2013 01:49 49 autorun.inf
1 Datei(en), 49 Bytes
Verzeichnis von C:\Program Files\Steam\steam\backup\schinese
15/06/2013 01:49 49 autorun.inf
1 Datei(en), 49 Bytes
Verzeichnis von C:\Program Files\Steam\steam\backup\spanish
15/06/2013 01:49 49 autorun.inf
1 Datei(en), 49 Bytes
Verzeichnis von C:\Program Files\Steam\steam\backup\tchinese
15/06/2013 01:49 49 autorun.inf
1 Datei(en), 49 Bytes
Verzeichnis von C:\Program Files\Steam\steam\backup\thai
15/06/2013 01:49 49 autorun.inf
1 Datei(en), 49 Bytes
Verzeichnis von C:\SWSetup\CyberDVD\Stage1
16/06/2008 22:24 47 AUTORUN.INF
1 Datei(en), 47 Bytes
Verzeichnis von C:\SWSetup\CyberDVD\Stage1\LPrint
27/05/2008 00:30 48 AUTORUN.INF
1 Datei(en), 48 Bytes
Verzeichnis von C:\SWSetup\CyberDVD\Stage1\PDIR
11/06/2008 23:09 51 Autorun.inf
1 Datei(en), 51 Bytes
Verzeichnis von C:\SWSetup\CyberDVD\Stage2
16/06/2008 22:24 47 AUTORUN.INF
1 Datei(en), 47 Bytes
Verzeichnis von C:\SWSetup\CyberDVD\Stage2\LPrint
27/05/2008 00:30 48 AUTORUN.INF
1 Datei(en), 48 Bytes
Verzeichnis von C:\SWSetup\CyberDVD\Stage2\PDIR
11/06/2008 23:09 51 Autorun.inf
1 Datei(en), 51 Bytes
Verzeichnis von C:\SWSetup\Drivers\Touchpad
17/08/2006 12:54 29 Autorun.inf
1 Datei(en), 29 Bytes
Verzeichnis von C:\SWSetup\ESUVT
15/08/2008 19:15 128 Setup.vbs
1 Datei(en), 128 Bytes
Verzeichnis von C:\SWSetup\MSWebcam
30/10/2008 17:22 56 Autorun.inf
1 Datei(en), 56 Bytes
Verzeichnis von C:\SWSetup\MSWorks
24/01/2007 12:59 65 autorun.inf
1 Datei(en), 65 Bytes
Verzeichnis von C:\SWSetup\Off12\GR\HS07Office
28/10/2006 20:27 175 AUTORUN.INF
1 Datei(en), 175 Bytes
Verzeichnis von C:\SWSetup\SP43932
16/08/2006 19:54 29 Autorun.inf
1 Datei(en), 29 Bytes
Verzeichnis von C:\System.sav\Util
18/03/2008 05:36 4.138 FUBID.vbs
12/12/2007 13:44 9.515 Logo.vbs
20/12/2007 10:40 5.409 MBRINST.VBS
17/07/2008 15:01 5.300 RWUCINI.VBS
4 Datei(en), 24.362 Bytes
Verzeichnis von C:\System.sav\Util\TDC
28/01/2008 16:50 477 Replace.vbs
1 Datei(en), 477 Bytes
Verzeichnis von C:\Users\*****\AppData\Local\temp\jrt
03/02/2013 14:34 370 clean_shortcut.vbs
1 Datei(en), 370 Bytes
Verzeichnis von C:\Users\*****\Desktop\Setups\photoshop\Photoshop\Scripting Guide\Sample Scripts\VBScript
24/11/2004 18:07 719 ApplyStyle.vbs
24/11/2004 18:06 3.863 BatchProcess.vbs
24/11/2004 18:24 1.193 ClipboardInteraction.vbs
24/11/2004 18:11 1.190 CreateAndExecuteAction.vbs
24/11/2004 18:11 1.307 CreateNewTextArt.vbs
13/01/2005 18:23 2.366 Crop.vbs
24/11/2004 18:10 589 DocumentByName.vbs
24/11/2004 18:10 728 DuplicateLayers.vbs
15/02/2005 13:17 595 ExecuteAction.vbs
24/11/2004 18:10 492 ExecuteJavaScript.vbs
24/11/2004 18:10 1.563 Filters.vbs
24/11/2004 18:10 1.279 HistoryState.vbs
24/11/2004 18:10 422 OpenDocument.vbs
16/02/2005 22:43 2.490 SaveAsFormats.vbs
24/11/2004 18:09 1.215 Selection.vbs
24/11/2004 18:09 1.422 SelectionEffects.vbs
24/11/2004 18:09 3.102 TextArt.vbs
24/11/2004 18:08 2.624 TextArtCenter.vbs
24/11/2004 18:07 723 Trim.vbs
19 Datei(en), 27.882 Bytes
Verzeichnis von C:\Users\*****\Desktop\Setups\photoshop\Photoshop CS2\Photoshop CS2
16/06/2004 22:36 49 AUTORUN.INF
1 Datei(en), 49 Bytes
Verzeichnis von C:\Users\*****\Desktop\Studium\2. Semester\Grundlagen der Werbepsychologie\Referat\1) Produkt-Audit
05/07/2010 18:01 45 AUTORUN.INF
1 Datei(en), 45 Bytes
Verzeichnis von C:\Users\*****\Desktop\Studium\2. Semester\Grundlagen der Werbepsychologie\Referat\Aufgaben\Foto\1) Produkt-Audit
05/07/2010 17:16 45 AUTORUN.INF
1 Datei(en), 45 Bytes
Verzeichnis von C:\Users\*****\Desktop\Studium\2. Semester\Grundlagen der Werbepsychologie\Referat\Aufgaben\Foto\2) Marken-Audit
05/07/2010 17:17 45 AUTORUN.INF
1 Datei(en), 45 Bytes
Verzeichnis von C:\Users\*****\Desktop\Studium\2. Semester\Grundlagen der Werbepsychologie\Referat\Aufgaben\Foto\3) Wettberwerbs-Audit
05/07/2010 17:18 45 AUTORUN.INF
1 Datei(en), 45 Bytes
Verzeichnis von C:\Users\*****\Desktop\Studium\2. Semester\Grundlagen der Werbepsychologie\Referat\Aufgaben\Khlschrank\1) Produkt-Audit
05/07/2010 17:20 45 AUTORUN.INF
1 Datei(en), 45 Bytes
Verzeichnis von C:\Users\*****\Desktop\Studium\2. Semester\Grundlagen der Werbepsychologie\Referat\Aufgaben\Khlschrank\2) Marken-Audit
05/07/2010 17:20 45 AUTORUN.INF
1 Datei(en), 45 Bytes
Verzeichnis von C:\Users\*****\Desktop\Studium\2. Semester\Grundlagen der Werbepsychologie\Referat\Aufgaben\Khlschrank\3) Wettbewerbs-Audit
05/07/2010 17:21 45 AUTORUN.INF
1 Datei(en), 45 Bytes
Verzeichnis von C:\Users\*****\Desktop\Studium\3. Semester\Boulevardjournalismus\Posterpr„sentation\Pr„sentation
31/10/2010 15:25 45 AUTORUN.INF
1 Datei(en), 45 Bytes
Verzeichnis von C:\Windows\System32
21/01/2008 04:24 12.198 gatherWiredInfo.vbs
21/01/2008 04:23 15.181 gatherWirelessInfo.vbs
18/02/2009 20:39 92.918 slmgr.vbs
01/08/2009 08:27 201.184 winrm.vbs
4 Datei(en), 321.481 Bytes
Verzeichnis von C:\Windows\System32\Printing_Admin_Scripts\de-DE
23/01/2009 12:33 106.798 prncnfg.vbs
23/01/2009 12:33 51.986 prndrvr.vbs
23/01/2009 12:33 70.586 prnjobs.vbs
23/01/2009 12:33 82.080 prnmngr.vbs
23/01/2009 12:33 57.556 prnport.vbs
23/01/2009 12:33 51.806 prnqctl.vbs
23/01/2009 12:33 7.518 pubprn.vbs
7 Datei(en), 428.330 Bytes
Verzeichnis von C:\Windows\winsxs\x86_microsoft-windows-dot3svc_31bf3856ad364e35_6.0.6001.18000_none_6b6c0ec873844bfa
21/01/2008 04:24 12.198 gatherWiredInfo.vbs
1 Datei(en), 12.198 Bytes
Verzeichnis von C:\Windows\winsxs\x86_microsoft-windows-dot3svc_31bf3856ad364e35_6.0.6002.18005_none_6d5787d470a61746
21/01/2008 04:24 12.198 gatherWiredInfo.vbs
1 Datei(en), 12.198 Bytes
Verzeichnis von C:\Windows\winsxs\x86_microsoft-windows-iis-legacyscripts_31bf3856ad364e35_6.0.6001.18000_none_7e466ce97736febd
02/11/2006 14:36 98.133 adsutil.vbs
02/11/2006 14:36 4.346 clusftp.vbs
02/11/2006 14:36 4.341 clusweb.vbs
02/11/2006 14:36 41.401 IIsExt.vbs
21/01/2008 04:25 12.796 iisswtch.vbs
5 Datei(en), 161.017 Bytes
Verzeichnis von C:\Windows\winsxs\x86_microsoft-windows-p..inscripts.resources_31bf3856ad364e35_6.0.6000.16386_de-de_6385c801608735e3
23/01/2009 12:33 106.798 prncnfg.vbs
23/01/2009 12:33 51.986 prndrvr.vbs
23/01/2009 12:33 70.586 prnjobs.vbs
23/01/2009 12:33 82.080 prnmngr.vbs
23/01/2009 12:33 57.556 prnport.vbs
23/01/2009 12:33 51.806 prnqctl.vbs
23/01/2009 12:33 7.518 pubprn.vbs
7 Datei(en), 428.330 Bytes
Verzeichnis von C:\Windows\winsxs\x86_microsoft-windows-s..ity-licensing-tools_31bf3856ad364e35_6.0.6001.18000_none_c54a066e67e43f8b
21/01/2008 04:24 80.047 slmgr.vbs
1 Datei(en), 80.047 Bytes
Verzeichnis von C:\Windows\winsxs\x86_microsoft-windows-s..ity-licensing-tools_31bf3856ad364e35_6.0.6002.18005_none_c7357f7a65060ad7
18/02/2009 20:39 92.918 slmgr.vbs
1 Datei(en), 92.918 Bytes
Verzeichnis von C:\Windows\winsxs\x86_microsoft-windows-w..for-management-core_31bf3856ad364e35_6.0.6001.18000_none_ca65755fad07cc55
21/01/2008 04:24 195.122 winrm.vbs
1 Datei(en), 195.122 Bytes
Verzeichnis von C:\Windows\winsxs\x86_microsoft-windows-w..for-management-core_31bf3856ad364e35_6.0.6002.18005_none_cc50ee6baa2997a1
21/01/2008 04:24 195.122 winrm.vbs
1 Datei(en), 195.122 Bytes
Verzeichnis von C:\Windows\winsxs\x86_microsoft-windows-w..for-management-core_31bf3856ad364e35_7.0.6001.18181_none_bb807475382e6b2a
01/08/2009 08:27 201.184 winrm.vbs
1 Datei(en), 201.184 Bytes
Verzeichnis von C:\Windows\winsxs\x86_microsoft-windows-wlansvc_31bf3856ad364e35_6.0.6000.16884_none_9a0b894107fccf79
01/04/2009 18:30 14.827 gatherWirelessInfo.vbs
1 Datei(en), 14.827 Bytes
Verzeichnis von C:\Windows\winsxs\x86_microsoft-windows-wlansvc_31bf3856ad364e35_6.0.6000.21082_none_9a92fd9a211c6fd7
01/04/2009 18:30 14.827 gatherWirelessInfo.vbs
1 Datei(en), 14.827 Bytes
Verzeichnis von C:\Windows\winsxs\x86_microsoft-windows-wlansvc_31bf3856ad364e35_6.0.6001.18000_none_9c44425304e62138
21/01/2008 04:23 15.181 gatherWirelessInfo.vbs
1 Datei(en), 15.181 Bytes
Verzeichnis von C:\Windows\winsxs\x86_microsoft-windows-wlansvc_31bf3856ad364e35_6.0.6001.18288_none_9bf5c90f051fc5c6
21/01/2008 04:23 15.181 gatherWirelessInfo.vbs
1 Datei(en), 15.181 Bytes
Verzeichnis von C:\Windows\winsxs\x86_microsoft-windows-wlansvc_31bf3856ad364e35_6.0.6001.22468_none_9c9507981e2d2ad5
21/01/2008 04:23 15.181 gatherWirelessInfo.vbs
1 Datei(en), 15.181 Bytes
Verzeichnis von C:\Windows\winsxs\x86_microsoft-windows-wlansvc_31bf3856ad364e35_6.0.6002.18005_none_9e2fbb5f0207ec84
21/01/2008 04:23 15.181 gatherWirelessInfo.vbs
1 Datei(en), 15.181 Bytes
Verzeichnis von C:\Windows\winsxs\x86_microsoft-windows-wlansvc_31bf3856ad364e35_6.0.6002.18064_none_9deddb8d02397ad3
21/01/2008 04:23 15.181 gatherWirelessInfo.vbs
1 Datei(en), 15.181 Bytes
Verzeichnis von C:\Windows\winsxs\x86_microsoft-windows-wlansvc_31bf3856ad364e35_6.0.6002.22170_none_9e68a7441b62d132
21/01/2008 04:23 15.181 gatherWirelessInfo.vbs
1 Datei(en), 15.181 Bytes
Anzahl der angezeigten Dateien:
108 Datei(en), 2.319.720 Bytes
0 Verzeichnis(se), 102.200.053.760 Bytes frei
Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: 0751-9EBA
A C:\autoexec.bat
A SHR C:\bootmgr
A C:\ComboFix.txt
A C:\config.sys
A C:\eula.1028.txt
A C:\eula.1031.txt
A C:\eula.1033.txt
A C:\eula.1036.txt
A C:\eula.1040.txt
A C:\eula.1041.txt
A C:\eula.1042.txt
A C:\eula.2052.txt
A C:\eula.3082.txt
A C:\fwdownload.log
A C:\globdata.ini
A SH I C:\hiberfil.sys
A C:\install.ini
A C:\install.res.1028.dll
A C:\install.res.1031.dll
A C:\install.res.1033.dll
A C:\install.res.1036.dll
A C:\install.res.1040.dll
A C:\install.res.1041.dll
A C:\install.res.1042.dll
A C:\install.res.2052.dll
A C:\install.res.3082.dll
A SHR C:\IO.SYS
A C:\M1120.log
A SHR C:\MSDOS.SYS
A SH C:\pagefile.sys
A C:\vcredist.bmp
A C:\VC_RED.cab
A C:\VC_RED.MSI
Datentr„ger in Laufwerk D: ist RECOVERY
Volumeseriennummer: C6A4-837A
Verzeichnis von D:\HP\PostRecovery
28/01/2008 16:50 477 Replace.vbs
1 Datei(en), 477 Bytes
Anzahl der angezeigten Dateien:
1 Datei(en), 477 Bytes
0 Verzeichnis(se), 1.381.220.352 Bytes frei
Datentr„ger in Laufwerk D: ist RECOVERY
Volumeseriennummer: C6A4-837A
SH D:\BLOCK.RIN
SH D:\bootmgr
SH D:\Desktop.ini
SH D:\Folder.htt
A SH D:\MASTER.LOG
SH D:\protect.arabic
SH D:\protect.bulgarian
SH D:\protect.chinese hong kong
SH D:\protect.chinese simplified
SH D:\protect.chinese traditional
SH D:\protect.czech
SH D:\protect.danish
SH D:\protect.dutch
SH D:\protect.ed
SH D:\protect.english
SH D:\protect.finnish
SH D:\protect.french
SH D:\protect.german
SH D:\protect.greek
SH D:\protect.hebrew
SH D:\protect.hungarian
SH D:\protect.italian
SH D:\protect.japanese
SH D:\protect.korean
SH D:\protect.norwegian
SH D:\protect.polish
SH D:\protect.portuguese
SH D:\protect.portuguese brazilian
SH D:\protect.romanian
SH D:\protect.russian
SH D:\protect.slovak
SH D:\protect.spanish
SH D:\protect.swedish
SH D:\protect.turkish
Volume in Laufwerk F: hat keine Bezeichnung.
Volumeseriennummer: 8842-3660
Volume in Laufwerk F: hat keine Bezeichnung.
Volumeseriennummer: 8842-3660
Verzeichnis von F:\
13/04/2014 17:55 0 AUTORUN.INF
1 Datei(en), 0 Bytes
Anzahl der angezeigten Dateien:
1 Datei(en), 0 Bytes
0 Verzeichnis(se), 322.392.064 Bytes frei
SH F:\4. Stock.zip
SH F:\Haiti Direct- Big Band, Mini Jazz & Twoubadou Sounds (1960-1978).zip
SH F:\._.Trashes
H F:\AUTORUN.INF
SH F:\bookmarks-2014-01-30.json
SH F:\AUTORUN_.INF
SH F:\Mietvertrag.pdf
SH F:\img018.bmp
SH F:\img019.bmp
Volume in Laufwerk G: hat keine Bezeichnung.
Volumeseriennummer: B681-8FE2
Volume in Laufwerk G: hat keine Bezeichnung.
Volumeseriennummer: B681-8FE2
Verzeichnis von G:\
13/04/2014 17:55 0 AUTORUN.INF
1 Datei(en), 0 Bytes
Anzahl der angezeigten Dateien:
1 Datei(en), 0 Bytes
0 Verzeichnis(se), 13.299.343.360 Bytes frei
H G:\AUTORUN.INF
SH G:\AUTORUN_.INF
|
|
17.04.2014, 19:36
| #10 |
| /// the machine /// TB-Ausbilder | Windows Vista: USB-Stick Ordner werden als Verknüpfungen angezeigt noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
17.04.2014, 21:34
| #11 |
| | Windows Vista: USB-Stick Ordner werden als Verknüpfungen angezeigt Sieht gut aus soweit! Einen der zwei Sticks hab ich formatiert, abgesteckt, wieder drangehängt und neue Ordner angelegt. Die wurden nicht zu Verknüpfungen verwandelt. Sieht so aus als wäre das Problem gelöst! Bei dem anderen Stick werden die Dateien nach wie vor nicht angezeigt (sind aber noch vorhanden, sh. F: im letzten Log von gestern) - lässt sich da was machen? |
|
18.04.2014, 16:55
| #12 |
| /// the machine /// TB-Ausbilder | Windows Vista: USB-Stick Ordner werden als Verknüpfungen angezeigt Versteckte Dateien anzeigen lassen, dann solltest du die ordner sehen.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
18.04.2014, 20:29
| #13 |
| | Windows Vista: USB-Stick Ordner werden als Verknüpfungen angezeigt Danke für deinen Hinweis! Sie waren nicht nur versteckt, sondern als geschützte Systemdateien getarnt - jetzt hab ich sie wieder |
|
19.04.2014, 12:29
| #14 |
| /// the machine /// TB-Ausbilder | Windows Vista: USB-Stick Ordner werden als Verknüpfungen angezeigt Gut, mach dann in den einzelnen Ordnern mit Rechtsklick Eigenschaften die Haken raus, dann sind sie wieder normal und du kannst die Verknüpfungen löschen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
21.04.2014, 13:32
| #15 |
| | Windows Vista: USB-Stick Ordner werden als Verknüpfungen angezeigt hab ich erledigt, der stick ist wie vorher, dankeschön! sind jetzt noch dateien zu löschen oder programme zu deinstallieren? usb vaccine und malwarebites finde ich supersinnvoll und würde die gern auf dem rechner behalten, wenn aus deiner sicht nichts dagegenspricht. |
|
| Themen zu Windows Vista: USB-Stick Ordner werden als Verknüpfungen angezeigt |
| 4d36e972-e325-11ce-bfc1-08002be10318, adobe, avira, bonjour, defender, desktop, firefox, flash player, hotspot, installation, java/exploit.cve-2012-1723.do, mindspark, minidump, monitor, ordner, problem, required, rundll, scan, security, services.exe, software, spotify web helper, svchost.exe, system, tracker, usb-stick, vbs/kryptik.y, vbs/kryptik.y., verknüpfung, vista, windows |
WARNUNG an die MITLESER: 
Linear-Darstellung
