Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung
Mein Laptop legt Verknüpfungen am USB Stick an

Mein Laptop legt Verknüpfungen am USB Stick an


Plagegeister aller Art und deren Bekämpfung: Mein Laptop legt Verknüpfungen am USB Stick an

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Seite 2 von 2 1 2
Alt 24.04.2014, 13:40   #16
Marcus.V
 
Mein Laptop legt Verknüpfungen am USB Stick an - Standard

Mein Laptop legt Verknüpfungen am USB Stick an



FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-04-2014
Ran by Marcus Vogelgsang (administrator) on MARCUSVOGELGSAN on 24-04-2014 14:38:39
Running from C:\Users\Marcus Vogelgsang\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: Downloading Farbar Recovery Scan Tool 
Download link for 64-Bit Version: Downloading Farbar Recovery Scan Tool 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(PCTV Systems S.à r.l.) C:\Program Files (x86)\Common Files\PCTV Systems\StreamingServer\StrmServer.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.23.9\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.23.9\GoogleCrashHandler64.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 11.0\Reader\Reader_sl.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\OFFICE11\OUTLOOK.EXE
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Farbar) C:\Users\Marcus Vogelgsang\Downloads\FRST64 (1).exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2280232 2010-07-29] (Synaptics Incorporated)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1103440 2011-07-01] (Dritek System Inc.)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [SuiteTray] => C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe [341360 2011-09-20] (Egis Technology Inc.)
HKLM-x32\...\Run: [hpqSRMon] => C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe [150528 2008-07-22] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-10-23] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [3854640 2014-04-18] (AVAST Software)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-3727746948-312616605-306874443-1001\...\Run: [StrmServer.exe] => C:\Program Files (x86)\Common Files\PCTV Systems\StreamingServer\StrmServer.exe [746768 2010-12-21] (PCTV Systems S.à r.l.)
HKU\S-1-5-21-3727746948-312616605-306874443-1001\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-09-14] (Apple Inc.)
HKU\S-1-5-21-3727746948-312616605-306874443-1001\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-09-15] (Apple Inc.)
HKU\S-1-5-21-3727746948-312616605-306874443-1001\...\Run: [AppleIEDAV] => C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe [1315144 2013-09-04] (Apple Inc.)
Lsa: [Notification Packages] scecli C:\Program Files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Nach Updates suchen.lnk
ShortcutTarget: Nach Updates suchen.lnk -> C:\Program Files (x86)\Common Files\PCTV Systems\WebUpdater\WebUpdater.exe (PCTV Systems)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.yhs4.search.yahoo.com/?hspart=avast&hsimp=yhs-001&type={partner_id}
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Sign In
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2431} URL = 
SearchScopes: HKLM-x32 - {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?hspart=avast&hsimp=yhs-001&type={partner_id}&p={searchTerms}
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?hspart=avast&hsimp=yhs-001&type={partner_id}&p={searchTerms}
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - No Name - !{E3286BF1-E654-42FF-B4A6-5E111731DF6B} -  No File
Toolbar: HKLM-x32 - No Name - !{95B7759C-8C7F-4BF1-B163-73684A933233} -  No File
Toolbar: HKLM-x32 - No Name - !{E3286BF1-E654-42FF-B4A6-5E111731DF6B} -  No File
DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} -  No File
Tcpip\Parameters: [DhcpNameServer] 192.168.43.1

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @java.com/DTPlugin,version=10.21.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Marcus Vogelgsang\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012-04-19]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012-04-19]

Chrome: 
=======
CHR HomePage: hxxp://de.yhs4.search.yahoo.com/?hspart=avast&hsimp=yhs-001&type={partner_id}
CHR RestoreOnStartup: "sync_promo": {
      "startup_count"
CHR StartupUrls: "hxxp://de.yhs4.search.yahoo.com/?hspart=avast&hsimp=yhs-001&type={partner_id}"
CHR DefaultSearchKeyword: www.yahoo.com
CHR DefaultSearchProvider: Yahoo! (Avast)
CHR DefaultSearchURL: hxxp://de.yhs4.search.yahoo.com/yhs/search?hspart=avast&hsimp=yhs-001&type={partner_id}&p={searchTerms}
CHR DefaultNewTabURL: 
CHR Extension: (Google Docs) - C:\Users\Marcus Vogelgsang\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-04-10]
CHR Extension: (Google Drive) - C:\Users\Marcus Vogelgsang\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-04-10]
CHR Extension: (YouTube) - C:\Users\Marcus Vogelgsang\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-04-10]
CHR Extension: (Google-Suche) - C:\Users\Marcus Vogelgsang\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-04-10]
CHR Extension: (Google Wallet) - C:\Users\Marcus Vogelgsang\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-10]
CHR Extension: (Google Mail) - C:\Users\Marcus Vogelgsang\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-04-10]
CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\DVDVideoSoftBrowserExtension.crx [2014-04-10]
CHR HKLM-x32\...\Chrome\Extension: [dgldkplledicnbnnliodeffobaiaodaf] - C:\Program Files (x86)\SiteRanker\Chrome\siterank_c.crx [2014-04-10]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-04-18]

==================== Services (Whitelisted) =================

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-04-18] (AVAST Software)
R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [256832 2011-04-24] (NTI Corporation)
S4 AntiVirWebService; "C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe" [X]
S2 HPSLPSVC; C:\Users\MARCUS~1\AppData\Local\Temp\7zS79A1\hpslpsvc64.dll [X]

==================== Drivers (Whitelisted) ====================

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-04-18] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-04-18] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-04-18] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-04-18] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-04-18] (AVAST Software)
R3 aswStm; C:\Windows\system32\drivers\aswStm.sys [84816 2014-04-18] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208928 2014-04-18] ()
R3 azvusb; C:\Windows\System32\DRIVERS\azvusb.sys [54784 2009-08-24] (AzureWave Technologies, Inc.)
S3 BTWDPAN; C:\Windows\System32\DRIVERS\btwdpan.sys [89640 2011-08-30] (Broadcom Corporation.)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2014-04-21] (Malwarebytes Corporation)
S1 PCLEPCI; C:\Windows\SysWOW64\drivers\pclepci.sys [14165 2005-02-09] (Pinnacle Systems GmbH)
S3 Andbus; system32\DRIVERS\lgandbus64.sys [X]
S3 AndDiag; system32\DRIVERS\lganddiag64.sys [X]
S3 AndGps; system32\DRIVERS\lgandgps64.sys [X]
S3 ANDModem; system32\DRIVERS\lgandmodem64.sys [X]
S1 ArcCtrl; system32\drivers\ArcCtrl.sys [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [X]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [X]
S3 LgBttPort; system32\DRIVERS\lgbtpt64.sys [X]
S3 lgbusenum; system32\DRIVERS\lgbtbs64.sys [X]
S3 LGVMODEM; system32\DRIVERS\lgvmdm64.sys [X]
S3 massfilter; system32\drivers\massfilter.sys [X]
S3 usbbus; system32\DRIVERS\lgx64bus.sys [X]
S3 UsbDiag; system32\DRIVERS\lgx64diag.sys [X]
S3 USBModem; system32\DRIVERS\lgx64modem.sys [X]
S3 ZTEusbnet; system32\DRIVERS\ZTEusbnet.sys [X]
S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [X]
S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-04-24 08:31 - 2014-04-24 08:31 - 02061824 _____ (Farbar) C:\Users\Marcus Vogelgsang\Downloads\FRST64 (1).exe
2014-04-22 22:46 - 2014-04-24 08:29 - 00000000 ____D () C:\Users\Marcus Vogelgsang\Downloads\FRST-OlderVersion
2014-04-21 21:26 - 2014-04-21 21:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-04-21 21:26 - 2014-04-14 20:13 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-04-21 21:26 - 2014-04-14 20:05 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-04-21 21:26 - 2014-04-14 20:05 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-04-21 21:26 - 2014-04-14 20:04 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-04-21 21:25 - 2014-04-21 21:26 - 00004161 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log
2014-04-21 21:12 - 2014-04-21 21:12 - 00987448 _____ () C:\Users\Marcus Vogelgsang\Downloads\SecurityCheck.exe
2014-04-21 18:29 - 2014-04-21 18:30 - 02347384 _____ (ESET) C:\Users\Marcus Vogelgsang\Downloads\esetsmartinstaller_enu.exe
2014-04-20 09:21 - 2014-04-20 09:21 - 01016261 _____ (Thisisu) C:\Users\Marcus Vogelgsang\Downloads\JRT.exe
2014-04-20 09:21 - 2014-04-20 09:21 - 00000000 ____D () C:\Windows\ERUNT
2014-04-20 09:15 - 2014-04-20 09:16 - 00000000 ____D () C:\AdwCleaner
2014-04-20 09:15 - 2014-04-20 09:15 - 01308369 _____ () C:\Users\Marcus Vogelgsang\Downloads\adwcleaner.exe
2014-04-20 08:51 - 2014-04-20 08:52 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Marcus Vogelgsang\Downloads\mbam-setup-2.0.1.1004.exe
2014-04-19 15:31 - 2014-04-19 15:31 - 00848856 _____ (Panda Security ) C:\Users\Marcus Vogelgsang\Downloads\USBVaccineSetup (1).exe
2014-04-19 14:56 - 2014-04-19 14:56 - 00029774 _____ () C:\ComboFix.txt
2014-04-19 14:48 - 2014-04-19 14:56 - 00000000 ____D () C:\Qoobox
2014-04-19 14:48 - 2014-04-19 14:55 - 00000000 ____D () C:\Windows\erdnt
2014-04-19 14:48 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-04-19 14:48 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-04-19 14:48 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-04-19 14:48 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-04-19 14:48 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-04-19 14:48 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-04-19 14:48 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-04-19 14:48 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-04-19 14:47 - 2014-04-19 14:47 - 05195154 ____R (Swearware) C:\Users\Marcus Vogelgsang\Downloads\ComboFix.exe
2014-04-19 14:43 - 2014-04-19 14:43 - 00848856 _____ (Panda Security ) C:\Users\Marcus Vogelgsang\Downloads\USBVaccineSetup.exe
2014-04-19 14:43 - 2014-04-19 14:43 - 00003042 _____ () C:\Windows\System32\Tasks\PandaUSBVaccine
2014-04-18 22:52 - 2014-04-18 22:52 - 00000000 ____D () C:\Users\Marcus Vogelgsang\AppData\Roaming\DropboxMaster
2014-04-18 22:51 - 2014-04-18 22:51 - 00315984 _____ (Dropbox, Inc.) C:\Users\Marcus Vogelgsang\Downloads\DropboxInstaller.exe
2014-04-18 22:00 - 2014-04-18 22:00 - 00000000 ____D () C:\Users\Marcus Vogelgsang\Documents\BW-Bank
2014-04-18 18:05 - 2014-04-18 18:05 - 00000043 _____ () C:\Users\Marcus Vogelgsang\AppData\Roaming\WB.CFG
2014-04-18 17:09 - 2014-04-24 14:38 - 00018148 _____ () C:\Users\Marcus Vogelgsang\Downloads\FRST.txt
2014-04-18 17:09 - 2014-04-18 17:10 - 00053124 _____ () C:\Users\Marcus Vogelgsang\Downloads\Addition.txt
2014-04-18 17:08 - 2014-04-24 14:38 - 00000000 ____D () C:\FRST
2014-04-18 17:07 - 2014-04-24 08:29 - 02061824 _____ (Farbar) C:\Users\Marcus Vogelgsang\Downloads\FRST64.exe
2014-04-18 17:05 - 2014-04-18 17:05 - 00003378 _____ () C:\Windows\System32\Tasks\pricemeterdownloader
2014-04-18 17:05 - 2014-04-18 17:05 - 00003300 _____ () C:\Windows\System32\Tasks\PriceMeterUpdater
2014-04-18 15:39 - 2014-04-21 21:18 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-18 15:39 - 2014-04-18 15:39 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-18 12:47 - 2014-04-18 13:27 - 00000000 ____D () C:\Users\Marcus Vogelgsang\Documents\Peter Orth
2014-04-18 12:40 - 2014-04-22 09:42 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-04-18 12:40 - 2014-04-18 12:40 - 00001970 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-04-18 12:40 - 2014-04-18 12:40 - 00000000 ____D () C:\Users\Marcus Vogelgsang\AppData\Roaming\AVAST Software
2014-04-18 12:40 - 2014-04-18 12:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast
2014-04-18 12:38 - 2014-04-18 12:38 - 00000000 ____D () C:\Program Files (x86)\Siber Systems
2014-04-18 12:37 - 2014-04-18 12:37 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2014-04-18 12:37 - 2014-04-18 12:37 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2014-04-18 12:37 - 2014-04-18 12:37 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-04-18 12:37 - 2014-04-18 12:37 - 00208928 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-04-18 12:37 - 2014-04-18 12:37 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-04-18 12:37 - 2014-04-18 12:37 - 00084816 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2014-04-18 12:37 - 2014-04-18 12:37 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-04-18 12:37 - 2014-04-18 12:37 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-04-18 12:37 - 2014-04-18 12:37 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-04-18 12:36 - 2014-04-18 12:36 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-04-18 12:36 - 2014-04-18 12:36 - 00000000 ____D () C:\Program Files\AVAST Software
2014-04-18 12:33 - 2014-03-17 22:35 - 00000426 _____ () C:\AVScanner.ini
2014-04-18 12:31 - 2014-04-18 12:35 - 88551496 _____ (AVAST Software) C:\Users\Marcus Vogelgsang\Downloads\avast_free_antivirus_setup_9.0.2016.exe
2014-04-18 12:31 - 2014-04-18 12:31 - 00002062 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk
2014-04-18 12:31 - 2014-04-18 12:31 - 00002050 _____ () C:\Users\Public\Desktop\Mozilla Thunderbird.lnk
2014-04-18 12:31 - 2014-04-18 12:31 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-04-18 12:29 - 2014-04-18 12:30 - 21987424 _____ (Mozilla) C:\Users\Marcus Vogelgsang\Downloads\Thunderbird Setup 24.4.0.exe
2014-04-11 16:31 - 2014-04-12 09:01 - 00000000 ____D () C:\Users\Marcus Vogelgsang\Documents\BHH2014Unfall
2014-04-11 14:06 - 2014-04-11 14:06 - 00000000 __SHD () C:\Users\Marcus Vogelgsang\AppData\Local\EmieUserList
2014-04-11 14:06 - 2014-04-11 14:06 - 00000000 __SHD () C:\Users\Marcus Vogelgsang\AppData\Local\EmieSiteList
2014-04-10 17:58 - 2014-03-06 12:21 - 23549440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-10 17:58 - 2014-03-06 11:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-10 17:58 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-04-10 17:58 - 2014-03-06 11:19 - 17387008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-10 17:58 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-10 17:58 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-04-10 17:58 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-04-10 17:58 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-10 17:58 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-10 17:58 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-10 17:58 - 2014-03-06 10:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-10 17:58 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-10 17:58 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-04-10 17:58 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-04-10 17:58 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-04-10 17:58 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-04-10 17:58 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-10 17:58 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-04-10 17:58 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-10 17:58 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-04-10 17:58 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-04-10 17:58 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-04-10 17:58 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-04-10 17:58 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-10 17:58 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-04-10 17:58 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-04-10 17:58 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-04-10 17:58 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-04-10 17:58 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-04-10 17:58 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-04-10 17:58 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-04-10 17:58 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-04-10 17:58 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-04-10 17:58 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-10 17:58 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-04-10 17:58 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-04-10 17:58 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-04-10 17:58 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-04-10 17:58 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-10 17:58 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-04-10 17:58 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-04-10 17:58 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-04-10 17:58 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-10 17:58 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-10 17:58 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-04-10 17:58 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-04-10 17:58 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-04-10 17:58 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-04-10 15:05 - 2014-04-24 14:39 - 00001128 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-10 15:05 - 2014-04-24 14:16 - 00001132 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-10 15:05 - 2014-04-18 19:21 - 00002199 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-04-10 15:05 - 2014-04-10 15:11 - 00004128 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-04-10 15:05 - 2014-04-10 15:11 - 00003876 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-04-10 15:05 - 2014-04-10 15:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-04-10 13:08 - 2014-04-10 13:08 - 00000000 ____D () C:\Users\Marcus Vogelgsang\AppData\Local\TB
2014-04-10 12:58 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-10 12:58 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-10 12:58 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-10 12:58 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-10 12:58 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-10 12:58 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-10 12:58 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-10 12:58 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-10 12:58 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-10 12:58 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-10 12:58 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-04-10 12:58 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-10 12:58 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-10 12:58 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-10 12:58 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-10 12:58 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-04-10 12:58 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys

==================== One Month Modified Files and Folders =======

2014-04-24 14:39 - 2014-04-10 15:05 - 00001128 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-24 14:38 - 2014-04-18 17:09 - 00018148 _____ () C:\Users\Marcus Vogelgsang\Downloads\FRST.txt
2014-04-24 14:38 - 2014-04-18 17:08 - 00000000 ____D () C:\FRST
2014-04-24 14:38 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-24 14:37 - 2012-10-17 06:43 - 00000349 _____ () C:\Users\Public\Documents\PCLECHAL.INI
2014-04-24 14:37 - 2009-07-14 07:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-04-24 14:37 - 2009-07-14 06:51 - 00164395 _____ () C:\Windows\setupact.log
2014-04-24 14:36 - 2012-02-18 04:20 - 01641293 _____ () C:\Windows\WindowsUpdate.log
2014-04-24 14:25 - 2012-04-06 20:12 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-24 14:16 - 2014-04-10 15:05 - 00001132 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-24 13:42 - 2013-03-22 23:06 - 00000000 ____D () C:\Users\Marcus Vogelgsang\Desktop\Motorsport
2014-04-24 13:40 - 2012-02-18 13:13 - 04181866 _____ () C:\Windows\system32\perfh007.dat
2014-04-24 13:40 - 2012-02-18 13:13 - 01264928 _____ () C:\Windows\system32\perfc007.dat
2014-04-24 13:40 - 2009-07-14 07:13 - 01313306 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-24 08:41 - 2009-07-14 06:45 - 00016752 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-24 08:41 - 2009-07-14 06:45 - 00016752 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-24 08:33 - 2012-10-13 12:03 - 00000000 ___RD () C:\Users\Marcus Vogelgsang\Dropbox
2014-04-24 08:31 - 2014-04-24 08:31 - 02061824 _____ (Farbar) C:\Users\Marcus Vogelgsang\Downloads\FRST64 (1).exe
2014-04-24 08:29 - 2014-04-22 22:46 - 00000000 ____D () C:\Users\Marcus Vogelgsang\Downloads\FRST-OlderVersion
2014-04-24 08:29 - 2014-04-18 17:07 - 02061824 _____ (Farbar) C:\Users\Marcus Vogelgsang\Downloads\FRST64.exe
2014-04-24 07:51 - 2012-10-13 12:02 - 00000000 ____D () C:\Users\Marcus Vogelgsang\AppData\Roaming\Dropbox
2014-04-22 09:42 - 2014-04-18 12:40 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-04-21 21:26 - 2014-04-21 21:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-04-21 21:26 - 2014-04-21 21:25 - 00004161 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log
2014-04-21 21:26 - 2013-12-17 11:37 - 00000000 ____D () C:\ProgramData\Oracle
2014-04-21 21:26 - 2012-11-02 08:26 - 00000000 ____D () C:\Program Files (x86)\Java
2014-04-21 21:18 - 2014-04-18 15:39 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-21 21:12 - 2014-04-21 21:12 - 00987448 _____ () C:\Users\Marcus Vogelgsang\Downloads\SecurityCheck.exe
2014-04-21 21:08 - 2010-11-21 05:47 - 00427676 _____ () C:\Windows\PFRO.log
2014-04-21 18:30 - 2014-04-21 18:29 - 02347384 _____ (ESET) C:\Users\Marcus Vogelgsang\Downloads\esetsmartinstaller_enu.exe
2014-04-20 09:31 - 2012-04-06 23:00 - 01307298 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-04-20 09:21 - 2014-04-20 09:21 - 01016261 _____ (Thisisu) C:\Users\Marcus Vogelgsang\Downloads\JRT.exe
2014-04-20 09:21 - 2014-04-20 09:21 - 00000000 ____D () C:\Windows\ERUNT
2014-04-20 09:16 - 2014-04-20 09:15 - 00000000 ____D () C:\AdwCleaner
2014-04-20 09:16 - 2012-03-23 22:44 - 00000000 ____D () C:\Users\Marcus Vogelgsang
2014-04-20 09:15 - 2014-04-20 09:15 - 01308369 _____ () C:\Users\Marcus Vogelgsang\Downloads\adwcleaner.exe
2014-04-20 08:52 - 2014-04-20 08:51 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Marcus Vogelgsang\Downloads\mbam-setup-2.0.1.1004.exe
2014-04-19 15:31 - 2014-04-19 15:31 - 00848856 _____ (Panda Security ) C:\Users\Marcus Vogelgsang\Downloads\USBVaccineSetup (1).exe
2014-04-19 14:56 - 2014-04-19 14:56 - 00029774 _____ () C:\ComboFix.txt
2014-04-19 14:56 - 2014-04-19 14:48 - 00000000 ____D () C:\Qoobox
2014-04-19 14:55 - 2014-04-19 14:48 - 00000000 ____D () C:\Windows\erdnt
2014-04-19 14:55 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-04-19 14:47 - 2014-04-19 14:47 - 05195154 ____R (Swearware) C:\Users\Marcus Vogelgsang\Downloads\ComboFix.exe
2014-04-19 14:43 - 2014-04-19 14:43 - 00848856 _____ (Panda Security ) C:\Users\Marcus Vogelgsang\Downloads\USBVaccineSetup.exe
2014-04-19 14:43 - 2014-04-19 14:43 - 00003042 _____ () C:\Windows\System32\Tasks\PandaUSBVaccine
2014-04-18 22:52 - 2014-04-18 22:52 - 00000000 ____D () C:\Users\Marcus Vogelgsang\AppData\Roaming\DropboxMaster
2014-04-18 22:52 - 2012-10-13 12:03 - 00001064 _____ () C:\Users\Marcus Vogelgsang\Desktop\Dropbox.lnk
2014-04-18 22:52 - 2012-10-13 12:02 - 00000000 ____D () C:\Users\Marcus Vogelgsang\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-04-18 22:51 - 2014-04-18 22:51 - 00315984 _____ (Dropbox, Inc.) C:\Users\Marcus Vogelgsang\Downloads\DropboxInstaller.exe
2014-04-18 22:00 - 2014-04-18 22:00 - 00000000 ____D () C:\Users\Marcus Vogelgsang\Documents\BW-Bank
2014-04-18 19:21 - 2014-04-10 15:05 - 00002199 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-04-18 19:09 - 2011-10-20 10:18 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-04-18 19:01 - 2012-03-23 22:48 - 00000000 ___RD () C:\Users\Marcus Vogelgsang\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-04-18 19:00 - 2013-02-07 22:11 - 00000000 ____D () C:\Program Files (x86)\VideoLAN
2014-04-18 18:05 - 2014-04-18 18:05 - 00000043 _____ () C:\Users\Marcus Vogelgsang\AppData\Roaming\WB.CFG
2014-04-18 17:10 - 2014-04-18 17:09 - 00053124 _____ () C:\Users\Marcus Vogelgsang\Downloads\Addition.txt
2014-04-18 17:05 - 2014-04-18 17:05 - 00003378 _____ () C:\Windows\System32\Tasks\pricemeterdownloader
2014-04-18 17:05 - 2014-04-18 17:05 - 00003300 _____ () C:\Windows\System32\Tasks\PriceMeterUpdater
2014-04-18 15:39 - 2014-04-18 15:39 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-18 14:22 - 2013-08-26 10:01 - 00000000 ____D () C:\Users\Marcus Vogelgsang\AppData\Local\avgchrome
2014-04-18 13:27 - 2014-04-18 12:47 - 00000000 ____D () C:\Users\Marcus Vogelgsang\Documents\Peter Orth
2014-04-18 12:42 - 2013-10-13 18:01 - 00000000 ____D () C:\ProgramData\AVG2014
2014-04-18 12:42 - 2013-10-13 17:59 - 00000000 ____D () C:\ProgramData\MFAData
2014-04-18 12:42 - 2012-11-15 22:49 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-04-18 12:40 - 2014-04-18 12:40 - 00001970 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-04-18 12:40 - 2014-04-18 12:40 - 00000000 ____D () C:\Users\Marcus Vogelgsang\AppData\Roaming\AVAST Software
2014-04-18 12:40 - 2014-04-18 12:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast
2014-04-18 12:38 - 2014-04-18 12:38 - 00000000 ____D () C:\Program Files (x86)\Siber Systems
2014-04-18 12:37 - 2014-04-18 12:37 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2014-04-18 12:37 - 2014-04-18 12:37 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2014-04-18 12:37 - 2014-04-18 12:37 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-04-18 12:37 - 2014-04-18 12:37 - 00208928 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-04-18 12:37 - 2014-04-18 12:37 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-04-18 12:37 - 2014-04-18 12:37 - 00084816 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2014-04-18 12:37 - 2014-04-18 12:37 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-04-18 12:37 - 2014-04-18 12:37 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-04-18 12:37 - 2014-04-18 12:37 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-04-18 12:36 - 2014-04-18 12:36 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-04-18 12:36 - 2014-04-18 12:36 - 00000000 ____D () C:\Program Files\AVAST Software
2014-04-18 12:35 - 2014-04-18 12:31 - 88551496 _____ (AVAST Software) C:\Users\Marcus Vogelgsang\Downloads\avast_free_antivirus_setup_9.0.2016.exe
2014-04-18 12:33 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
2014-04-18 12:31 - 2014-04-18 12:31 - 00002062 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk
2014-04-18 12:31 - 2014-04-18 12:31 - 00002050 _____ () C:\Users\Public\Desktop\Mozilla Thunderbird.lnk
2014-04-18 12:31 - 2014-04-18 12:31 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-04-18 12:30 - 2014-04-18 12:29 - 21987424 _____ (Mozilla) C:\Users\Marcus Vogelgsang\Downloads\Thunderbird Setup 24.4.0.exe
2014-04-18 12:19 - 2013-10-02 09:28 - 00000000 ____D () C:\Users\Marcus Vogelgsang\Desktop\DTM
2014-04-18 12:17 - 2013-06-29 20:41 - 00000000 ____D () C:\Users\Marcus Vogelgsang\Desktop\Musik
2014-04-14 20:13 - 2014-04-21 21:26 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-04-14 20:05 - 2014-04-21 21:26 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-04-14 20:05 - 2014-04-21 21:26 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-04-14 20:04 - 2014-04-21 21:26 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-04-12 14:19 - 2013-01-15 11:30 - 00000000 ____D () C:\Users\Marcus Vogelgsang\Documents\PdfGrabber
2014-04-12 10:19 - 2012-05-19 11:16 - 00000000 ____D () C:\Users\Marcus Vogelgsang\Documents\AD_LUMIX
2014-04-12 10:19 - 2011-01-01 00:00 - 00000000 ____D () C:\Users\Marcus Vogelgsang\Documents\DCIM
2014-04-12 09:01 - 2014-04-11 16:31 - 00000000 ____D () C:\Users\Marcus Vogelgsang\Documents\BHH2014Unfall
2014-04-12 09:01 - 2014-02-26 18:39 - 00000000 ____D () C:\Users\Marcus Vogelgsang\AppData\Local\Windows Live
2014-04-11 14:06 - 2014-04-11 14:06 - 00000000 __SHD () C:\Users\Marcus Vogelgsang\AppData\Local\EmieUserList
2014-04-11 14:06 - 2014-04-11 14:06 - 00000000 __SHD () C:\Users\Marcus Vogelgsang\AppData\Local\EmieSiteList
2014-04-11 10:51 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-04-11 07:46 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-04-10 17:59 - 2009-07-14 04:34 - 00000566 _____ () C:\Windows\win.ini
2014-04-10 17:58 - 2013-08-14 22:11 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-10 17:58 - 2012-04-08 21:53 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-04-10 17:56 - 2012-04-09 21:47 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-04-10 15:11 - 2014-04-10 15:05 - 00004128 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-04-10 15:11 - 2014-04-10 15:05 - 00003876 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-04-10 15:05 - 2014-04-10 15:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-04-10 15:05 - 2012-04-06 22:18 - 00000000 ____D () C:\Program Files (x86)\Google
2014-04-10 15:04 - 2012-04-06 22:17 - 00000000 ____D () C:\Users\Marcus Vogelgsang\AppData\Local\Deployment
2014-04-10 15:00 - 2012-04-06 22:18 - 00000000 ____D () C:\Program Files\Google
2014-04-10 14:56 - 2012-04-06 22:18 - 00000000 ____D () C:\Users\Marcus Vogelgsang\AppData\Local\Google
2014-04-10 13:08 - 2014-04-10 13:08 - 00000000 ____D () C:\Users\Marcus Vogelgsang\AppData\Local\TB
2014-03-31 09:35 - 2010-11-21 05:27 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

Some content of TEMP:
====================
C:\Users\Marcus Vogelgsang\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpmot0x3.dll
C:\Users\Marcus Vogelgsang\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmptlgqkz.dll
C:\Users\Marcus Vogelgsang\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe
C:\Users\Marcus Vogelgsang\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-04-19 16:35

==================== End Of Log ============================
--- --- ---
Alt 25.04.2014, 09:10   #17
schrauber
/// the machine
/// TB-Ausbilder
 
Mein Laptop legt Verknüpfungen am USB Stick an - Standard

Mein Laptop legt Verknüpfungen am USB Stick an


Fertig

Die Reihenfolge ist hier entscheidend.
  1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
  2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
    • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
    • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
    • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
  3. Downloade Dir bitte auf jeden Fall DelFix Download DelFix auf deinen Desktop:
    • Schließe alle offenen Programme.
    • Starte die delfix.exe mit einem Doppelklick.
    • Setze vor jede Funktion ein Häkchen.
    • Klicke auf Start.
    • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
    • Starte deinen Rechner abschließend neu.
  4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.



Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun

Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
  • Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
  • Windows Updates
    • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
    • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
  • Gehe sicher das die automatischen Updates aktiviert sind.
  • Software Updates
    Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
    Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.


Anti- Viren Software
  • Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.


Zusätzlicher Schutz
  • MalwareBytes Anti Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
    Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.
  • WinPatrol
    Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.


Sicheres Browsen
  • SpywareBlaster
    Eine kurze Einführung findest du Hier
  • MVPs hosts file
    Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
  • WOT (Web of trust)
    Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.


Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
  • Opera
  • Mozilla Firefox.
    • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
    • NoScript
      Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    • AdblockPlus
      Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
      Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts
  • Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
  • verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe
Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________

__________________
Alt 25.04.2014, 10:34   #18
Marcus.V
 
Mein Laptop legt Verknüpfungen am USB Stick an - Standard

Mein Laptop legt Verknüpfungen am USB Stick an


Ich habe jetzt noch die Verknüpfungen auf dem Stick

# DelFix v10.6 - Datei am 25/04/2014 um 10:34:30 erstellt
# Aktualisiert am 11/11/2013 von Xplode
# Benutzer : Marcus Vogelgsang - MARCUSVOGELGSAN
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)

~ Aktiviere die Benutzerkontensteuerung ... OK

~ Entferne die Bereinigungsprogramme ...

Gelöscht : C:\FRST
Gelöscht : C:\AdwCleaner
Gelöscht : C:\ComboFix.txt
Gelöscht : C:\logFileUI.txt
Gelöscht : C:\Users\Marcus Vogelgsang\Downloads\Addition.txt
Gelöscht : C:\Users\Marcus Vogelgsang\Downloads\adwcleaner.exe
Gelöscht : C:\Users\Marcus Vogelgsang\Downloads\esetsmartinstaller_enu.exe
Gelöscht : C:\Users\Marcus Vogelgsang\Downloads\Fixlog.txt
Gelöscht : C:\Users\Marcus Vogelgsang\Downloads\FRST.txt
Gelöscht : C:\Users\Marcus Vogelgsang\Downloads\FRST64 (1).exe
Gelöscht : C:\Users\Marcus Vogelgsang\Downloads\FRST64.exe
Gelöscht : C:\Users\Marcus Vogelgsang\Downloads\JRT.exe
Gelöscht : C:\Users\Marcus Vogelgsang\Downloads\SecurityCheck.exe
Gelöscht : HKLM\SOFTWARE\AdwCleaner
Gelöscht : HKLM\SOFTWARE\Swearware

~ Erstelle ein Backup der Registrierungsdatenbank ... OK

~ Lösche die Wiederherstellungspunkte ...

Gelöscht : RP #248 [Removed Visual Studio 2012 x86 Redistributables | 04/18/2014 17:07:43]
Gelöscht : RP #249 [Removed LG Bluetooth Drivers. | 04/18/2014 17:08:00]
Gelöscht : RP #250 [Entfernt LG United Mobile Driver | 04/18/2014 17:08:48]
Gelöscht : RP #251 [Windows Update | 04/18/2014 17:23:45]
Gelöscht : RP #252 [Installed Java 7 Update 55 | 04/21/2014 19:25:07]
Gelöscht : RP #253 [Windows Update | 04/22/2014 20:40:08]

Ein neuer Wiederherstellungspunkt wurde erstellt !

~ Stelle die Systemeinstellungen wieder her ... OK

########## - EOF - ##########

Wie bekomme ich jetzt die Verknüpfungen jetzt Weg?
__________________
Alt 26.04.2014, 08:04   #19
schrauber
/// the machine
/// TB-Ausbilder
 
Mein Laptop legt Verknüpfungen am USB Stick an - Standard

Mein Laptop legt Verknüpfungen am USB Stick an


Systemsteuerung > Ordneroptionen > Versteckte DAteien anzeigen lassen und Haken raus bei Systemdateien ausblenden.

Dann siehst du die Originalordner.

Rechtsklick auf diese, Haken raus ber vertecjt und geschützt, dann solltest du die ordner wieder ganz normal sehen, dann kannste die Verknüpfungen einfach löschen.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 26.04.2014, 08:41   #20
Marcus.V
 
Mein Laptop legt Verknüpfungen am USB Stick an - Standard

Mein Laptop legt Verknüpfungen am USB Stick an


Sobald ich die Verknüpfungen löschen, kommen sie wieder.
Wenn ich den Stick an einem anderen PC Anschließe zeigt er nichts an!


Alt 26.04.2014, 16:16   #21
schrauber
/// the machine
/// TB-Ausbilder
 
Mein Laptop legt Verknüpfungen am USB Stick an - Standard

Mein Laptop legt Verknüpfungen am USB Stick an


Screenshot vom WIndows Explorer bite bei geöffnetem Stick.
__________________
--> Mein Laptop legt Verknüpfungen am USB Stick an

Alt 26.04.2014, 17:32   #22
Marcus.V
 
Mein Laptop legt Verknüpfungen am USB Stick an - Standard

Mein Laptop legt Verknüpfungen am USB Stick an


Anbei der Anhang
Angehängte Grafiken
Dateityp: jpg Unbenannt.jpg (66,6 KB, 113x aufgerufen)

Alt 26.04.2014, 18:01   #23
Marcus.V
 
Mein Laptop legt Verknüpfungen am USB Stick an - Standard

Mein Laptop legt Verknüpfungen am USB Stick an


Was ist wen ich den Stick jetzt komplet Formatiere?
Hab die Daten Extra Gespeichert

Alt 27.04.2014, 18:09   #24
schrauber
/// the machine
/// TB-Ausbilder
 
Mein Laptop legt Verknüpfungen am USB Stick an - Standard

Mein Laptop legt Verknüpfungen am USB Stick an


Ja wenn DU die Daten hast kannste den Stick formatieren, das ist der schnellste Weg
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 30.04.2014, 21:49   #25
Marcus.V
 
Mein Laptop legt Verknüpfungen am USB Stick an - Standard

Mein Laptop legt Verknüpfungen am USB Stick an


Stick ist Formatiert. Nach dem Speichrrn der Daten taucht immer noch das gleiche Problem auf. Auch bei einem Anderen Stick.

Alt 01.05.2014, 16:46   #26
schrauber
/// the machine
/// TB-Ausbilder
 
Mein Laptop legt Verknüpfungen am USB Stick an - Standard

Mein Laptop legt Verknüpfungen am USB Stick an


Poste bitte nochmal ein frisches FRST log.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 01.05.2014, 17:44   #27
Marcus.V
 
Mein Laptop legt Verknüpfungen am USB Stick an - Standard

Mein Laptop legt Verknüpfungen am USB Stick an



FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-05-2014 01
Ran by Marcus Vogelgsang (administrator) on MARCUSVOGELGSAN on 01-05-2014 18:41:04
Running from C:\Users\Marcus Vogelgsang\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.23.9\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.23.9\GoogleCrashHandler64.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(PCTV Systems S.à r.l.) C:\Program Files (x86)\Common Files\PCTV Systems\StreamingServer\StrmServer.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe
(Microsoft Corporation) C:\Windows\System32\wscript.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\OFFICE11\OUTLOOK.EXE
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Farbar) C:\Users\Marcus Vogelgsang\Downloads\FRST64(1).exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2280232 2010-07-29] (Synaptics Incorporated)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1103440 2011-07-01] (Dritek System Inc.)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [SuiteTray] => C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe [341360 2011-09-20] (Egis Technology Inc.)
HKLM-x32\...\Run: [hpqSRMon] => C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe [150528 2008-07-22] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-01-20] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [3854640 2014-04-18] (AVAST Software)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-01-20] (Apple Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-3727746948-312616605-306874443-1001\...\Run: [StrmServer.exe] => C:\Program Files (x86)\Common Files\PCTV Systems\StreamingServer\StrmServer.exe [746768 2010-12-21] (PCTV Systems S.à r.l.)
HKU\S-1-5-21-3727746948-312616605-306874443-1001\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-09-14] (Apple Inc.)
HKU\S-1-5-21-3727746948-312616605-306874443-1001\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-09-15] (Apple Inc.)
HKU\S-1-5-21-3727746948-312616605-306874443-1001\...\Run: [AppleIEDAV] => C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe [1315144 2013-09-04] (Apple Inc.)
HKU\S-1-5-21-3727746948-312616605-306874443-1001\...\Run: [Microsoft] => wscript.exe //B "C:\Users\Marcus Vogelgsang\AppData\Roaming\Microsoft.vbe"
Lsa: [Notification Packages] scecli C:\Program Files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Nach Updates suchen.lnk
ShortcutTarget: Nach Updates suchen.lnk -> C:\Program Files (x86)\Common Files\PCTV Systems\WebUpdater\WebUpdater.exe (PCTV Systems)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.yhs4.search.yahoo.com/?hspart=avast&hsimp=yhs-001&type={partner_id}
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2431} URL = 
SearchScopes: HKLM-x32 - {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?hspart=avast&hsimp=yhs-001&type={partner_id}&p={searchTerms}
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?hspart=avast&hsimp=yhs-001&type={partner_id}&p={searchTerms}
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - No Name - !{E3286BF1-E654-42FF-B4A6-5E111731DF6B} -  No File
Toolbar: HKLM-x32 - No Name - !{95B7759C-8C7F-4BF1-B163-73684A933233} -  No File
Toolbar: HKLM-x32 - No Name - !{E3286BF1-E654-42FF-B4A6-5E111731DF6B} -  No File
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} -  No File
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Marcus Vogelgsang\AppData\Roaming\Mozilla\Firefox\Profiles\vvaybwkb.default
FF Homepage: hxxp://google.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_206.dll ()
FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_206.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Marcus Vogelgsang\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012-04-19]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-04-18]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012-04-19]

Chrome: 
=======
CHR HomePage: hxxp://de.yhs4.search.yahoo.com/?hspart=avast&hsimp=yhs-001&type={partner_id}
CHR RestoreOnStartup: "sync_promo"
CHR StartupUrls: "hxxp://de.yhs4.search.yahoo.com/?hspart=avast&hsimp=yhs-001&type={partner_id}"
CHR DefaultSearchKeyword: www.yahoo.com
CHR DefaultSearchProvider: Yahoo! (Avast)
CHR DefaultSearchURL: hxxp://de.yhs4.search.yahoo.com/yhs/search?hspart=avast&hsimp=yhs-001&type={partner_id}&p={searchTerms}
CHR DefaultNewTabURL: 
CHR Extension: (Google Docs) - C:\Users\Marcus Vogelgsang\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-04-10]
CHR Extension: (Google Drive) - C:\Users\Marcus Vogelgsang\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-04-10]
CHR Extension: (YouTube) - C:\Users\Marcus Vogelgsang\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-04-10]
CHR Extension: (Google-Suche) - C:\Users\Marcus Vogelgsang\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-04-10]
CHR Extension: (Google Wallet) - C:\Users\Marcus Vogelgsang\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-10]
CHR Extension: (Google Mail) - C:\Users\Marcus Vogelgsang\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-04-10]
CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\DVDVideoSoftBrowserExtension.crx [2014-04-10]
CHR HKLM-x32\...\Chrome\Extension: [dgldkplledicnbnnliodeffobaiaodaf] - C:\Program Files (x86)\SiteRanker\Chrome\siterank_c.crx [2014-04-10]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-04-18]

==================== Services (Whitelisted) =================

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-04-18] (AVAST Software)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-04-03] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [857912 2014-04-03] (Malwarebytes Corporation)
R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [256832 2011-04-24] (NTI Corporation)
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia)
S4 AntiVirWebService; "C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe" [X]
S2 HPSLPSVC; C:\Users\MARCUS~1\AppData\Local\Temp\7zS79A1\hpslpsvc64.dll [X]

==================== Drivers (Whitelisted) ====================

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-04-18] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-04-18] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-04-18] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-04-18] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-04-18] (AVAST Software)
R3 aswStm; C:\Windows\system32\drivers\aswStm.sys [84816 2014-04-18] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208928 2014-04-18] ()
R3 azvusb; C:\Windows\System32\DRIVERS\azvusb.sys [54784 2009-08-24] (AzureWave Technologies, Inc.)
S3 BTWDPAN; C:\Windows\System32\DRIVERS\btwdpan.sys [89640 2011-08-30] (Broadcom Corporation.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-04-03] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2014-05-01] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63192 2014-04-03] (Malwarebytes Corporation)
S1 PCLEPCI; C:\Windows\SysWOW64\drivers\pclepci.sys [14165 2005-02-09] (Pinnacle Systems GmbH)
R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-12-06] (Secunia)
S3 Andbus; system32\DRIVERS\lgandbus64.sys [X]
S3 AndDiag; system32\DRIVERS\lganddiag64.sys [X]
S3 AndGps; system32\DRIVERS\lgandgps64.sys [X]
S3 ANDModem; system32\DRIVERS\lgandmodem64.sys [X]
S1 ArcCtrl; system32\drivers\ArcCtrl.sys [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [X]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [X]
S3 LgBttPort; system32\DRIVERS\lgbtpt64.sys [X]
S3 lgbusenum; system32\DRIVERS\lgbtbs64.sys [X]
S3 LGVMODEM; system32\DRIVERS\lgvmdm64.sys [X]
S3 massfilter; system32\drivers\massfilter.sys [X]
S3 usbbus; system32\DRIVERS\lgx64bus.sys [X]
S3 UsbDiag; system32\DRIVERS\lgx64diag.sys [X]
S3 USBModem; system32\DRIVERS\lgx64modem.sys [X]
S3 ZTEusbnet; system32\DRIVERS\ZTEusbnet.sys [X]
S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [X]
S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-01 18:41 - 2014-05-01 18:41 - 00020386 _____ () C:\Users\Marcus Vogelgsang\Downloads\FRST.txt
2014-05-01 18:40 - 2014-05-01 18:41 - 00000000 ____D () C:\FRST
2014-05-01 18:36 - 2014-05-01 18:37 - 02061824 _____ (Farbar) C:\Users\Marcus Vogelgsang\Downloads\FRST64(1).exe
2014-05-01 18:36 - 2014-05-01 18:36 - 02061824 _____ (Farbar) C:\Users\Marcus Vogelgsang\Downloads\FRST64.exe
2014-05-01 18:30 - 2014-05-01 18:32 - 83022576 _____ (Nero AG) C:\Users\Marcus Vogelgsang\Downloads\Nero_BurningROM2014-15.0.04600_trial(1).exe
2014-05-01 18:29 - 2014-05-01 18:31 - 83022576 _____ (Nero AG) C:\Users\Marcus Vogelgsang\Downloads\Nero_BurningROM2014-15.0.04600_trial.exe
2014-04-26 18:58 - 2014-04-26 18:58 - 00000000 ____D () C:\Users\Marcus Vogelgsang\Documents\TEST
2014-04-26 09:55 - 2014-04-26 09:55 - 00000000 ____D () C:\Users\Marcus Vogelgsang\AppData\Local\Macromedia
2014-04-26 08:43 - 2014-04-26 08:43 - 00001747 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-04-26 08:43 - 2014-04-26 08:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-04-26 08:42 - 2014-04-26 08:42 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-04-26 08:42 - 2014-04-26 08:42 - 00000000 ____D () C:\Program Files\iTunes
2014-04-26 08:42 - 2014-04-26 08:42 - 00000000 ____D () C:\Program Files\iPod
2014-04-26 08:42 - 2014-04-26 08:42 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-04-26 08:41 - 2014-04-26 08:41 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Apple Computer
2014-04-26 08:41 - 2014-04-26 08:41 - 00000000 ____D () C:\Users\Default\AppData\Local\Apple Computer
2014-04-26 08:41 - 2014-04-26 08:41 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Apple Computer
2014-04-26 08:41 - 2014-04-26 08:41 - 00000000 ____D () C:\Users\Default User\AppData\Local\Apple Computer
2014-04-26 08:39 - 2014-04-26 08:39 - 00000000 ____D () C:\Program Files\Bonjour
2014-04-26 08:39 - 2014-04-26 08:39 - 00000000 ____D () C:\Program Files (x86)\Bonjour
2014-04-25 11:29 - 2013-12-17 09:50 - 00554306 ___SH () C:\Users\Marcus Vogelgsang\AppData\Roaming\Microsoft.vbe
2014-04-25 11:23 - 2014-04-25 11:23 - 00448512 _____ (OldTimer Tools) C:\Users\Marcus Vogelgsang\Downloads\TFC (1).exe
2014-04-25 11:07 - 2014-04-25 11:07 - 00700980 _____ () C:\Users\Marcus Vogelgsang\Downloads\adblock_edge-2.0.7-sm+an+tb+fx-windows.xpi
2014-04-25 11:07 - 2014-04-25 11:07 - 00448512 _____ (OldTimer Tools) C:\Users\Marcus Vogelgsang\Downloads\TFC.exe
2014-04-25 11:06 - 2014-04-25 11:06 - 00537528 _____ () C:\Users\Marcus Vogelgsang\Downloads\noscript-2.6.8.20.xpi.zip
2014-04-25 11:05 - 2014-04-25 11:05 - 00001123 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-04-25 11:05 - 2014-04-25 11:05 - 00001111 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-04-25 11:05 - 2014-04-25 11:05 - 00000000 ____D () C:\Users\Marcus Vogelgsang\AppData\Local\Mozilla
2014-04-25 11:04 - 2014-04-25 11:04 - 00283192 _____ (Mozilla) C:\Users\Marcus Vogelgsang\Downloads\FirefoxSetupStub28.0.exe
2014-04-25 10:57 - 2014-04-25 10:57 - 00313256 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-04-25 10:57 - 2014-04-25 10:57 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-04-25 10:57 - 2014-04-25 10:57 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-04-25 10:57 - 2014-04-25 10:57 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2014-04-25 10:55 - 2014-04-25 10:55 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-04-25 10:55 - 2014-04-25 10:55 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-04-25 10:55 - 2014-04-25 10:55 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-04-25 10:55 - 2014-04-25 10:55 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-04-25 10:55 - 2014-04-25 10:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-04-25 10:42 - 2014-04-25 10:42 - 00001066 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-04-25 10:42 - 2014-04-25 10:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-04-25 10:42 - 2014-04-25 10:42 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-04-25 10:42 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-25 10:42 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-25 10:42 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-25 10:41 - 2014-04-25 10:42 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Marcus Vogelgsang\Downloads\mbam-setup-2.0.1.1004 (1).exe
2014-04-25 10:41 - 2014-04-25 10:41 - 00001033 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Secunia PSI.lnk
2014-04-25 10:41 - 2014-04-25 10:41 - 00000000 ____D () C:\Users\Marcus Vogelgsang\AppData\Local\Secunia PSI
2014-04-25 10:41 - 2014-04-25 10:41 - 00000000 ____D () C:\Program Files (x86)\Secunia
2014-04-25 10:40 - 2014-04-25 10:40 - 05329480 _____ (Secunia) C:\Users\Marcus Vogelgsang\Downloads\PSISetup_3.0.0.9016.exe
2014-04-25 10:34 - 2014-04-25 10:35 - 00001738 _____ () C:\DelFix.txt
2014-04-25 09:11 - 2014-04-27 17:37 - 00039145 _____ () C:\Users\Marcus Vogelgsang\Desktop\PDSS2014.xlsx
2014-04-22 22:46 - 2014-04-24 08:29 - 00000000 ____D () C:\Users\Marcus Vogelgsang\Downloads\FRST-OlderVersion
2014-04-21 21:25 - 2014-04-21 21:26 - 00004161 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log
2014-04-20 09:21 - 2014-04-25 10:34 - 00000000 ____D () C:\Windows\ERUNT
2014-04-20 08:51 - 2014-04-20 08:52 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Marcus Vogelgsang\Downloads\mbam-setup-2.0.1.1004.exe
2014-04-19 15:31 - 2014-04-19 15:31 - 00848856 _____ (Panda Security ) C:\Users\Marcus Vogelgsang\Downloads\USBVaccineSetup (1).exe
2014-04-19 14:48 - 2014-04-25 10:34 - 00000000 ____D () C:\Windows\erdnt
2014-04-19 14:43 - 2014-04-19 14:43 - 00848856 _____ (Panda Security ) C:\Users\Marcus Vogelgsang\Downloads\USBVaccineSetup.exe
2014-04-19 14:43 - 2014-04-19 14:43 - 00003042 _____ () C:\Windows\System32\Tasks\PandaUSBVaccine
2014-04-18 22:52 - 2014-04-18 22:52 - 00000000 ____D () C:\Users\Marcus Vogelgsang\AppData\Roaming\DropboxMaster
2014-04-18 22:51 - 2014-04-18 22:51 - 00315984 _____ (Dropbox, Inc.) C:\Users\Marcus Vogelgsang\Downloads\DropboxInstaller.exe
2014-04-18 22:00 - 2014-04-18 22:00 - 00000000 ____D () C:\Users\Marcus Vogelgsang\Documents\BW-Bank
2014-04-18 18:05 - 2014-04-18 18:05 - 00000043 _____ () C:\Users\Marcus Vogelgsang\AppData\Roaming\WB.CFG
2014-04-18 17:05 - 2014-04-18 17:05 - 00003378 _____ () C:\Windows\System32\Tasks\pricemeterdownloader
2014-04-18 17:05 - 2014-04-18 17:05 - 00003300 _____ () C:\Windows\System32\Tasks\PriceMeterUpdater
2014-04-18 15:39 - 2014-05-01 18:39 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-18 15:39 - 2014-04-18 15:39 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-18 12:47 - 2014-04-25 11:30 - 00000000 ____D () C:\Users\Marcus Vogelgsang\Documents\Peter Orth
2014-04-18 12:40 - 2014-04-27 13:12 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-04-18 12:40 - 2014-04-18 12:40 - 00001970 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-04-18 12:40 - 2014-04-18 12:40 - 00000000 ____D () C:\Users\Marcus Vogelgsang\AppData\Roaming\AVAST Software
2014-04-18 12:40 - 2014-04-18 12:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast
2014-04-18 12:38 - 2014-04-18 12:38 - 00000000 ____D () C:\Program Files (x86)\Siber Systems
2014-04-18 12:37 - 2014-04-18 12:37 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2014-04-18 12:37 - 2014-04-18 12:37 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2014-04-18 12:37 - 2014-04-18 12:37 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-04-18 12:37 - 2014-04-18 12:37 - 00208928 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-04-18 12:37 - 2014-04-18 12:37 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-04-18 12:37 - 2014-04-18 12:37 - 00084816 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2014-04-18 12:37 - 2014-04-18 12:37 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-04-18 12:37 - 2014-04-18 12:37 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-04-18 12:37 - 2014-04-18 12:37 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-04-18 12:36 - 2014-04-18 12:36 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-04-18 12:36 - 2014-04-18 12:36 - 00000000 ____D () C:\Program Files\AVAST Software
2014-04-18 12:33 - 2014-03-17 22:35 - 00000426 _____ () C:\AVScanner.ini
2014-04-18 12:31 - 2014-04-18 12:35 - 88551496 _____ (AVAST Software) C:\Users\Marcus Vogelgsang\Downloads\avast_free_antivirus_setup_9.0.2016.exe
2014-04-18 12:31 - 2014-04-18 12:31 - 00002062 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk
2014-04-18 12:31 - 2014-04-18 12:31 - 00002050 _____ () C:\Users\Public\Desktop\Mozilla Thunderbird.lnk
2014-04-18 12:31 - 2014-04-18 12:31 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-04-18 12:29 - 2014-04-18 12:30 - 21987424 _____ (Mozilla) C:\Users\Marcus Vogelgsang\Downloads\Thunderbird Setup 24.4.0.exe
2014-04-11 16:31 - 2014-04-12 09:01 - 00000000 ____D () C:\Users\Marcus Vogelgsang\Documents\BHH2014Unfall
2014-04-11 14:06 - 2014-04-11 14:06 - 00000000 __SHD () C:\Users\Marcus Vogelgsang\AppData\Local\EmieUserList
2014-04-11 14:06 - 2014-04-11 14:06 - 00000000 __SHD () C:\Users\Marcus Vogelgsang\AppData\Local\EmieSiteList
2014-04-10 17:58 - 2014-03-06 12:21 - 23549440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-10 17:58 - 2014-03-06 11:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-10 17:58 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-04-10 17:58 - 2014-03-06 11:19 - 17387008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-10 17:58 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-10 17:58 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-04-10 17:58 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-04-10 17:58 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-10 17:58 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-10 17:58 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-10 17:58 - 2014-03-06 10:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-10 17:58 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-10 17:58 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-04-10 17:58 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-04-10 17:58 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-04-10 17:58 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-04-10 17:58 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-10 17:58 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-04-10 17:58 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-10 17:58 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-04-10 17:58 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-04-10 17:58 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-04-10 17:58 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-04-10 17:58 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-10 17:58 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-04-10 17:58 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-04-10 17:58 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-04-10 17:58 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-04-10 17:58 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-04-10 17:58 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-04-10 17:58 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-04-10 17:58 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-04-10 17:58 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-04-10 17:58 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-10 17:58 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-04-10 17:58 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-04-10 17:58 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-04-10 17:58 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-04-10 17:58 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-10 17:58 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-04-10 17:58 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-04-10 17:58 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-04-10 17:58 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-10 17:58 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-10 17:58 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-04-10 17:58 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-04-10 17:58 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-04-10 17:58 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-04-10 15:05 - 2014-05-01 18:38 - 00001128 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-10 15:05 - 2014-04-27 17:16 - 00001132 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-10 15:05 - 2014-04-26 14:18 - 00002139 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-04-10 15:05 - 2014-04-10 15:11 - 00004128 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-04-10 15:05 - 2014-04-10 15:11 - 00003876 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-04-10 15:05 - 2014-04-10 15:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-04-10 13:08 - 2014-04-10 13:08 - 00000000 ____D () C:\Users\Marcus Vogelgsang\AppData\Local\TB
2014-04-10 12:58 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-10 12:58 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-10 12:58 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-10 12:58 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-10 12:58 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-10 12:58 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-10 12:58 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-10 12:58 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-10 12:58 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-10 12:58 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-10 12:58 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-04-10 12:58 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-10 12:58 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-10 12:58 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-10 12:58 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-10 12:58 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-04-10 12:58 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys

==================== One Month Modified Files and Folders =======

2014-05-01 18:41 - 2014-05-01 18:41 - 00020386 _____ () C:\Users\Marcus Vogelgsang\Downloads\FRST.txt
2014-05-01 18:41 - 2014-05-01 18:40 - 00000000 ____D () C:\FRST
2014-05-01 18:39 - 2014-04-18 15:39 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-01 18:38 - 2014-04-10 15:05 - 00001128 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-01 18:38 - 2012-10-17 06:43 - 00000349 _____ () C:\Users\Public\Documents\PCLECHAL.INI
2014-05-01 18:38 - 2012-04-06 20:12 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-01 18:38 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-01 18:38 - 2009-07-14 06:51 - 00164899 _____ () C:\Windows\setupact.log
2014-05-01 18:37 - 2014-05-01 18:36 - 02061824 _____ (Farbar) C:\Users\Marcus Vogelgsang\Downloads\FRST64(1).exe
2014-05-01 18:37 - 2012-02-18 04:20 - 01889756 _____ () C:\Windows\WindowsUpdate.log
2014-05-01 18:37 - 2010-11-21 05:47 - 00428614 _____ () C:\Windows\PFRO.log
2014-05-01 18:36 - 2014-05-01 18:36 - 02061824 _____ (Farbar) C:\Users\Marcus Vogelgsang\Downloads\FRST64.exe
2014-05-01 18:35 - 2012-04-06 20:12 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-05-01 18:35 - 2012-04-06 20:12 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-05-01 18:35 - 2011-10-20 11:22 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-01 18:32 - 2014-05-01 18:30 - 83022576 _____ (Nero AG) C:\Users\Marcus Vogelgsang\Downloads\Nero_BurningROM2014-15.0.04600_trial(1).exe
2014-05-01 18:31 - 2014-05-01 18:29 - 83022576 _____ (Nero AG) C:\Users\Marcus Vogelgsang\Downloads\Nero_BurningROM2014-15.0.04600_trial.exe
2014-05-01 18:24 - 2009-07-14 06:45 - 00016752 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-01 18:24 - 2009-07-14 06:45 - 00016752 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-30 22:46 - 2012-02-18 13:13 - 04255826 _____ () C:\Windows\system32\perfh007.dat
2014-04-30 22:46 - 2012-02-18 13:13 - 01288608 _____ () C:\Windows\system32\perfc007.dat
2014-04-30 22:46 - 2009-07-14 07:13 - 01337886 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-27 17:37 - 2014-04-25 09:11 - 00039145 _____ () C:\Users\Marcus Vogelgsang\Desktop\PDSS2014.xlsx
2014-04-27 17:16 - 2014-04-10 15:05 - 00001132 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-27 13:12 - 2014-04-18 12:40 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-04-26 20:02 - 2012-10-13 12:03 - 00000000 ___RD () C:\Users\Marcus Vogelgsang\Dropbox
2014-04-26 18:58 - 2014-04-26 18:58 - 00000000 ____D () C:\Users\Marcus Vogelgsang\Documents\TEST
2014-04-26 18:22 - 2012-10-13 12:02 - 00000000 ____D () C:\Users\Marcus Vogelgsang\AppData\Roaming\Dropbox
2014-04-26 14:18 - 2014-04-10 15:05 - 00002139 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-04-26 09:55 - 2014-04-26 09:55 - 00000000 ____D () C:\Users\Marcus Vogelgsang\AppData\Local\Macromedia
2014-04-26 09:02 - 2013-03-22 23:06 - 00000000 ____D () C:\Users\Marcus Vogelgsang\Desktop\Motorsport
2014-04-26 08:43 - 2014-04-26 08:43 - 00001747 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-04-26 08:43 - 2014-04-26 08:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-04-26 08:42 - 2014-04-26 08:42 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-04-26 08:42 - 2014-04-26 08:42 - 00000000 ____D () C:\Program Files\iTunes
2014-04-26 08:42 - 2014-04-26 08:42 - 00000000 ____D () C:\Program Files\iPod
2014-04-26 08:42 - 2014-04-26 08:42 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-04-26 08:41 - 2014-04-26 08:41 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Apple Computer
2014-04-26 08:41 - 2014-04-26 08:41 - 00000000 ____D () C:\Users\Default\AppData\Local\Apple Computer
2014-04-26 08:41 - 2014-04-26 08:41 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Apple Computer
2014-04-26 08:41 - 2014-04-26 08:41 - 00000000 ____D () C:\Users\Default User\AppData\Local\Apple Computer
2014-04-26 08:39 - 2014-04-26 08:39 - 00000000 ____D () C:\Program Files\Bonjour
2014-04-26 08:39 - 2014-04-26 08:39 - 00000000 ____D () C:\Program Files (x86)\Bonjour
2014-04-26 08:32 - 2009-07-14 07:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-04-25 11:30 - 2014-04-18 12:47 - 00000000 ____D () C:\Users\Marcus Vogelgsang\Documents\Peter Orth
2014-04-25 11:23 - 2014-04-25 11:23 - 00448512 _____ (OldTimer Tools) C:\Users\Marcus Vogelgsang\Downloads\TFC (1).exe
2014-04-25 11:17 - 2012-11-15 22:49 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-04-25 11:07 - 2014-04-25 11:07 - 00700980 _____ () C:\Users\Marcus Vogelgsang\Downloads\adblock_edge-2.0.7-sm+an+tb+fx-windows.xpi
2014-04-25 11:07 - 2014-04-25 11:07 - 00448512 _____ (OldTimer Tools) C:\Users\Marcus Vogelgsang\Downloads\TFC.exe
2014-04-25 11:06 - 2014-04-25 11:06 - 00537528 _____ () C:\Users\Marcus Vogelgsang\Downloads\noscript-2.6.8.20.xpi.zip
2014-04-25 11:05 - 2014-04-25 11:05 - 00001123 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-04-25 11:05 - 2014-04-25 11:05 - 00001111 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-04-25 11:05 - 2014-04-25 11:05 - 00000000 ____D () C:\Users\Marcus Vogelgsang\AppData\Local\Mozilla
2014-04-25 11:05 - 2012-11-15 22:49 - 00000000 ____D () C:\Users\Marcus Vogelgsang\AppData\Roaming\Mozilla
2014-04-25 11:05 - 2012-10-04 19:45 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-04-25 11:04 - 2014-04-25 11:04 - 00283192 _____ (Mozilla) C:\Users\Marcus Vogelgsang\Downloads\FirefoxSetupStub28.0.exe
2014-04-25 10:57 - 2014-04-25 10:57 - 00313256 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-04-25 10:57 - 2014-04-25 10:57 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-04-25 10:57 - 2014-04-25 10:57 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-04-25 10:57 - 2014-04-25 10:57 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2014-04-25 10:55 - 2014-04-25 10:55 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-04-25 10:55 - 2014-04-25 10:55 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-04-25 10:55 - 2014-04-25 10:55 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-04-25 10:55 - 2014-04-25 10:55 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-04-25 10:55 - 2014-04-25 10:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-04-25 10:55 - 2012-11-02 08:26 - 00000000 ____D () C:\Program Files (x86)\Java
2014-04-25 10:52 - 2012-04-06 22:04 - 00000000 ____D () C:\ProgramData\Apple
2014-04-25 10:42 - 2014-04-25 10:42 - 00001066 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-04-25 10:42 - 2014-04-25 10:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-04-25 10:42 - 2014-04-25 10:42 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-04-25 10:42 - 2014-04-25 10:41 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Marcus Vogelgsang\Downloads\mbam-setup-2.0.1.1004 (1).exe
2014-04-25 10:41 - 2014-04-25 10:41 - 00001033 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Secunia PSI.lnk
2014-04-25 10:41 - 2014-04-25 10:41 - 00000000 ____D () C:\Users\Marcus Vogelgsang\AppData\Local\Secunia PSI
2014-04-25 10:41 - 2014-04-25 10:41 - 00000000 ____D () C:\Program Files (x86)\Secunia
2014-04-25 10:41 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
2014-04-25 10:40 - 2014-04-25 10:40 - 05329480 _____ (Secunia) C:\Users\Marcus Vogelgsang\Downloads\PSISetup_3.0.0.9016.exe
2014-04-25 10:35 - 2014-04-25 10:34 - 00001738 _____ () C:\DelFix.txt
2014-04-25 10:34 - 2014-04-20 09:21 - 00000000 ____D () C:\Windows\ERUNT
2014-04-25 10:34 - 2014-04-19 14:48 - 00000000 ____D () C:\Windows\erdnt
2014-04-24 08:29 - 2014-04-22 22:46 - 00000000 ____D () C:\Users\Marcus Vogelgsang\Downloads\FRST-OlderVersion
2014-04-21 21:26 - 2014-04-21 21:25 - 00004161 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log
2014-04-21 21:26 - 2013-12-17 11:37 - 00000000 ____D () C:\ProgramData\Oracle
2014-04-20 09:31 - 2012-04-06 23:00 - 01307298 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-04-20 09:16 - 2012-03-23 22:44 - 00000000 ____D () C:\Users\Marcus Vogelgsang
2014-04-20 08:52 - 2014-04-20 08:51 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Marcus Vogelgsang\Downloads\mbam-setup-2.0.1.1004.exe
2014-04-19 15:31 - 2014-04-19 15:31 - 00848856 _____ (Panda Security ) C:\Users\Marcus Vogelgsang\Downloads\USBVaccineSetup (1).exe
2014-04-19 14:55 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-04-19 14:43 - 2014-04-19 14:43 - 00848856 _____ (Panda Security ) C:\Users\Marcus Vogelgsang\Downloads\USBVaccineSetup.exe
2014-04-19 14:43 - 2014-04-19 14:43 - 00003042 _____ () C:\Windows\System32\Tasks\PandaUSBVaccine
2014-04-18 22:52 - 2014-04-18 22:52 - 00000000 ____D () C:\Users\Marcus Vogelgsang\AppData\Roaming\DropboxMaster
2014-04-18 22:52 - 2012-10-13 12:03 - 00001064 _____ () C:\Users\Marcus Vogelgsang\Desktop\Dropbox.lnk
2014-04-18 22:52 - 2012-10-13 12:02 - 00000000 ____D () C:\Users\Marcus Vogelgsang\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-04-18 22:51 - 2014-04-18 22:51 - 00315984 _____ (Dropbox, Inc.) C:\Users\Marcus Vogelgsang\Downloads\DropboxInstaller.exe
2014-04-18 22:00 - 2014-04-18 22:00 - 00000000 ____D () C:\Users\Marcus Vogelgsang\Documents\BW-Bank
2014-04-18 19:09 - 2011-10-20 10:18 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-04-18 19:01 - 2012-03-23 22:48 - 00000000 ___RD () C:\Users\Marcus Vogelgsang\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-04-18 19:00 - 2013-02-07 22:11 - 00000000 ____D () C:\Program Files (x86)\VideoLAN
2014-04-18 18:05 - 2014-04-18 18:05 - 00000043 _____ () C:\Users\Marcus Vogelgsang\AppData\Roaming\WB.CFG
2014-04-18 17:05 - 2014-04-18 17:05 - 00003378 _____ () C:\Windows\System32\Tasks\pricemeterdownloader
2014-04-18 17:05 - 2014-04-18 17:05 - 00003300 _____ () C:\Windows\System32\Tasks\PriceMeterUpdater
2014-04-18 15:39 - 2014-04-18 15:39 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-18 14:22 - 2013-08-26 10:01 - 00000000 ____D () C:\Users\Marcus Vogelgsang\AppData\Local\avgchrome
2014-04-18 12:42 - 2013-10-13 18:01 - 00000000 ____D () C:\ProgramData\AVG2014
2014-04-18 12:42 - 2013-10-13 17:59 - 00000000 ____D () C:\ProgramData\MFAData
2014-04-18 12:40 - 2014-04-18 12:40 - 00001970 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-04-18 12:40 - 2014-04-18 12:40 - 00000000 ____D () C:\Users\Marcus Vogelgsang\AppData\Roaming\AVAST Software
2014-04-18 12:40 - 2014-04-18 12:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast
2014-04-18 12:38 - 2014-04-18 12:38 - 00000000 ____D () C:\Program Files (x86)\Siber Systems
2014-04-18 12:37 - 2014-04-18 12:37 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2014-04-18 12:37 - 2014-04-18 12:37 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2014-04-18 12:37 - 2014-04-18 12:37 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-04-18 12:37 - 2014-04-18 12:37 - 00208928 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-04-18 12:37 - 2014-04-18 12:37 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-04-18 12:37 - 2014-04-18 12:37 - 00084816 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2014-04-18 12:37 - 2014-04-18 12:37 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-04-18 12:37 - 2014-04-18 12:37 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-04-18 12:37 - 2014-04-18 12:37 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-04-18 12:36 - 2014-04-18 12:36 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-04-18 12:36 - 2014-04-18 12:36 - 00000000 ____D () C:\Program Files\AVAST Software
2014-04-18 12:35 - 2014-04-18 12:31 - 88551496 _____ (AVAST Software) C:\Users\Marcus Vogelgsang\Downloads\avast_free_antivirus_setup_9.0.2016.exe
2014-04-18 12:31 - 2014-04-18 12:31 - 00002062 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk
2014-04-18 12:31 - 2014-04-18 12:31 - 00002050 _____ () C:\Users\Public\Desktop\Mozilla Thunderbird.lnk
2014-04-18 12:31 - 2014-04-18 12:31 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-04-18 12:30 - 2014-04-18 12:29 - 21987424 _____ (Mozilla) C:\Users\Marcus Vogelgsang\Downloads\Thunderbird Setup 24.4.0.exe
2014-04-18 12:19 - 2013-10-02 09:28 - 00000000 ____D () C:\Users\Marcus Vogelgsang\Desktop\DTM
2014-04-18 12:17 - 2013-06-29 20:41 - 00000000 ____D () C:\Users\Marcus Vogelgsang\Desktop\Musik
2014-04-12 14:19 - 2013-01-15 11:30 - 00000000 ____D () C:\Users\Marcus Vogelgsang\Documents\PdfGrabber
2014-04-12 10:19 - 2012-05-19 11:16 - 00000000 ____D () C:\Users\Marcus Vogelgsang\Documents\AD_LUMIX
2014-04-12 10:19 - 2011-01-01 00:00 - 00000000 ____D () C:\Users\Marcus Vogelgsang\Documents\DCIM
2014-04-12 09:01 - 2014-04-11 16:31 - 00000000 ____D () C:\Users\Marcus Vogelgsang\Documents\BHH2014Unfall
2014-04-12 09:01 - 2014-02-26 18:39 - 00000000 ____D () C:\Users\Marcus Vogelgsang\AppData\Local\Windows Live
2014-04-11 14:06 - 2014-04-11 14:06 - 00000000 __SHD () C:\Users\Marcus Vogelgsang\AppData\Local\EmieUserList
2014-04-11 14:06 - 2014-04-11 14:06 - 00000000 __SHD () C:\Users\Marcus Vogelgsang\AppData\Local\EmieSiteList
2014-04-11 10:51 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-04-11 07:46 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-04-10 17:59 - 2009-07-14 04:34 - 00000566 _____ () C:\Windows\win.ini
2014-04-10 17:58 - 2013-08-14 22:11 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-10 17:58 - 2012-04-08 21:53 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-04-10 17:56 - 2012-04-09 21:47 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-04-10 15:11 - 2014-04-10 15:05 - 00004128 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-04-10 15:11 - 2014-04-10 15:05 - 00003876 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-04-10 15:05 - 2014-04-10 15:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-04-10 15:05 - 2012-04-06 22:18 - 00000000 ____D () C:\Program Files (x86)\Google
2014-04-10 15:04 - 2012-04-06 22:17 - 00000000 ____D () C:\Users\Marcus Vogelgsang\AppData\Local\Deployment
2014-04-10 15:00 - 2012-04-06 22:18 - 00000000 ____D () C:\Program Files\Google
2014-04-10 14:56 - 2012-04-06 22:18 - 00000000 ____D () C:\Users\Marcus Vogelgsang\AppData\Local\Google
2014-04-10 13:08 - 2014-04-10 13:08 - 00000000 ____D () C:\Users\Marcus Vogelgsang\AppData\Local\TB
2014-04-03 09:51 - 2014-04-25 10:42 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-03 09:51 - 2014-04-25 10:42 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-03 09:50 - 2014-04-25 10:42 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

Some content of TEMP:
====================
C:\Users\Marcus Vogelgsang\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpksymls.dll


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-04-19 16:35

==================== End Of Log ============================
--- --- ---
Alt 02.05.2014, 16:37   #28
schrauber
/// the machine
/// TB-Ausbilder
 
Mein Laptop legt Verknüpfungen am USB Stick an - Standard

Mein Laptop legt Verknüpfungen am USB Stick an


Ok ich seh schon, müssen wir von aussen ran.

Scan mit Farbar's Recovery Scan Tool (Recovery Mode - Windows Vista, 7, 8)
Hinweise für Windows 8-Nutzer: Anleitung 1 (FRST-Variante) und Anleitung 2 (zweiter Teil)
  • Downloade dir bitte die passende Version des Tools (im Zweifel beide) und speichere diese auf einen USB Stick: FRST Download FRST 32-Bit | FRST 64-Bit
  • Schließe den USB Stick an das infizierte System an und boote das System in die System Reparatur Option.
  • Scanne jetzt nach der bebilderten Anleitung oder verwende die folgende Kurzanleitung:
Über den Boot Manager:
  • Starte den Rechner neu.
  • Während dem Hochfahren drücke mehrmals die F8 Taste
  • Wähle nun Computer reparieren.
  • Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".
Mit Windows CD/DVD (auch bei Windows 8 möglich):
  • Lege die Windows CD in dein Laufwerk.
  • Starte den Rechner neu und starte von der CD.
  • Wähle die Spracheinstellungen und klicke "Weiter".
  • Klicke auf Computerreparaturoptionen !
  • Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".
Wähle in den Reparaturoptionen: Eingabeaufforderung
  • Gib nun bitte notepad ein und drücke Enter.
  • Im öffnenden Textdokument: Datei > Speichern unter... und wähle Computer.
    Hier wird dir der Laufwerksbuchstabe deines USB Sticks angezeigt, merke ihn dir.
  • Schließe Notepad wieder
  • Gib nun bitte folgenden Befehl ein.
    e:\frst.exe bzw. e:\frst64.exe
    Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks, den du dir gemerkt hast. Gegebenfalls anpassen.
  • Akzeptiere den Disclaimer mit Ja und klicke Untersuchen
Das Tool erstellt eine FRST.txt auf deinem USB Stick. Poste den Inhalt bitte hier nach Möglichkeit in Code-Tags (Anleitung).

__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 06.05.2014, 07:56   #29
Marcus.V
 
Mein Laptop legt Verknüpfungen am USB Stick an - Standard

Mein Laptop legt Verknüpfungen am USB Stick an


Habe keine CD das System ist auf dem PC Gespeichert.

Habe Windows 7

Alt 07.05.2014, 06:16   #30
schrauber
/// the machine
/// TB-Ausbilder
 
Mein Laptop legt Verknüpfungen am USB Stick an - Standard

Mein Laptop legt Verknüpfungen am USB Stick an


Die Funktion über den Bootmanager geht nicht?
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Antwort
Seite 2 von 2 1 2

Themen zu Mein Laptop legt Verknüpfungen am USB Stick an
daten, gen, hallo zusammen, laptop, lnk/agent.ak, selbsständig, sensible, stick, trojaner, usb, usb stick, verknüpfungen, virus, win32/adware.yontoo.a, win32/adware.yontoo.b, zusammen


« Ich weiß nicht mehr weiter :-( | Ad by Browser Extension »


Ähnliche Themen: Mein Laptop legt Verknüpfungen am USB Stick an


  1. Nur Verknüpfungen auf USB Stick und Ständig POP UP Werbung auf dem Laptop
    Plagegeister aller Art und deren Bekämpfung - 29.06.2015 (8)
  2. WLAN Stick legt Monitor lahm
    Netzwerk und Hardware - 06.06.2015 (9)
  3. USB-Stick nur noch mit Verknüpfungen
    Log-Analyse und Auswertung - 01.05.2015 (13)
  4. WIN 7: USB Stick beinhaltet nur Verknüpfungen!
    Plagegeister aller Art und deren Bekämpfung - 22.04.2015 (18)
  5. Mein USB-Stick zeigt nur noch Verknüpfungen an und ein unbekanntes Programm möchte Änderungen an meinem Computer vornehmen
    Plagegeister aller Art und deren Bekämpfung - 21.04.2015 (24)
  6. Windows 8.1: Nur Verknüpfungen auf USB-Stick
    Log-Analyse und Auswertung - 19.04.2015 (34)
  7. USB-Stick zeigt nur noch Verknüpfungen an
    Plagegeister aller Art und deren Bekämpfung - 04.02.2015 (17)
  8. Windows 7: Auf USB-Stick gezogene Dateien werden zu Verknüpfungen - 2. Laptop
    Plagegeister aller Art und deren Bekämpfung - 25.09.2014 (11)
  9. VBS Jenxcus - Nur Verknüpfungen auf USB-Stick
    Plagegeister aller Art und deren Bekämpfung - 05.08.2014 (2)
  10. USB Stick: Verknüpfungen Windows 8.0
    Plagegeister aller Art und deren Bekämpfung - 24.01.2014 (13)
  11. Nur noch Verknüpfungen auf USB-STick
    Plagegeister aller Art und deren Bekämpfung - 14.11.2013 (33)
  12. USB Stick zeigt nur Verknüpfungen
    Plagegeister aller Art und deren Bekämpfung - 29.04.2013 (20)
  13. Extern USB Stick Verknüpfungen
    Plagegeister aller Art und deren Bekämpfung - 02.04.2012 (25)
  14. USB Stick erstellt nur Verknüpfungen
    Plagegeister aller Art und deren Bekämpfung - 17.12.2011 (10)
  15. Nur noch Verknüpfungen auf USB-Stick/CF-Karten
    Log-Analyse und Auswertung - 23.11.2011 (2)
  16. winsvc.exe - Laptop befallen - Auf USB- Stick nur noch Verknüpfungen
    Log-Analyse und Auswertung - 15.11.2011 (28)
  17. USB Stick zeigt nur noch Verknüpfungen an
    Log-Analyse und Auswertung - 08.11.2011 (31)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema Mein Laptop legt Verknüpfungen am USB Stick an - FRST Logfile: Code: Alles auswählen Aufklappen ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-04-2014 Ran by Marcus Vogelgsang (administrator) on MARCUSVOGELGSAN on 24-04-2014 14:38:39 Running from - Mein Laptop legt Verknüpfungen am USB Stick an...
Archiv
Du betrachtest: Mein Laptop legt Verknüpfungen am USB Stick an auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55