| |
| |||||||
Log-Analyse und Auswertung: Windwos 7: Backdoor.Agent.DCEGen, Trojan.Delf und noch ordentlich MalwareWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
04.05.2014, 00:40
| #1 |
| |  Windwos 7: Backdoor.Agent.DCEGen, Trojan.Delf und noch ordentlich Malware Hallo TB-Team, ich hab hier ein verseuchtes Notebook und brauch beim reinigen eure Hilfe. Eigentlich ist nur ein Problem mit dem Mauscursor aufgetreten, der von alleine immer nach oben oder nach unten gedriftet ist. Man konnte mit dem Touchpad auch nicht wirklich gegensteuern. Habe vorhin MWB laufen lassen und da hat sich schon ein bisschen angesammelt. FRST und GMER Log files sind auch anbei. Vielen Dank schonmal! Malwarebytes: Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Scan Date: 04.05.2014 Scan Time: 00:02:15 Logfile: log.txt Administrator: Yes Version: 2.00.1.1004 Malware Database: v2014.05.03.06 Rootkit Database: v2014.03.27.01 License: Free Malware Protection: Disabled Malicious Website Protection: Disabled Chameleon: Disabled OS: Windows 7 Service Pack 1 CPU: x86 File System: NTFS User: ***** Scan Type: Threat Scan Result: Completed Objects Scanned: 331617 Time Elapsed: 32 min, 6 sec Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Disabled Shuriken: Enabled PUP: Enabled PUM: Enabled Processes: 0 (No malicious items detected) Modules: 0 (No malicious items detected) Registry Keys: 5 Malware.Trace, HKU\S-1-5-21-1313351843-3303109176-4145949557-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\DC3_FEXEC, , [b250c18ce497d165e059101f2cd7916f], PUP.Optional.PriceGong.A, HKU\S-1-5-21-1313351843-3303109176-4145949557-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\PriceGong, , [c04275d86b10f145df38e0a7ca386898], PUP.Optional.Softonic.A, HKU\S-1-5-21-1313351843-3303109176-4145949557-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SOFTONIC\Universal Downloader, , [25dde7660d6e25110dfda3d8778b18e8], PUP.Optional.PriceGong.A, HKU\S-1-5-21-1313351843-3303109176-4145949557-1006-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\PriceGong, , [f60c6ae3601b74c2e1366324bb479f61], PUP.Optional.PriceGong.A, HKU\S-1-5-21-1313351843-3303109176-4145949557-501-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\PriceGong, , [6a98212c2b507abc888fb1d6ba48c23e], Registry Values: 1 Backdoor.Agent.DCEGen, HKU\S-1-5-21-1313351843-3303109176-4145949557-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|HP Notebook Management, C:\Windows\system32\MSDCSC\hpnbmgmt.exe, , [a55d430ad7a4c76f905705889072728e] Registry Data: 2 Hijack.UserInit, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON|Userinit, C:\Windows\system32\userinit.exe,C:\Windows\system32\MSDCSC\hpnbmgmt.exe, Good: (userinit.exe), Bad: (C:\Windows\system32\userinit.exe,C:\Windows\system32\MSDCSC\hpnbmgmt.exe),,[c33fc687f78464d265e11f13c63e3fc1] PUP.Optional.Conduit, HKU\S-1-5-21-1313351843-3303109176-4145949557-501-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://search.conduit.com?SearchSource=10&ctid=CT2269050, Good: (hxxp://www.google.com), Bad: (hxxp://search.conduit.com?SearchSource=10&ctid=CT2269050),,[04fe64e9c7b47abcd7c1083022e2966a] Folders: 3 Stolen.Data, C:\Users\*****\AppData\Roaming\dclogs, , [5fa3ff4e6a119a9c7a835a03a55ea35d], PUP.Optional.Conduit.A, C:\Users\*****\AppData\Local\Temp\ct2269050, , [b0521637accf6cca67c6d79106fcf709], PUP.Optional.Conduit.A, C:\Users\*****\AppData\Local\Temp\ct2269050\xpi, , [b0521637accf6cca67c6d79106fcf709], Files: 13 Trojan.Delf, C:\Users\*****\AppData\Roaming\install\winupdater.exe, , [3ac868e575060f27fa7c207f04fc4cb4], PUP.Optional.OpenCandy, C:\Users\*****\AppData\Local\Temp\is-O8N12.tmp\OCSetupHlp.dll, , [966c301d1d5edc5a3fa15309a163dc24], PUP.Optional.Conduit, C:\Users\*****\AppData\Local\Temp\ct2269050\ieLogic.exe, , [c43e61ece893b87e96e84ee129d7e41c], Stolen.Data, C:\Users\*****\AppData\Roaming\dclogs\2013-08-14-4.dc, , [5fa3ff4e6a119a9c7a835a03a55ea35d], Stolen.Data, C:\Users\*****\AppData\Roaming\dclogs\2013-08-15-5.dc, , [5fa3ff4e6a119a9c7a835a03a55ea35d], Stolen.Data, C:\Users\*****\AppData\Roaming\dclogs\2013-08-20-3.dc, , [5fa3ff4e6a119a9c7a835a03a55ea35d], Trojan.Agent.Gen, C:\Users\*****\AppData\Roaming\*****-wchelper.dll, , [ca381d303447072f29f99ae747bc09f7], PUP.Optional.Conduit.A, C:\Users\*****\AppData\Local\Temp\ct2269050\CT2269050.xpi, , [b0521637accf6cca67c6d79106fcf709], PUP.Optional.Conduit.A, C:\Users\*****\AppData\Local\Temp\ct2269050\ffLogic.exe, , [b0521637accf6cca67c6d79106fcf709], PUP.Optional.Conduit.A, C:\Users\*****\AppData\Local\Temp\ct2269050\statisticsStub.exe, , [b0521637accf6cca67c6d79106fcf709], PUP.Optional.Conduit.A, C:\Users\*****\AppData\Local\Temp\ct2269050\xpi\install.rdf, , [b0521637accf6cca67c6d79106fcf709], PUP.Optional.Conduit.A, C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\g1vlkkbs.default\prefs.js, Good: (), Bad: (user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}");), ,[3bc7004d9ddecf67561aec79a361dc24] PUP.Optional.Conduit.A, C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\g1vlkkbs.default\prefs.js, Good: (), Bad: (user_pref("CT2269050.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&q=");), ,[33cf87c6007b9e98dd948ed7976df50b] Physical Sectors: 0 (No malicious items detected) (end) Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:01-05-2014
Ran by ***** (administrator) on ***** on 04-05-2014 00:38:03
Running from C:\Users\***** \Downloads
Microsoft Windows 7 Professional Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv.exe
(Hewlett-Packard) C:\Windows\System32\hpservice.exe
(Validity Sensors, Inc.) C:\Windows\System32\vcsFPService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(ArcSoft Inc.) C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AEstSrv.exe
(LSI Corporation) C:\Program Files\LSI SoftModem\agrsmsvc.exe
() C:\Program Files\ALDITALKVerbindungsassistent\ALDITALKVerbindungsassistent_Service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(AVM Berlin) C:\Program Files\avmwlanstick\WLanNetService.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Cisco Systems, Inc.) C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
( ) C:\Windows\System32\dkabcoms.exe
(Teruten) C:\Windows\System32\FsUsbExService.Exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.EXE
(Motorola Mobility LLC) C:\Program Files\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe
(pdfforge GmbH) C:\Program Files\PDF Architect\HelperService.exe
(pdfforge GmbH) C:\Program Files\PDF Architect\ConversionService.exe
(Protexis Inc.) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
(Motorola) C:\Program Files\Motorola\MotForwardDaemon\ForwardDaemon.exe
() C:\Program Files\MTN Internet\AssistantServices.exe
() C:\Program Files\Verbindungsassistent\WTGService.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMON.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Motorola Mobility LLC) C:\Program Files\Motorola Mobility\Motorola Device Manager\MotoHelperAgent.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.EXE
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jucheck.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1578280 2009-10-10] (Synaptics Incorporated)
HKLM\...\Run: [NPSStartup] => [X]
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-28] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray.exe [495708 2010-09-08] (IDT, Inc.)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
Winlogon\Notify\ScCertProp: wlnotify.dll [X]
HKLM\...\Policies\Explorer\Run: [Updates] => C:\system32\SystemProtection.exe [141824 2013-10-12] ( (Microsoft Corporation))
HKU\S-1-5-21-1313351843-3303109176-4145949557-1001\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [354304 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-21-1313351843-3303109176-4145949557-1001\...\MountPoints2: {03b61ceb-1ffd-11e0-8aa9-002713a6f0ec} - H:\pushinst.exe
HKU\S-1-5-21-1313351843-3303109176-4145949557-1001\...\MountPoints2: {20d7571f-8d20-11e0-8c45-002713a6f0ec} - I:\LaunchU3.exe -a
HKU\S-1-5-21-1313351843-3303109176-4145949557-1001\...\MountPoints2: {5f33cbd1-e23a-11e1-9a89-002713a6f0ec} - I:\AutoRun.exe
HKU\S-1-5-21-1313351843-3303109176-4145949557-1001\...\MountPoints2: {5f33cbee-e23a-11e1-9a89-002713a6f0ec} - I:\AutoRun.exe
HKU\S-1-5-21-1313351843-3303109176-4145949557-1001\...\MountPoints2: {5f33cc04-e23a-11e1-9a89-002713a6f0ec} - H:\AutoRun.exe
HKU\S-1-5-21-1313351843-3303109176-4145949557-1001\...\MountPoints2: {5f3bd669-e2e3-11e1-99f2-002713a6f0ec} - I:\AutoRun.exe
HKU\S-1-5-21-1313351843-3303109176-4145949557-1001\...\MountPoints2: {5f3bd66e-e2e3-11e1-99f2-002713a6f0ec} - H:\AutoRun.exe
HKU\S-1-5-21-1313351843-3303109176-4145949557-1001\...\MountPoints2: {5f3bd6ae-e2e3-11e1-99f2-705ab6a0d29b} - H:\AutoRun.exe
HKU\S-1-5-21-1313351843-3303109176-4145949557-1001\...\MountPoints2: {5f3bd6b2-e2e3-11e1-99f2-705ab6a0d29b} - H:\AutoRun.exe
HKU\S-1-5-21-1313351843-3303109176-4145949557-1001\...\MountPoints2: {72494687-e2dd-11e1-89b8-002713a6f0ec} - I:\AutoRun.exe
HKU\S-1-5-21-1313351843-3303109176-4145949557-1001\...\MountPoints2: {732d4230-bdff-11e2-8700-002713a6f0ec} - H:\MotorolaDeviceManagerSetup.exe -a
HKU\S-1-5-21-1313351843-3303109176-4145949557-1001\...\MountPoints2: {7654d8bd-264d-11e0-a079-002713a6f0ec} - H:\pushinst.exe
HKU\S-1-5-21-1313351843-3303109176-4145949557-1001\...\MountPoints2: {99e60995-5118-11e1-bcba-002713a6f0ec} - H:\LaunchU3.exe -a
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.search-results.com/?l=dis&o=41648036
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x3338F3DED2B3CB01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
URLSearchHook: HKCU - (No Name) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - No File
SearchScopes: HKLM - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050
SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050
SearchScopes: HKCU - {C7576B9D-B442-46bc-AF74-080A9E723E01} URL = hxxp://websearch.search-results.com/redirect?client=ie&tb=STC-SRS&o=41648033&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=96&apn_dtid=YYYYYYYYDE&apn_uid=9A2A31B8-7A41-4E8A-9DEE-494104803222&apn_sauid=2E84504C-3655-48A0-9FD2-B28BEAC9CCDD
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files\PDF Architect\PDFIEHelper.dll (pdfforge GmbH)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - PDF Architect Toolbar - {25A3A431-30BB-47C8-AD6A-E1063801134F} - C:\Program Files\PDF Architect\PDFIEPlugin.dll (pdfforge GmbH)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKCU - No Name - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - No File
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{5AF65354-03AE-46C4-817B-B72FDF84E827}: [NameServer]134.147.222.4,134.147.32.4
FireFox:
========
FF ProfilePath: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\g1vlkkbs.default
FF user.js: detected! => C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\g1vlkkbs.default\user.js
FF SearchEngineOrder.1: Search-Results
FF Homepage: hxxp://ard.de/
FF NetworkProxy: "no_proxies_on", "fritz.box"
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF Plugin: @garmin.com/GpsControl - C:\Program Files\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @RIM.com/WebSLLauncher,version=1.0 - C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npnul32.dll (mozilla.org)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
FF Extension: DVDVideoSoftTB Community Toolbar - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\g1vlkkbs.default\Extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5} [2012-01-07]
FF Extension: Free YouTube Download (Free Studio) Menu - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\g1vlkkbs.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2012-01-07]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} [2011-03-23]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} [2011-06-22]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} [2012-04-17]
FF HKLM\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files\PDF Architect\FFPDFArchitectExt [2013-07-28]
Chrome:
=======
CHR HomePage: hxxp://internacional.elpais.com/
CHR StartupUrls: "hxxp://dict.leo.org/esde?lang=de&lp=esde", "hxxp://internacional.elpais.com/"
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\34.0.1847.131\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\34.0.1847.131\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\34.0.1847.131\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
CHR Plugin: (Skype Toolbars) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.9.0.9216_0\npSkypeChromePlugin.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java Deployment Toolkit 6.0.310.5) - C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U31) - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll No File
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll No File
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll No File
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll No File
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll No File
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll No File
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll No File
CHR Plugin: (RIM Handheld Application Loader) - C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
CHR Plugin: (Garmin Communicator Plug-In) - C:\Program Files\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Extension: (YouTube) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2011-12-15]
CHR Extension: (Adblock Plus) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2013-01-03]
CHR Extension: (Google-Suche) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2011-12-15]
CHR Extension: (DVDVideoSoft Browser Extension) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp [2012-11-26]
CHR Extension: (Google Wallet) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-02]
CHR Extension: (Google Mail) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2011-12-15]
CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Users\*****\AppData\Roaming\DVDVideoSoft\DVDVideoSoftBrowserExtension.crx [2012-11-19]
========================== Services (Whitelisted) =================
R2 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 AgereModemAudio; C:\Program Files\LSI SoftModem\agrsmsvc.exe [14336 2009-08-03] (LSI Corporation)
R2 ALDITALKVerbindungsassistent_Service; C:\Program Files\ALDITALKVerbindungsassistent\ALDITALKVerbindungsassistent_Service.exe [343024 2012-08-20] ()
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440400 2014-02-28] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-28] (Avira Operations GmbH & Co. KG)
R2 AVM WLAN Connection Service; C:\Program Files\avmwlanstick\WlanNetService.exe [364544 2008-02-25] (AVM Berlin)
R2 CVPND; C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe [1528624 2009-11-17] (Cisco Systems, Inc.)
R2 dkab_device; C:\Windows\system32\DKabcoms.exe [603376 2009-06-09] ( )
R2 Motorola Device Manager; C:\Program Files\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe [137528 2013-11-15] (Motorola Mobility LLC)
R2 PDF Architect Helper Service; C:\Program Files\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
R2 PDF Architect Service; C:\Program Files\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)
R2 PST Service; C:\Program Files\Motorola\MotForwardDaemon\ForwardDaemon.exe [65657 2011-09-02] (Motorola)
R2 STacSV; C:\Program Files\IDT\WDM\STacSV.exe [254034 2010-09-08] (IDT, Inc.)
R2 UI Assistant Service; C:\Program Files\MTN Internet\AssistantServices.exe [271696 2012-03-06] ()
R2 vcsFPService; C:\Windows\system32\vcsFPService.exe [1639728 2009-10-21] (Validity Sensors, Inc.)
R2 WTGService; C:\Program Files\Verbindungsassistent\WTGService.exe [296400 2009-03-03] ()
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-12-23] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135648 2013-12-23] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-27] (Avira Operations GmbH & Co. KG)
S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [4352 2007-11-07] (AVM Berlin)
S3 CVirtA; C:\Windows\System32\DRIVERS\CVirtA.sys [5275 2007-01-18] (Cisco Systems, Inc.)
R2 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [308859 2009-11-17] (Cisco Systems, Inc.)
R3 DNE; C:\Windows\System32\DRIVERS\dne2000.sys [131984 2008-11-16] (Deterministic Networks, Inc.)
R3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2010-06-14] ()
S3 fwlanusbn; C:\Windows\System32\DRIVERS\fwlanusbn.sys [401920 2007-12-19] (AVM GmbH)
S3 GKUPRO2D; C:\Windows\System32\Drivers\GKUPRO2D.sys [71168 2005-02-18] (Gemplus)
S3 massfilter; C:\Windows\System32\drivers\massfilter.sys [9216 2011-05-20] (MBB Incorporated)
S3 OXSDIDRV_x32; C:\Windows\System32\DRIVERS\OXSDIDRV_x32.sys [52656 2009-09-28] ()
S3 OXUDIDRV; C:\Windows\system32\Drivers\OXUDIDRV_X32.sys [24880 2010-05-25] ()
S3 risdpcie; C:\Windows\system32\DRIVERS\risdpe86.sys [47616 2009-10-28] (REDC)
R3 rismc32; C:\Windows\System32\DRIVERS\rismc32.sys [49152 2009-07-20] (RICOH Company, Ltd.)
S3 rixdpcie; C:\Windows\system32\DRIVERS\rixdpe86.sys [38912 2009-09-28] (REDC)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1765168 2009-09-17] ()
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-08-05] (Avira GmbH)
S3 ss_bbus; C:\Windows\System32\DRIVERS\ss_bbus.sys [98432 2010-04-27] (MCCI)
S3 ss_bmdfl; C:\Windows\System32\DRIVERS\ss_bmdfl.sys [14848 2010-04-27] (MCCI Corporation)
S3 ss_bmdm; C:\Windows\System32\DRIVERS\ss_bmdm.sys [123648 2010-04-27] (MCCI Corporation)
U0 vhsps; C:\Windows\System32\drivers\ifnhodf.sys [52440 2014-05-04] (Malwarebytes Corporation)
S3 flpydisk; \SystemRoot\system32\DRIVERS\flpydisk.sys [X]
S3 motccgpfl; system32\DRIVERS\motccgpfl.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-05-04 00:38 - 2014-05-04 00:38 - 00020512 _____ () C:\Users\*****\Downloads\FRST.txt
2014-05-04 00:37 - 2014-05-04 00:38 - 00000000 ____D () C:\FRST
2014-05-04 00:37 - 2014-05-04 00:37 - 00000466 _____ () C:\Users\*****\Downloads\defogger_disable.log
2014-05-04 00:37 - 2014-05-04 00:37 - 00000000 _____ () C:\Users\*****\defogger_reenable
2014-05-04 00:36 - 2014-05-04 00:36 - 01050624 _____ (Farbar) C:\Users\*****\Downloads\FRST.exe
2014-05-04 00:36 - 2014-05-04 00:36 - 00380416 _____ () C:\Users\*****\Downloads\vdolc97y.exe
2014-05-04 00:36 - 2014-05-04 00:36 - 00009850 _____ () C:\Users\*****\Desktop\Mappe1.xlsx
2014-05-04 00:35 - 2014-05-04 00:35 - 00050477 _____ () C:\Users\*****\Downloads\Defogger.exe
2014-05-04 00:05 - 2014-05-04 00:05 - 00052440 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\ifnhodf.sys
2014-05-03 23:28 - 2014-05-03 23:29 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-03 23:27 - 2014-05-03 23:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-05-03 23:27 - 2014-05-03 23:27 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware
2014-05-03 23:27 - 2014-04-03 09:51 - 00073432 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-03 23:27 - 2014-04-03 09:51 - 00051416 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-03 23:27 - 2014-04-03 09:50 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-03 23:22 - 2014-05-03 23:22 - 00613200 _____ (Chip Digital GmbH) C:\Users\*****\Downloads\Malwarebytes Anti Malware - CHIP-Downloader.exe
2014-04-16 22:48 - 2014-03-06 11:19 - 17387008 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-16 22:48 - 2014-03-06 10:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-16 22:48 - 2014-03-06 10:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-04-16 22:48 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-04-16 22:48 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-16 22:48 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-04-16 22:48 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-16 22:48 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-16 22:48 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-16 22:48 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-16 22:48 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-16 22:48 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-04-16 22:48 - 2014-03-06 09:38 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-04-16 22:48 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-04-16 22:48 - 2014-03-06 09:28 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-04-16 22:48 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-04-16 22:48 - 2014-03-06 09:18 - 00575488 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-16 22:48 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-04-16 22:48 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-16 22:48 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-04-16 22:48 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-16 22:48 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-04-16 22:48 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-16 22:48 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-04-16 22:48 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-16 22:48 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-16 22:28 - 2014-03-04 11:17 - 00868352 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
==================== One Month Modified Files and Folders =======
2014-05-04 00:38 - 2014-05-04 00:38 - 00020512 _____ () C:\Users\*****\Downloads\FRST.txt
2014-05-04 00:38 - 2014-05-04 00:37 - 00000000 ____D () C:\FRST
2014-05-04 00:37 - 2014-05-04 00:37 - 00000466 _____ () C:\Users\*****\Downloads\defogger_disable.log
2014-05-04 00:37 - 2014-05-04 00:37 - 00000000 _____ () C:\Users\*****\defogger_reenable
2014-05-04 00:36 - 2014-05-04 00:36 - 01050624 _____ (Farbar) C:\Users\*****\Downloads\FRST.exe
2014-05-04 00:36 - 2014-05-04 00:36 - 00380416 _____ () C:\Users\*****\Downloads\vdolc97y.exe
2014-05-04 00:36 - 2014-05-04 00:36 - 00009850 _____ () C:\Users\*****\Desktop\Mappe1.xlsx
2014-05-04 00:35 - 2014-05-04 00:35 - 00050477 _____ () C:\Users\*****\Downloads\Defogger.exe
2014-05-04 00:33 - 2011-01-14 20:20 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-04 00:32 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\tracing
2014-05-04 00:14 - 2011-01-13 21:31 - 01158297 _____ () C:\Windows\WindowsUpdate.log
2014-05-04 00:05 - 2014-05-04 00:05 - 00052440 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\ifnhodf.sys
2014-05-04 00:05 - 2009-07-14 09:50 - 00000000 ____D () C:\Windows\CSC
2014-05-04 00:05 - 2005-07-03 22:15 - 00000000 ____D () C:\Users\*****\AppData\Roaming\install
2014-05-03 23:29 - 2014-05-03 23:28 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-03 23:27 - 2014-05-03 23:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-05-03 23:27 - 2014-05-03 23:27 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware
2014-05-03 23:27 - 2012-12-19 19:13 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-03 23:25 - 2009-07-14 06:34 - 00009920 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-03 23:25 - 2009-07-14 06:34 - 00009920 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-03 23:22 - 2014-05-03 23:22 - 00613200 _____ (Chip Digital GmbH) C:\Users\*****\Downloads\Malwarebytes Anti Malware - CHIP-Downloader.exe
2014-05-03 23:22 - 2011-01-12 12:32 - 00005144 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-03 23:18 - 2013-12-11 00:14 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cef5f52f0fe202.job
2014-05-03 23:17 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-03 23:17 - 2009-07-14 06:39 - 00192266 _____ () C:\Windows\setupact.log
2014-05-03 21:53 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-04-16 22:50 - 2011-01-14 00:48 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-04-16 22:47 - 2013-08-10 21:42 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-16 22:45 - 2011-04-17 15:33 - 88028728 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
Files to move or delete:
====================
C:\ProgramData\PKP_DLes.DAT
C:\ProgramData\PKP_DLet.DAT
C:\ProgramData\PKP_DLev.DAT
Some content of TEMP:
====================
C:\Users\kefi\AppData\Local\Temp\AskSLib.dll
C:\Users\*****\AppData\Local\Temp\AskSLib.dll
C:\Users\*****\AppData\Local\Temp\avgnt.exe
C:\Users\*****\AppData\Local\Temp\contentDATs.exe
C:\Users\*****\AppData\Local\Temp\DelayInst.exe
C:\Users\*****\AppData\Local\Temp\FileSystemView.dll
C:\Users\*****\AppData\Local\Temp\GoogleChromeInstaller.exe
C:\Users\*****\AppData\Local\Temp\installservice.exe
C:\Users\*****\AppData\Local\Temp\instmsi.exe
C:\Users\*****\AppData\Local\Temp\instmsiw.exe
C:\Users\*****\AppData\Local\Temp\jre-6u24-windows-i586-iftw-rv.exe
C:\Users\*****\AppData\Local\Temp\jre-6u26-windows-i586-iftw-rv.exe
C:\Users\*****\AppData\Local\Temp\jre-6u29-windows-i586-iftw-rv.exe
C:\Users\*****\AppData\Local\Temp\jre-7u7-windows-i586-iftw.exe
C:\Users\*****\AppData\Local\Temp\mfc80.dll
C:\Users\*****\AppData\Local\Temp\mfc80u.dll
C:\Users\*****\AppData\Local\Temp\mfcm80.dll
C:\Users\*****\AppData\Local\Temp\mfcm80u.dll
C:\Users\*****\AppData\Local\Temp\MotoCast_Installer_2.0309.exe
C:\Users\*****\AppData\Local\Temp\MotorolaDeviceManager_2.0405.exe
C:\Users\*****\AppData\Local\Temp\msvcm80.dll
C:\Users\*****\AppData\Local\Temp\msvcp80.dll
C:\Users\*****\AppData\Local\Temp\msvcr80.dll
C:\Users\*****\AppData\Local\Temp\ose00000.exe
C:\Users\*****\AppData\Local\Temp\OSU.exe
C:\Users\*****\AppData\Local\Temp\search-resultsToolbarInstaller-1.9.1.0.exe
C:\Users\*****\AppData\Local\Temp\SecurityScan_Release.exe
C:\Users\*****\AppData\Local\Temp\setup.exe
C:\Users\*****\AppData\Local\Temp\SkypeSetup.exe
C:\Users\*****\AppData\Local\Temp\tbDVDV.dll
C:\Users\*****\AppData\Local\Temp\Uninstaller.exe
C:\Users\*****\AppData\Local\Temp\VersionUpdater.exe
C:\Users\*****\AppData\Local\Temp\vpnclient_setup.exe
C:\Users\*****\AppData\Local\Temp\WtgDriverInstallX.dll
C:\Users\*****\AppData\Local\Temp\WTGXMLUtil.dll
C:\Users\*****\AppData\Local\Temp\WtgZip.dll
C:\Users\*****\AppData\Local\Temp\ytb.exe
C:\Users\*****\AppData\Local\Temp\{8667B502-27D6-4215-A728-376BECFDAE90}-21.0.1180.79_21.0.1180.77_chrome_updater.exe
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-03-15 14:45
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version:01-05-2014
Ran by ****** at 2014-05-04 00:39:03
Running from C:\Users\******\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Disabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Disabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
Update for Microsoft Office 2007 (KB2508958) (HKLM\...\{91120000-0014-0000-0000-0000000FF1CE}_PROR_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version: - Microsoft)
7-Zip 9.20 (HKLM\...\7-Zip) (Version: - )
Adobe Flash Player 10 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 10.1.102.64 - Adobe Systems Incorporated)
Adobe Flash Player 11 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 11.1.102.55 - Adobe Systems Incorporated)
Adobe Reader X (10.1.3) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.3 - Adobe Systems Incorporated)
ALDI TALK Verbindungsassistent (HKLM\...\ALDITALKVerbindungsassistent) (Version: - ALDI TALK Verbindungsassistent)
ArcSoft Panorama Maker 5 (HKLM\...\{F18046C5-1C4E-4BE1-A3D6-A6F970E2E8E8}) (Version: 5.0.1.71 - ArcSoft)
ASTERICS 3.3 (HKLM\...\{F66B9ED8-DB45-4A0C-BE7B-513BE9E28226}) (Version: 3.3.0 - University Duisburg-Essen, Germany)
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.3.350 - Avira)
AVM FRITZ!WLAN (HKLM\...\AVMWLANCLI) (Version: - AVM Berlin)
BioEdit (HKLM\...\{AF6D9313-E338-48F0-9B0C-7DE20EDB99CF}) (Version: 7.0.9 - Tom Hall)
BlackBerry Desktop Software 6.1 (HKLM\...\BlackBerry_Desktop) (Version: 6.1.0.35 - Research in Motion Ltd.)
BlackBerry Desktop Software 6.1 (Version: 6.1.0.35 - Research in Motion Ltd.) Hidden
Cisco Systems VPN Client 5.0.06.0160 (HKLM\...\{21E247D4-5E27-4BEA-AA4D-19A81203FE2A}) (Version: 5.0.6 - Cisco Systems, Inc.)
Corel Graphics - Windows Shell Extension (HKLM\...\_{B6BFCD02-BA0E-41A9-9C9C-6624C4BB475F}) (Version: 15.2.0.686 - Corel Corporation)
Corel Graphics - Windows Shell Extension (Version: 15.2.686 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - BR (Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - Capture (Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - Common (Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - Connect (Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - Custom Data (Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - DE (Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - Draw (Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - EN (Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - ES (Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - Filters (Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - FontNav (Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - FR (Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - IPM (Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - IT (Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - NL (Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - PHOTO-PAINT (Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - Photozoom Plugin (Version: 15.0 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - Redist (Version: 15.0 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - Setup Files (Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - VBA (Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - VideoBrowser (Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - VSTA (Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 - WT (Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Graphics Suite X5 (Version: 15.3 - Corel Corporation) Hidden
CorelDRAW(R) Graphics Suite X5 (HKLM\...\_{CE54DCE1-E00A-4D91-ACB9-A2D916C24051}) (Version: 15.2.0.686 - Corel Corporation)
Dell Druckersoftware-Deinstallation (HKLM\...\Dell_HostCD) (Version: - Dell, Inc.)
Dropbox (HKCU\...\Dropbox) (Version: 2.0.22 - Dropbox, Inc.)
Duden Korrektor kompakt (HKLM\...\{D5B8CDB6-0F63-49BB-9E32-D0246BE90C8F}) (Version: 6.00.00 - Bibliographisches Institut & F.A. Brockhaus AG)
Duden-Bibliothek (HKLM\...\{5C81B189-5456-40C4-9313-7FE6FA6DD64C}) (Version: 5.1.0 - Bibliographisches Institut AG)
Free YouTube to MP3 Converter version 3.11.35.1031 (HKLM\...\Free YouTube to MP3 Converter_is1) (Version: 3.11.35.1031 - DVDVideoSoft Ltd.)
Garmin BaseCamp (HKLM\...\{74E69F8A-BCBB-4A0A-9361-32225755D8C3}) (Version: 3.2.2 - Garmin Ltd or its subsidiaries)
Garmin Topo España v4 (HKLM\...\{9F9E90E8-E0BD-45DF-AE19-C2B51FAAE692}) (Version: 4.0.0.0 - Garmin Ltd or its subsidiaries)
Garmin USB Drivers (HKLM\...\{65F9E1F3-A2C1-4AA9-9F33-A3AEB0255F0E}) (Version: 2.3.0.0 - Garmin Ltd or its subsidiaries)
Geneious 5.4.4 (HKLM\...\4435-7533-6274-7601) (Version: 5.4.4 - Biomatters Ltd)
Ghostscript GPL 8.64 (Msi Setup) (HKLM\...\_{06CD45E6-FF5E-4D8E-BC01-B276A90DADF2}) (Version: 8.64 - Corel Corporation)
Ghostscript GPL 8.64 (Msi Setup) (Version: 8.64 - Corel Corporation) Hidden
Google Chrome (HKLM\...\Google Chrome) (Version: 34.0.1847.131 - Google Inc.)
Google Earth (HKLM\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (Version: 1.3.23.9 - Google Inc.) Hidden
Hotfix für Microsoft Visual Studio 2007 Tools for Applications - ENU (KB947789) (HKLM\...\{8E87B944-4815-3C5E-947F-5035C9F64362}.KB947789) (Version: 1 - Microsoft Corporation)
HP 3D DriveGuard (HKLM\...\{9B6079F8-EBA2-4C55-96A6-325E8E22DF0C}) (Version: 4.0.4.1 - Hewlett-Packard)
HP ESU for Microsoft Windows 7 (HKLM\...\{1C47EEFD-ADC8-4B7C-9979-C550573B4C42}) (Version: 1.0.5.1 - Hewlett-Packard Company)
HP Integrated Module with Bluetooth wireless technology (HKLM\...\{9E9D49A4-1DF4-4138-B7DB-5D87A893088E}) (Version: 6.2.1.500 - Broadcom Corporation)
HP Quick Launch Buttons (HKLM\...\{34D2AB40-150D-475D-AE32-BD23FB5EE355}) (Version: 6.50.12.1 - Hewlett-Packard)
HP Webcam Driver (HKLM\...\{399C37FB-08AF-493B-BFED-20FBD85EDF7F}) (Version: 5.8.50009.1 - Sonix)
ICQ7.2 (HKLM\...\{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}) (Version: 7.2 - ICQ)
IDT Audio (HKLM\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6300.0 - IDT)
Intel(R) Management Engine Components (HKLM\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation)
Intel(R) Network Connections Drivers (HKLM\...\PROSet) (Version: 14.8 - Intel)
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version: - Intel Corporation)
Iomega Encryption (HKLM\...\{B8A37E68-5AC8-45A6-A037-753EF47836C5}) (Version: 1.03.0001 - Iomega an EMC Company)
IrfanView (remove only) (HKLM\...\IrfanView) (Version: 4.28 - Irfan Skiljan)
Java 7 Update 51 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.510 - Oracle)
Java Auto Updater (Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Java(TM) 6 Update 31 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83216031FF}) (Version: 6.0.310 - Oracle)
JavaFX 2.1.1 (HKLM\...\{1111706F-666A-4037-7777-211328764D10}) (Version: 2.1.1 - Oracle Corporation)
Langenscheidt Vokabeltrainer 6.0 Spanisch (HKLM\...\{249556BD-ABA8-4510-84A3-8B30B402B07C}) (Version: 6.0.0 - Langenscheidt)
Linder BIOLOGIE Genetik (HKLM\...\{BF2BC602-AE11-4C5B-91A9-B57CDB905314}) (Version: - )
LSI HDA Modem (HKLM\...\LSI Soft Modem) (Version: 2.2.96 - LSI Corporation)
Malwarebytes Anti-Malware Version 2.0.1.1004 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.1.1004 - Malwarebytes Corporation)
Microsoft .NET Framework 1.1 (HKLM\...\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}) (Version: 1.1.4322 - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{91120000-0014-0000-0000-0000000FF1CE}_PROR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (Version: - Microsoft) Hidden
Microsoft Office Access MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Outlook MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Professional 2007 (HKLM\...\PROR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Professional 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (Version: - Microsoft) Hidden
Microsoft Office Publisher MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio Tools for Applications 2.0 - ENU (HKLM\...\{AA4A4B2C-0465-3CF8-BA76-27A027D8ACAB}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual Studio Tools for Applications 2.0 Language Pack - DEU (HKLM\...\{8E87B944-4815-3C5E-947F-5035C9F64362}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual Studio Tools for Applications 2.0 Runtime (HKLM\...\{299C0434-4F4E-341F-A916-4E07AEB35E79}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual Studio Tools for Applications 2.0 Runtime Language Pack - DEU (HKLM\...\{76DAEC83-AF7B-333C-8A53-83D7C7D39199}) (Version: 9.0.30729 - Microsoft Corporation)
Motorola Device Manager (HKLM\...\{28DB8373-C1BB-444F-A427-A55585A12ED7}) (Version: 2.4.5 - Motorola Mobility)
Motorola Device Software Update (Version: 13.09.3001 - Motorola Mobility) Hidden
Motorola Mobile Drivers Installation 6.3.0 (HKLM\...\{A55747C1-4651-433D-B082-478874FF7516}) (Version: 6.3.0 - Motorola Mobility LLC)
Mozilla Firefox (3.6.23) (HKLM\...\Mozilla Firefox (3.6.23)) (Version: 3.6.23 (de) - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MTN Internet (HKLM\...\{A9E5EDA7-2E6C-49E7-924B-A32B89C24A04}) (Version: 1.0.0.1 - ZTE)
Nikon Message Center 2 (HKLM\...\{B014EE44-9197-4513-9613-71E6EB1B514E}) (Version: 2.0.1 - Nikon)
No23 Recorder (HKLM\...\{22B0E143-2B0B-435B-9F56-136A3D16065F}) (Version: 2.1.0.3 - No23)
Nokia Connectivity Cable Driver (HKLM\...\{BC4AE628-81A4-4FC6-863A-7A9BA2E2531F}) (Version: 6.80.5.1 - )
PC Connectivity Solution (HKLM\...\{AC599724-5755-48C1-ABE7-ABB857652930}) (Version: 8.15.0.0 - Nokia)
PDF Architect (HKLM\...\{064A929A-4DE8-40CF-A901-BD40C14E4D25}) (Version: 1.1.83.9982 - pdfforge GmbH)
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.7.1 - pdfforge)
Picture Control Utility (HKLM\...\{87441A59-5E64-4096-A170-14EFE67200C3}) (Version: 1.2.2 - Nikon)
QLBCASL (Version: 6.40.17.2 - Hewlett-Packard) Hidden
RemoteComms External Disk Access (HKLM\...\{04FCD5DE-1662-4F99-BDA9-C57212113EF2}) (Version: 1.25.0003 - PLX Technology)
RICOH Media Driver (HKLM\...\{F5CC2EF8-20A4-4366-A681-3FE849E65809}) (Version: 2.13.00.05 - RICOH)
RUBICon (HKLM\...\{5A1084A3-79B7-480C-9275-D8AA0CCEFA52}) (Version: 2.0.24 - RUB)
Samsung Mobile phone USB driver Drive Software (HKLM\...\Samsung Mobile phone USB driver Drive) (Version: - )
Samsung New PC Studio (HKLM\...\InstallShield_{F193FC0E-9E18-40FC-A974-509A1BDD240A}) (Version: 1.00.0000 - Samsung Electronics Co., Ltd.)
Samsung New PC Studio (Version: 1.00.0000 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.3.650.0 - SAMSUNG Electronics Co., Ltd.)
SamsungConnectivityCableDriver (HKLM\...\{7E84FAC8-C518-40F9-9807-7455301D6D25}) (Version: 6.83.6.2.1 - Samsung)
Sequencher 4.10.1 Demo (HKLM\...\{38B10B3D-CDBE-4560-BA5A-A6C33D1B6802}) (Version: 4.10.1 - Gene Codes Corporation)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 14.0.10.0 - Synaptics Incorporated)
Uninstall 1.0.0.1 (HKLM\...\Uninstall_is1) (Version: - )
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{91120000-0014-0000-0000-0000000FF1CE}_PROR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM\...\{91120000-0014-0000-0000-0000000FF1CE}_PROR_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM\...\{91120000-0014-0000-0000-0000000FF1CE}_PROR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM\...\{91120000-0014-0000-0000-0000000FF1CE}_PROR_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version: - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM\...\{90120000-001A-0407-0000-0000000FF1CE}_PROR_{EA54F104-79D2-48CC-9ABC-91A63C43D353}) (Version: - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition (HKLM\...\{91120000-0014-0000-0000-0000000FF1CE}_PROR_{53DEC068-4690-4F6B-9946-7D21EF02236B}) (Version: - Microsoft)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2878297) 32-Bit Edition (HKLM\...\{91120000-0014-0000-0000-0000000FF1CE}_PROR_{9B1DEEA3-B4ED-49F0-9EF7-4A820EEEA7F1}) (Version: - Microsoft)
Validity Fingerprint Driver (HKLM\...\{DF553DE7-3F31-495D-904D-AFA89BD3739C}) (Version: 4.0.8.0 - Validity Sensors, Inc.)
Verbindungsassistent (HKLM\...\Verbindungsassistent) (Version: 2.1 - Verbindungsassistent)
ViewNX 2 (HKLM\...\{DDD62492-32A7-412B-8AF1-2CF032AD42E3}) (Version: 2.1.2 - Nikon)
Visual Basic for Applications (R) Core - English (Version: 6.4.99.69 - Microsoft Corporation) Hidden
Visual Basic for Applications (R) Core - German (Version: 6.4.99.69 - Microsoft Corporation) Hidden
Visual Basic for Applications (R) Core (Version: 6.4.99.69 - Microsoft Corporation) Hidden
VLC media player 1.1.5 (HKLM\...\VLC media player) (Version: 1.1.5 - VideoLAN)
Vokabeltrainer-Update 6.0.18 (HKLM\...\{5BB72321-F9E7-42C2-9400-AFC195E4F8C6}) (Version: 6.0.18 - Langenscheidt)
Windows Driver Package - Broadcom Bluetooth (06/15/2009 6.2.0.9000) (HKLM\...\B7541EC5F72AA713F557569278EB6273725F5607) (Version: 06/15/2009 6.2.0.9000 - Broadcom)
Windows Driver Package - Broadcom Bluetooth (07/30/2009 6.2.0.9405) (HKLM\...\A6A8668C0A13640CA28FE2A7D9654BE4AE478B13) (Version: 07/30/2009 6.2.0.9405 - Broadcom)
Windows Driver Package - Broadcom HIDClass (07/28/2009 6.2.0.9800) (HKLM\...\BF20603967CFDCB2BBF91950E8A56DFBC5C833FE) (Version: 07/28/2009 6.2.0.9800 - Broadcom)
Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0) (HKLM\...\49CF605F02C7954F4E139D18828DE298CD59217C) (Version: 06/03/2009 2.3.0.0 - Garmin)
Windows-Treiberpaket - Nokia pccsmcfd (10/12/2007 6.85.4.0) (HKLM\...\3A5DEFA413DDE699DBA6EBE0A63534ACA524D30F) (Version: 10/12/2007 6.85.4.0 - Nokia)
WinZip 16.0 (HKLM\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C240CC}) (Version: 16.0.9715 - WinZip Computing, S.L. )
==================== Restore Points =========================
14-03-2014 19:23:08 Windows Update
14-03-2014 19:32:39 Windows Update
18-03-2014 19:42:56 Windows Update
21-03-2014 19:35:57 Windows Update
22-03-2014 23:36:25 Installed Java 7 Update 51
16-04-2014 20:24:52 Windows Update
16-04-2014 20:45:01 Windows Update
03-05-2014 20:09:35 Windows Update
==================== Hosts content: ==========================
2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {0846BDC7-07F5-44EC-B6B0-23C4F6FABC8D} - System32\Tasks\Motorola Device Manager Initial Update => C:\Program Files\Motorola Mobility\Motorola Device Manager\MotorolaDeviceManagerUpdate.exe [2013-10-31] ()
Task: {10FBA785-D0B6-407C-B799-BCD9153C858B} - System32\Tasks\Motorola Device Manager Engine => C:\Program Files\Motorola Mobility\Motorola Device Manager\MotorolaDeviceManagerUpdate.exe [2013-10-31] ()
Task: {2B04E83F-D76D-4FF4-9FF3-1695729ED82A} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {51CCC4F0-DC7A-4DD6-BA63-8D39F72AA42B} - System32\Tasks\GoogleUpdateTaskMachineCore1cef5f52f0fe202 => C:\Program Files\Google\Update\GoogleUpdate.exe [2011-01-14] (Google Inc.)
Task: {5571C043-7280-4452-8107-5607E56AE6B3} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2011-01-14] (Google Inc.)
Task: {72C4EEF9-D51D-4409-B2BC-51E851C1D0B8} - System32\Tasks\Motorola Device Manager Update => C:\Program Files\Motorola Mobility\Motorola Device Manager\MotorolaDeviceManagerUpdate.exe [2013-10-31] ()
Task: {A3713E6F-22ED-4048-8FD1-9122629E28C8} - System32\Tasks\{F5DDE321-A33E-4E37-98D4-108095D0CDCA} => C:\Program Files\Skype\\Phone\Skype.exe
Task: {D9CB0A38-9F14-4F3E-AB2D-1199F25A9B2B} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2011-01-14] (Google Inc.)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cef5f52f0fe202.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2013-08-06 08:55 - 2013-08-05 10:07 - 00394824 _____ () C:\Program Files\Avira\AntiVir Desktop\sqlite3.dll
2012-08-20 19:25 - 2012-08-20 19:25 - 00343024 _____ () C:\Program Files\ALDITALKVerbindungsassistent\ALDITALKVerbindungsassistent_Service.exe
2009-11-17 13:08 - 2009-11-17 13:08 - 00197424 _____ () C:\Windows\system32\vpnapi.dll
2013-10-31 17:05 - 2013-10-31 17:05 - 00172032 _____ () C:\Program Files\Motorola Mobility\Motorola Device Manager\css_core.dll
2012-08-10 13:24 - 2012-03-06 15:44 - 00271696 _____ () C:\Program Files\MTN Internet\AssistantServices.exe
2012-08-20 20:33 - 2009-03-03 12:45 - 00296400 ____N () C:\Program Files\Verbindungsassistent\WTGService.exe
2014-05-03 21:59 - 2014-04-24 02:33 - 00065352 _____ () C:\Program Files\Google\Chrome\Application\34.0.1847.131\chrome_elf.dll
2014-05-03 21:59 - 2014-04-24 02:33 - 00674632 _____ () C:\Program Files\Google\Chrome\Application\34.0.1847.131\libglesv2.dll
2014-05-03 21:59 - 2014-04-24 02:33 - 00093000 _____ () C:\Program Files\Google\Chrome\Application\34.0.1847.131\libegl.dll
2014-05-03 21:59 - 2014-04-24 02:33 - 04081480 _____ () C:\Program Files\Google\Chrome\Application\34.0.1847.131\pdf.dll
2014-05-03 21:59 - 2014-04-24 02:33 - 00390472 _____ () C:\Program Files\Google\Chrome\Application\34.0.1847.131\ppGoogleNaClPluginChrome.dll
2014-05-03 21:59 - 2014-04-24 02:33 - 01647432 _____ () C:\Program Files\Google\Chrome\Application\34.0.1847.131\ffmpegsumo.dll
2014-05-03 21:59 - 2014-04-24 02:33 - 13692232 _____ () C:\Program Files\Google\Chrome\Application\34.0.1847.131\PepperFlash\pepflashplayer.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"
==================== Disabled items from MSCONFIG ==============
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Bluetooth.lnk => C:\Windows\pss\Bluetooth.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Launcher.lnk => C:\Windows\pss\Launcher.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^VPN Client.lnk => C:\Windows\pss\VPN Client.lnk.CommonStartup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: ArcSoft Connection Service => C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
MSCONFIG\startupreg: AutoStartNPSAgent => H:\NPSAgent.exe
MSCONFIG\startupreg: AVMWlanClient => C:\Program Files\avmwlanstick\wlangui.exe
MSCONFIG\startupreg: DKab1err => C:\Program Files\Dell\Printer Software\DKab1err.exe
MSCONFIG\startupreg: GoogleChromeAutoLaunch_0D73A4BF866AFC6952401D3F01412222 => "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-startup-window
MSCONFIG\startupreg: IAAnotif => C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
MSCONFIG\startupreg: IMSS => "C:\Program Files\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe"
MSCONFIG\startupreg: Nikon Message Center 2 => C:\Program Files\Nikon\Nikon Message Center 2\NkMC2.exe -s
MSCONFIG\startupreg: QlbCtrl.exe => C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: RIMBBLaunchAgent.exe => C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
MSCONFIG\startupreg: UIExec => "C:\Program Files\MTN Internet\UIExec.exe"
==================== Faulty Device Manager Devices =============
Name: Cisco Systems VPN Adapter
Description: Cisco Systems VPN Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: CVirtA
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (05/03/2014 11:24:36 PM) (Source: Microsoft Office 12) (User: )
Description: Rejected Safe Mode action : Microsoft Office Word.
Error: (05/03/2014 11:22:40 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.
Error: (05/03/2014 11:22:40 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error: (05/03/2014 11:22:40 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error: (05/03/2014 11:20:34 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: WINWORD.EXE, Version: 12.0.6695.5000, Zeitstempel: 0x5329c5d9
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea91c
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0003224d
ID des fehlerhaften Prozesses: 0x1628
Startzeit der fehlerhaften Anwendung: 0xWINWORD.EXE0
Pfad der fehlerhaften Anwendung: WINWORD.EXE1
Pfad des fehlerhaften Moduls: WINWORD.EXE2
Berichtskennung: WINWORD.EXE3
Error: (05/03/2014 10:05:41 PM) (Source: Windows Backup) (User: )
Description: Die Sicherung wurde aufgrund eines Fehlers beim Schreiben am Sicherungsspeicherort "I:\" nicht abgeschlossen. Fehler: "Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)"
Error: (05/03/2014 09:59:33 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.
Error: (05/03/2014 09:59:33 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error: (05/03/2014 09:59:33 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error: (04/16/2014 10:23:37 PM) (Source: Windows Backup) (User: )
Description: Die Sicherung wurde aufgrund eines Fehlers beim Schreiben am Sicherungsspeicherort "I:\" nicht abgeschlossen. Fehler: "Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)"
System errors:
=============
Error: (04/16/2014 10:42:01 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung empfangen: 47.
Error: (04/16/2014 10:42:01 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung empfangen: 47.
Error: (04/16/2014 10:42:01 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung empfangen: 47.
Error: (04/16/2014 10:42:01 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung empfangen: 47.
Error: (04/16/2014 10:42:00 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung empfangen: 47.
Error: (04/16/2014 10:42:00 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung empfangen: 47.
Error: (04/16/2014 10:42:00 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung empfangen: 47.
Error: (04/16/2014 10:42:00 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung empfangen: 47.
Error: (04/16/2014 10:42:00 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung empfangen: 47.
Error: (04/16/2014 10:42:00 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung empfangen: 47.
Microsoft Office Sessions:
=========================
Error: (05/03/2014 11:20:33 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6695.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 26 seconds with 0 seconds of active time. This session ended with a crash.
Error: (06/24/2013 10:26:47 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 138100 seconds with 5700 seconds of active time. This session ended with a crash.
Error: (12/19/2012 09:54:57 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 5858 seconds with 180 seconds of active time. This session ended with a crash.
Error: (06/28/2012 02:12:19 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6661.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 13209 seconds with 0 seconds of active time. This session ended with a crash.
Error: (06/14/2012 07:50:31 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.6600.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 28735 seconds with 840 seconds of active time. This session ended with a crash.
Error: (06/14/2012 07:49:23 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6661.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 21034 seconds with 600 seconds of active time. This session ended with a crash.
Error: (06/13/2012 01:20:53 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6661.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 63275 seconds with 3420 seconds of active time. This session ended with a crash.
Error: (06/12/2012 04:03:42 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6661.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 3292 seconds with 1020 seconds of active time. This session ended with a crash.
Error: (06/12/2012 02:49:37 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6661.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 2156 seconds with 1320 seconds of active time. This session ended with a crash.
Error: (06/12/2012 02:45:26 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6661.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 2701 seconds with 1020 seconds of active time. This session ended with a crash.
==================== Memory info ===========================
Percentage of memory in use: 57%
Total physical RAM: 2991.38 MB
Available physical RAM: 1281.25 MB
Total Pagefile: 5981.05 MB
Available Pagefile: 3741.17 MB
Total Virtual: 2047.88 MB
Available Virtual: 1913.91 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:215.59 GB) (Free:53.86 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (SYSTEM) (Fixed) (Total:0.29 GB) (Free:0.23 GB) NTFS
Drive e: (HP_RECOVERY) (Fixed) (Total:15 GB) (Free:4.49 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive f: (HP_TOOLS) (Fixed) (Total:1.99 GB) (Free:1.99 GB) FAT32
Drive i: () (Removable) (Total:7.51 GB) (Free:3.31 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: 202D2354)
Partition 1: (Not Active) - (Size=300 MB) - (Type=07 NTFS)
Partition 2: (Active) - (Size=216 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=15 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=2 GB) - (Type=0C)
========================================================
Disk: 1 (Size: 8 GB) (Disk ID: 00000000)
Partition: GPT Partition Type.
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-05-04 01:10:15
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST925041 rev.0006 232,89GB
Running: vdolc97y.exe; Driver: C:\Users\NICOLA~1\AppData\Local\Temp\pwldqpog.sys
---- System - GMER 2.1 ----
SSDT 92AE8866 ZwCreateSection
SSDT 92AE8870 ZwRequestWaitReplyPort
SSDT 92AE886B ZwSetContextThread
SSDT 92AE8875 ZwSetSecurityObject
SSDT 92AE887A ZwSystemDebugControl
SSDT 92AE8807 ZwTerminateProcess
---- Kernel code sections - GMER 2.1 ----
.text ntkrnlpa.exe!ZwRollbackEnlistment + 142D 83493A15 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 834CD212 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text ntkrnlpa.exe!KeRemoveQueueEx + 11F7 834D458C 4 Bytes [66, 88, AE, 92]
.text ntkrnlpa.exe!KeRemoveQueueEx + 1553 834D48E8 4 Bytes [70, 88, AE, 92] {JO 0xffffff8a; SCASB ; XCHG EDX, EAX}
.text ntkrnlpa.exe!KeRemoveQueueEx + 1597 834D492C 4 Bytes [6B, 88, AE, 92]
.text ntkrnlpa.exe!KeRemoveQueueEx + 1613 834D49A8 1 Byte [75]
.text ntkrnlpa.exe!KeRemoveQueueEx + 1613 834D49A8 4 Bytes [75, 88, AE, 92] {JNZ 0xffffff8a; SCASB ; XCHG EDX, EAX}
.text ...
---- Devices - GMER 2.1 ----
Device \Driver\BTHUSB \Device\0000009b bthport.sys
Device \Driver\BTHUSB \Device\0000009d bthport.sys
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\002713a6f0ec
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\002713a6f0ec (not active ControlSet)
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat@VideoMemoryBandwidth 3384410
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat@VideoMemorySize 1370423296
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat@SharedVideoMemory 1303314432
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat@GraphicsFPS 63957
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat@DiskScore 58
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat@CpuUPExpressCompressThroughput 202
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat@RandomReadDiskScore 1341
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat@TimeLastFormalAssessment 0xD5 0x23 0x1C 0x0F ...
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_1080_5sec_10mbps_h264.mp4@DateTime 0x40 0xF1 0xC1 0xBD ...
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_1080_5sec_10mbps_h264.mp4\GpuEngineUsage\A1/N1/E1@VP 7019
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_1080_5sec_10mbps_h264.mp4\GpuEngineUsage\Total@VP 7019
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_1080_5sec_MPEG2_HD_15mbps.mpg@DateTime 0xB0 0xB4 0x3B 0xAC ...
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_1080_5sec_MPEG2_HD_15mbps.mpg@FramesRendered 0x27 0x01 0x00 0x00 ...
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_1080_5sec_MPEG2_HD_15mbps.mpg\GpuEngineUsage\A1/N1/E1@Decode 1379
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_1080_5sec_MPEG2_HD_15mbps.mpg\GpuEngineUsage\A1/N1/E1@VP 4361
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_1080_5sec_MPEG2_HD_15mbps.mpg\GpuEngineUsage\Total@Decode 1379
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_1080_5sec_MPEG2_HD_15mbps.mpg\GpuEngineUsage\Total@VP 4361
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_1080_5sec_VC1_15mbps.wmv@DateTime 0x10 0x3C 0xF0 0xB0 ...
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_1080_5sec_VC1_15mbps.wmv\GpuEngineUsage\A1/N1/E1@Decode 5007
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_1080_5sec_VC1_15mbps.wmv\GpuEngineUsage\A1/N1/E1@VP 6700
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_1080_5sec_VC1_15mbps.wmv\GpuEngineUsage\Total@Decode 5007
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_1080_5sec_VC1_15mbps.wmv\GpuEngineUsage\Total@VP 6700
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_480i_5sec_6mbps_new.mpg@DateTime 0xC0 0xD7 0x59 0xB5 ...
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_480i_5sec_6mbps_new.mpg\GpuEngineUsage\A1/N1/E1@Decode 291
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_480i_5sec_6mbps_new.mpg\GpuEngineUsage\A1/N1/E1@VP 1794
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_480i_5sec_6mbps_new.mpg\GpuEngineUsage\Total@Decode 291
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_480i_5sec_6mbps_new.mpg\GpuEngineUsage\Total@VP 1794
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_480p_5sec_6mbps_new.mpg@DateTime 0x50 0xA4 0x99 0xB9 ...
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_480p_5sec_6mbps_new.mpg\GpuEngineUsage\A1/N1/E1@Decode 570
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_480p_5sec_6mbps_new.mpg\GpuEngineUsage\A1/N1/E1@VP 2471
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_480p_5sec_6mbps_new.mpg\GpuEngineUsage\A1/N1/E1@DwmRedir 34
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_480p_5sec_6mbps_new.mpg\GpuEngineUsage\Total@Decode 570
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_480p_5sec_6mbps_new.mpg\GpuEngineUsage\Total@VP 2471
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_480p_5sec_6mbps_new.mpg\GpuEngineUsage\Total@DwmRedir 34
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_480_5sec_6mbps_h264.mp4@DateTime 0x90 0x84 0x2F 0xC2 ...
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_480_5sec_6mbps_h264.mp4\GpuEngineUsage\A1/N1/E1@VP 2562
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winsat\MediaEx\8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c:AC\Clip_480_5sec_6mbps_h264.mp4\GpuEngineUsage\Total@VP 2562
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinSATAPI@IdleWinSATRunCount 6
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinSATAPI@IdleAssessmentCompletionCount 6
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinSATAPI@IdleWinSATRunAfterCount 5
Reg HKLM\SOFTWARE\Classes\.b64\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F}
Reg HKLM\SOFTWARE\Classes\.b64\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F}@ {E0D7930A-84BE-11CE-9641-444553540002}
Reg HKLM\SOFTWARE\Classes\.bz2\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F}
Reg HKLM\SOFTWARE\Classes\.bz2\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F}@ {E0D7930A-84BE-11CE-9641-444553540002}
Reg HKLM\SOFTWARE\Classes\.lha\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F}
Reg HKLM\SOFTWARE\Classes\.lha\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F}@ {E0D7930A-84BE-11CE-9641-444553540002}
Reg HKLM\SOFTWARE\Classes\.lzh\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F}
Reg HKLM\SOFTWARE\Classes\.lzh\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F}@ {E0D7930A-84BE-11CE-9641-444553540002}
Reg HKLM\SOFTWARE\Classes\.mim\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F}
Reg HKLM\SOFTWARE\Classes\.mim\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F}@ {E0D7930A-84BE-11CE-9641-444553540002}
Reg HKLM\SOFTWARE\Classes\.mime\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F}
Reg HKLM\SOFTWARE\Classes\.mime\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F}@ {E0D7930A-84BE-11CE-9641-444553540002}
Reg HKLM\SOFTWARE\Classes\.rar\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F}
Reg HKLM\SOFTWARE\Classes\.rar\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F}@ {E0D7930A-84BE-11CE-9641-444553540002}
Reg HKLM\SOFTWARE\Classes\.tbz2\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F}
Reg HKLM\SOFTWARE\Classes\.tbz2\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F}@ {E0D7930A-84BE-11CE-9641-444553540002}
Reg HKLM\SOFTWARE\Classes\.tz\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F}
Reg HKLM\SOFTWARE\Classes\.tz\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F}@ {E0D7930A-84BE-11CE-9641-444553540002}
Reg HKLM\SOFTWARE\Classes\.uu\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F}
Reg HKLM\SOFTWARE\Classes\.uu\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F}@ {E0D7930A-84BE-11CE-9641-444553540002}
Reg HKLM\SOFTWARE\Classes\.uue\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F}
Reg HKLM\SOFTWARE\Classes\.uue\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F}@ {E0D7930A-84BE-11CE-9641-444553540002}
---- EOF - GMER 2.1 ----
|
|
04.05.2014, 06:31
| #2 |
| /// the machine /// TB-Ausbilder    | Windwos 7: Backdoor.Agent.DCEGen, Trojan.Delf und noch ordentlich Malware hi,
__________________Scan mit Combofix
__________________ |
|
04.05.2014, 10:55
| #3 |
| | Windwos 7: Backdoor.Agent.DCEGen, Trojan.Delf und noch ordentlich Malware Hallo Schrauber,
__________________erstmal danke, dass du mir mit dem Problem hilfst. Habe Combofix laufen lassen, bei der Log file ist mir dann aber aufgefallen, dass der Windows Defender noch lief. Soll ich ich einen weiteren Suchlauf starten? Hier erstmal die Combofix log vom ersten Suchlauf: Code:
ATTFilter ComboFix 14-04-30.01 - ***** 04.05.2014 11:31:20.1.4 - x86
Microsoft Windows 7 Professional 6.1.7601.1.1252.49.1031.18.2991.1776 [GMT 2:00]
ausgeführt von:: c:\users\*****\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\*****\4.0
c:\users\*****\AppData\Local\lame_enc.dll
c:\users\*****\AppData\Local\no23xwrapper.dll
c:\users\*****\AppData\Local\ogg.dll
c:\users\*****\AppData\Local\vorbis.dll
c:\users\*****\AppData\Local\vorbisenc.dll
c:\users\*****\AppData\Local\vorbisfile.dll
c:\users\*****\AppData\Roaming\RBSpriteSurface400.dll
c:\windows\system32\MSDCSC
.
Infizierte Kopie von c:\windows\system32\Services.exe wurde gefunden und desinfiziert
Kopie von - c:\windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_cf36168b2e9c967b\services.exe wurde wiederhergestellt
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-04-04 bis 2014-05-04 ))))))))))))))))))))))))))))))
.
.
2014-05-04 09:39 . 2014-05-04 09:41 -------- d-----w- c:\users\*****\AppData\Local\temp
2014-05-04 09:39 . 2014-05-04 09:39 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-05-04 09:39 . 2014-05-04 09:39 -------- d-----w- c:\users\kefi\AppData\Local\temp
2014-05-04 09:39 . 2014-05-04 09:39 -------- d-----w- c:\users\Gast\AppData\Local\temp
2014-05-04 09:23 . 2014-04-29 12:34 2724864 ----a-w- c:\windows\system32\mshtml.tlb
2014-05-03 22:37 . 2014-05-03 22:40 -------- d-----w- C:\FRST
2014-05-03 21:28 . 2014-05-03 21:29 107736 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-05-03 21:27 . 2014-05-03 21:27 -------- d-----w- c:\program files\ Malwarebytes Anti-Malware
2014-05-03 21:27 . 2014-04-03 07:51 51416 ----a-w- c:\windows\system32\drivers\mwac.sys
2014-05-03 21:27 . 2014-04-03 07:51 73432 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-05-03 21:27 . 2014-04-03 07:50 23256 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-05-03 20:10 . 2014-04-17 03:32 8050496 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{46707FDB-8AEC-4DEC-8B4B-AD5E0077CA70}\mpengine.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-03-31 07:35 . 2011-01-14 09:32 231584 ------w- c:\windows\system32\MpSigStub.exe
2014-02-07 01:07 . 2014-03-14 19:24 2349056 ----a-w- c:\windows\system32\win32k.sys
2014-02-04 02:04 . 2014-03-14 19:26 509440 ----a-w- c:\windows\system32\qedit.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-17 14:45 130736 ----a-w- c:\users\*****\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-17 14:45 130736 ----a-w- c:\users\*****\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-17 14:45 130736 ----a-w- c:\users\*****\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-10-10 1578280]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-25 136216]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-25 171032]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-25 170520]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2014-02-28 689744]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2010-09-07 495708]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Bluetooth.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
backup=c:\windows\pss\Bluetooth.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Launcher.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Launcher.lnk
backup=c:\windows\pss\Launcher.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^VPN Client.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\VPN Client.lnk
backup=c:\windows\pss\VPN Client.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2013-11-21 16:57 959904 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ArcSoft Connection Service]
2010-10-27 18:17 207424 ----a-w- c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVMWlanClient]
2008-02-25 00:00 1753088 ----a-w- c:\program files\avmwlanstick\WLanGUI.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DKab1err]
2009-06-09 18:33 582896 ----a-w- c:\program files\Dell\Printer Software\dkab1err.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GoogleChromeAutoLaunch_0D73A4BF866AFC6952401D3F01412222]
2014-04-24 00:33 841032 ----a-w- c:\program files\Google\Chrome\Application\chrome.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]
2009-08-25 16:57 186904 ----a-r- c:\program files\Intel\Intel Matrix Storage Manager\IAANOTIF.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMSS]
2009-11-04 21:46 111640 ----a-r- c:\program files\Intel\Intel(R) Management Engine Components\IMSS\PICONSTARTUP.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nikon Message Center 2]
2010-05-25 18:16 619008 ----a-w- c:\program files\Nikon\Nikon Message Center 2\NkMC2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl.exe]
2009-11-11 14:11 287800 ----a-r- c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RIMBBLaunchAgent.exe]
2011-02-18 09:47 79192 ----a-w- c:\program files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UIExec]
2012-03-29 21:21 153432 ----a-w- c:\program files\MTN Internet\UIExec.exe
.
R3 avmeject;AVM Eject;c:\windows\system32\drivers\avmeject.sys [2007-11-07 4352]
R3 BTCFilterService;USB Networking Driver Filter Service;c:\windows\system32\DRIVERS\motfilt.sys [2013-03-20 6272]
R3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2009-05-05 228408]
R3 fwlanusbn;FRITZ!WLAN N;c:\windows\system32\DRIVERS\fwlanusbn.sys [2007-12-19 401920]
R3 GKUPRO2D;GKUPRO2D;c:\windows\system32\Drivers\GKUPRO2D.sys [2005-02-18 71168]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2014-03-06 108032]
R3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2009-10-26 125696]
R3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2009-10-30 209920]
R3 massfilter;Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [2011-05-20 9216]
R3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\DRIVERS\motccgp.sys [2013-03-19 21376]
R3 motccgpfl;MotCcgpFlService;c:\windows\system32\DRIVERS\motccgpfl.sys [x]
R3 Motousbnet;Motorola USB Networking Driver Service;c:\windows\system32\DRIVERS\Motousbnet.sys [2013-03-19 23936]
R3 motusbdevice;Motorola USB Dev Driver;c:\windows\system32\DRIVERS\motusbdevice.sys [2013-03-20 11264]
R3 OXSDIDRV_x32;Oxford Semi eSATA Filter (x32);c:\windows\system32\DRIVERS\OXSDIDRV_x32.sys [2009-09-28 52656]
R3 OXUDIDRV;OXUDIDRV;c:\windows\system32\Drivers\OXUDIDRV_X32.sys [2010-05-25 24880]
R3 rimspci;rimspci;c:\windows\system32\DRIVERS\rimspe86.sys [2009-10-26 48640]
R3 risdpcie;risdpcie;c:\windows\system32\DRIVERS\risdpe86.sys [2009-10-28 47616]
R3 rixdpcie;rixdpcie;c:\windows\system32\DRIVERS\rixdpe86.sys [2009-09-28 38912]
R3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\DRIVERS\ss_bbus.sys [2010-04-27 98432]
R3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\DRIVERS\ss_bmdfl.sys [2010-04-27 14848]
R3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\DRIVERS\ss_bmdm.sys [2010-04-27 123648]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [2011-05-19 1343400]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2013-11-27 37352]
S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\aestsrv.exe [2009-03-01 81920]
S2 ALDITALKVerbindungsassistent_Service;ALDITALKVerbindungsassistent_Service;c:\program files\ALDITALKVerbindungsassistent\ALDITALKVerbindungsassistent_Service.exe [2012-08-20 343024]
S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2014-02-28 440400]
S2 dkab_device;dkab_device;c:\windows\system32\DKabcoms.exe [2009-06-09 603376]
S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2010-07-29 238952]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [2009-07-08 26168]
S2 Motorola Device Manager;Motorola Device Manager Service;c:\program files\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe [2013-11-15 137528]
S2 PDF Architect Helper Service;PDF Architect Helper Service;c:\program files\PDF Architect\HelperService.exe [2013-04-08 1320496]
S2 PDF Architect Service;PDF Architect Service;c:\program files\PDF Architect\ConversionService.exe [2013-04-08 799280]
S2 PST Service;PST Service;c:\program files\Motorola\MotForwardDaemon\ForwardDaemon.exe [2011-09-02 65657]
S2 UI Assistant Service;UI Assistant Service;c:\program files\MTN Internet\AssistantServices.exe [2012-03-06 271696]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-11-04 2320920]
S2 vcsFPService;Validity VCS Fingerprint Service;c:\windows\system32\vcsFPService.exe [2009-10-21 1639728]
S2 WTGService;WTGService;c:\program files\Verbindungsassistent\WTGService.exe [2009-03-03 296400]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2009-09-17 29472]
S3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\DRIVERS\e1k6232.sys [2009-11-05 214696]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [2010-06-14 36608]
S3 NETw5s32;Intel(R) Wireless WiFi Link Adaptertreiber für Windows 7 32-Bit;c:\windows\system32\DRIVERS\NETw5s32.sys [2010-01-13 6755840]
S3 rismc32;RICOH Smart Card Reader;c:\windows\system32\DRIVERS\rismc32.sys [2009-07-20 49152]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - FSUSBEXDISK
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-05-03 19:57 1078088 ----a-w- c:\program files\Google\Chrome\Application\34.0.1847.131\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-05-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore1cef5f52f0fe202.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-01-14 18:20]
.
2014-05-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-01-14 18:20]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://de.search-results.com/?l=dis&o=41648036
uInternet Settings,ProxyOverride = fritz.box;192.168.*.*
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Free YouTube to MP3 Converter - c:\users\*****\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{5AF65354-03AE-46C4-817B-B72FDF84E827}: NameServer = 134.147.222.4,134.147.32.4
FF - ProfilePath - c:\users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\g1vlkkbs.default\
FF - prefs.js: browser.startup.homepage - hxxp://ard.de/
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}
FF - Ext: DVDVideoSoftTB Community Toolbar: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - %profile%\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
FF - Ext: Free YouTube Download (Free Studio) Menu: {ACAA314B-EEBA-48e4-AD47-84E31C44796C} - %profile%\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
FF - user.js: yahoo.ytff.general.dontshowhpoffer - true
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
URLSearchHooks-{872b5b88-9db5-4310-bdd0-ac189557e5f5} - (no file)
WebBrowser-{872B5B88-9DB5-4310-BDD0-AC189557E5F5} - (no file)
HKLM-Run-NPSStartup - (no file)
MSConfigStartUp-AutoStartNPSAgent - H:\NPSAgent.exe
MSConfigStartUp-QuickTime Task - c:\program files\QuickTime\QTTask.exe
AddRemove-LSI Soft Modem - c:\windows\agrsmdel
AddRemove-Samsung Mobile phone USB driver Drive - c:\windows\system32\Samsung_USB_Drivers\5\SSSDUninstall.exe
AddRemove-Uninstall_is1 - c:\program files\Common Files\DVDVideoSoft\unins000.exe
AddRemove-01_Simmental - c:\usb drivers\01_Simmental\Uninstall.exe
AddRemove-02_Siberian - c:\usb drivers\02_Siberian\Uninstall.exe
AddRemove-03_Swallowtail - c:\usb drivers\03_Swallowtail\Uninstall.exe
AddRemove-04_semseyite - c:\usb drivers\04_semseyite\Uninstall.exe
AddRemove-05_Sloan - c:\usb drivers\05_Sloan\Uninstall.exe
AddRemove-06_Spencer - c:\usb drivers\06_Spencer\Uninstall.exe
AddRemove-07_Schorl - c:\usb drivers\07_Schorl\Uninstall.exe
AddRemove-08_EMPChipset - c:\usb drivers\08_EMPChipset\Uninstall.exe
AddRemove-09_Hsp - c:\usb drivers\09_Hsp\Uninstall.exe
AddRemove-11_HSP_Plus_Default - c:\usb drivers\11_HSP_Plus_Default\Uninstall.exe
AddRemove-16_Shrewsbury - c:\usb drivers\16_Shrewsbury\Uninstall.exe
AddRemove-17_EMP_Chipset2 - c:\usb drivers\17_EMP_Chipset2\Uninstall.exe
AddRemove-18_Zinia_Serial_Driver - c:\usb drivers\18_Zinia_Serial_Driver\Uninstall.exe
AddRemove-19_VIA_driver - c:\usb drivers\19_VIA_driver\Uninstall.exe
AddRemove-20_NXP_Driver - c:\usb drivers\20_NXP_Driver\Uninstall.exe
AddRemove-21_Searsburg - c:\usb drivers\21_Searsburg\Uninstall.exe
AddRemove-22_WiBro_WiMAX - c:\usb drivers\22_WiBro_WiMAX\Uninstall.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0008\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'Explorer.exe'(5836)
c:\users\*****\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
c:\program files\WIDCOMM\Bluetooth Software\btncopy.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files\IDT\WDM\STacSV.exe
c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files\LSI SoftModem\agrsmsvc.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\avmwlanstick\WlanNetService.exe
c:\program files\WIDCOMM\Bluetooth Software\btwdins.exe
c:\program files\Cisco Systems\VPN Client\cvpnd.exe
c:\program files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\program files\Common Files\Protexis\License Service\PsiService_2.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\conhost.exe
c:\program files\Motorola Mobility\Motorola Device Manager\MotoHelperAgent.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\windows\servicing\TrustedInstaller.exe
c:\windows\system32\WUDFHost.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\sppsvc.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
c:\program files\Common Files\Java\Java Update\jucheck.exe
c:\program files\Java\jre7\bin\javaw.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2014-05-04 11:47:14 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2014-05-04 09:47
.
Vor Suchlauf: 14 Verzeichnis(se), 64.009.936.896 Bytes frei
Nach Suchlauf: 21 Verzeichnis(se), 70.882.373.632 Bytes frei
.
- - End Of File - - 1F92C20BFB80D1B66DF5C01F960AD7DF
A36C5E4F47E84449FF07ED3517B43A31
|
|
04.05.2014, 11:09
| #4 |
| /// the machine /// TB-Ausbilder | Windwos 7: Backdoor.Agent.DCEGen, Trojan.Delf und noch ordentlich Malware Passt schon. Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
04.05.2014, 12:38
| #5 |
| | Windwos 7: Backdoor.Agent.DCEGen, Trojan.Delf und noch ordentlich Malware So, hab nun alle Logs zusammen. mbam: Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 04.05.2014 Suchlauf-Zeit: 12:52:21 Logdatei: mbam.txt Administrator: Ja Version: 2.00.1.1004 Malware Datenbank: v2014.05.04.03 Rootkit Datenbank: v2014.03.27.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Chameleon: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x86 Dateisystem: NTFS Benutzer: ***** Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 317643 Verstrichene Zeit: 19 Min, 11 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Aktiviert Shuriken: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 0 (No malicious items detected) Registrierungswerte: 0 (No malicious items detected) Registrierungsdaten: 0 (No malicious items detected) Ordner: 0 (No malicious items detected) Dateien: 0 (No malicious items detected) Physische Sektoren: 0 (No malicious items detected) (end) Code:
ATTFilter # AdwCleaner v3.205 - Bericht erstellt am 04/05/2014 um 12:59:29
# Aktualisiert 28/04/2014 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (32 bits)
# Benutzername : ***** - NICOLA
# Gestartet von : C:\Users\*****\Desktop\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\Program Files\Conduit
Ordner Gelöscht : C:\Program Files\Common Files\DVDVideoSoft\TB
Ordner Gelöscht : C:\Users\Gast\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\Gast\AppData\LocalLow\DVDVideoSoftTB
Ordner Gelöscht : C:\Users\Gast\AppData\LocalLow\PriceGong
Ordner Gelöscht : C:\Users\kefi\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\kefi\AppData\LocalLow\DVDVideoSoftTB
Ordner Gelöscht : C:\Users\kefi\AppData\LocalLow\PriceGong
Ordner Gelöscht : C:\Users\*****\AppData\Local\Conduit
Ordner Gelöscht : C:\Users\*****\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\*****\AppData\LocalLow\PriceGong
Ordner Gelöscht : C:\Users\*****\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\*****\AppData\Roaming\pdfforge
Ordner Gelöscht : C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\g1vlkkbs.default\Conduit
Ordner Gelöscht : C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\g1vlkkbs.default\CT2269050
Ordner Gelöscht : C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\g1vlkkbs.default\Extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
Ordner Gelöscht : C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\g1vlkkbs.default\Extensions\{ACAA314B-EEBA-48E4-AD47-84E31C44796C}
Datei Gelöscht : C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\g1vlkkbs.default\user.js
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2269050
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_stuffit-expander_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_stuffit-expander_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00000000-6E41-4FD3-8538-502F5495E5FC}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D3F69D07-0AEE-47AF-87D0-1A67D4F70C68}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{C7576B9D-B442-46BC-AF74-080A9E723E01}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{25A3A431-30BB-47C8-AD6A-E1063801134F}]
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Schlüssel Gelöscht : HKLM\Software\Conduit
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17041
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
-\\ Mozilla Firefox v3.6.23 (de)
[ Datei : C:\Users\Gast\AppData\Roaming\Mozilla\Firefox\Profiles\e0by7jcj.default\prefs.js ]
[ Datei : C:\Users\kefi\AppData\Roaming\Mozilla\Firefox\Profiles\tgojrg4g.default\prefs.js ]
[ Datei : C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\g1vlkkbs.default\prefs.js ]
Zeile gelöscht : user_pref("CT2269050.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
Zeile gelöscht : user_pref("CT2269050.CTID", "CT2269050");
Zeile gelöscht : user_pref("CT2269050.CurrentServerDate", "19-1-2011");
Zeile gelöscht : user_pref("CT2269050.DialogsAlignMode", "LTR");
Zeile gelöscht : user_pref("CT2269050.DownloadReferralCookieData", "");
Zeile gelöscht : user_pref("CT2269050.EMailNotifierPollDate", "Wed Jan 19 2011 12:38:53 GMT+0100");
Zeile gelöscht : user_pref("CT2269050.FirstServerDate", "19-1-2011");
Zeile gelöscht : user_pref("CT2269050.FirstTime", true);
Zeile gelöscht : user_pref("CT2269050.FirstTimeFF3", true);
Zeile gelöscht : user_pref("CT2269050.FirstTimeSettingsDone", true);
Zeile gelöscht : user_pref("CT2269050.FixPageNotFoundErrors", true);
Zeile gelöscht : user_pref("CT2269050.GroupingServerCheckInterval", 1440);
Zeile gelöscht : user_pref("CT2269050.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
Zeile gelöscht : user_pref("CT2269050.Initialize", true);
Zeile gelöscht : user_pref("CT2269050.InitializeCommonPrefs", true);
Zeile gelöscht : user_pref("CT2269050.InstallationAndCookieDataSentCount", 1);
Zeile gelöscht : user_pref("CT2269050.InstallationType", "UnknownIntegration");
Zeile gelöscht : user_pref("CT2269050.InstalledDate", "Wed Jan 19 2011 10:43:52 GMT+0100");
Zeile gelöscht : user_pref("CT2269050.InvalidateCache", false);
Zeile gelöscht : user_pref("CT2269050.IsGrouping", false);
Zeile gelöscht : user_pref("CT2269050.IsMulticommunity", false);
Zeile gelöscht : user_pref("CT2269050.IsOpenThankYouPage", false);
Zeile gelöscht : user_pref("CT2269050.IsOpenUninstallPage", false);
Zeile gelöscht : user_pref("CT2269050.LanguagePackLastCheckTime", "Wed Jan 19 2011 10:43:54 GMT+0100");
Zeile gelöscht : user_pref("CT2269050.LanguagePackReloadIntervalMM", 1440);
Zeile gelöscht : user_pref("CT2269050.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx");
Zeile gelöscht : user_pref("CT2269050.LastLogin_2.7.2.0", "Wed Jan 19 2011 10:43:53 GMT+0100");
Zeile gelöscht : user_pref("CT2269050.LatestVersion", "3.2.5.2");
Zeile gelöscht : user_pref("CT2269050.Locale", "en");
Zeile gelöscht : user_pref("CT2269050.LoginCache", 4);
Zeile gelöscht : user_pref("CT2269050.MCDetectTooltipHeight", "83");
Zeile gelöscht : user_pref("CT2269050.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Zeile gelöscht : user_pref("CT2269050.MCDetectTooltipWidth", "295");
Zeile gelöscht : user_pref("CT2269050.RadioIsPodcast", false);
Zeile gelöscht : user_pref("CT2269050.RadioLastCheckTime", "Wed Jan 19 2011 10:43:53 GMT+0100");
Zeile gelöscht : user_pref("CT2269050.RadioLastUpdateIPServer", "3");
Zeile gelöscht : user_pref("CT2269050.RadioLastUpdateServer", "129132338014870000");
Zeile gelöscht : user_pref("CT2269050.RadioMediaID", "12473383");
Zeile gelöscht : user_pref("CT2269050.RadioMediaType", "Media Player");
Zeile gelöscht : user_pref("CT2269050.RadioMenuSelectedID", "EBRadioMenu_CT226905012473383");
Zeile gelöscht : user_pref("CT2269050.RadioStationName", "Hotmix%20108");
Zeile gelöscht : user_pref("CT2269050.RadioStationURL", "hxxp://67.202.67.18:8082");
Zeile gelöscht : user_pref("CT2269050.SavedHomepage", "resource:/browserconfig.properties");
Zeile gelöscht : user_pref("CT2269050.SearchEngine", "Search||hxxp://search.conduit.com/Results.aspx?q=UCM_SEARCH_TERM&ctid=CT2269050&octid=EB_ORIGINAL_CTID&SearchSource=1");
Zeile gelöscht : user_pref("CT2269050.SearchFromAddressBarIsInit", true);
Zeile gelöscht : user_pref("CT2269050.SearchInNewTabEnabled", true);
Zeile gelöscht : user_pref("CT2269050.SearchInNewTabIntervalMM", 1440);
Zeile gelöscht : user_pref("CT2269050.SearchInNewTabLastCheckTime", "Wed Jan 19 2011 10:43:53 GMT+0100");
Zeile gelöscht : user_pref("CT2269050.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_TOOLBAR_ID");
Zeile gelöscht : user_pref("CT2269050.SearchInNewTabUsageUrl", "hxxp://Usage.Hosting.conduit-services.com/UsageService.asmx/UsersRequests?ctid=EB_TOOLBAR_ID");
Zeile gelöscht : user_pref("CT2269050.SettingsCheckIntervalMin", 120);
Zeile gelöscht : user_pref("CT2269050.SettingsLastCheckTime", "Wed Jan 19 2011 10:43:52 GMT+0100");
Zeile gelöscht : user_pref("CT2269050.SettingsLastUpdate", "1294659279");
Zeile gelöscht : user_pref("CT2269050.ThirdPartyComponentsInterval", 504);
Zeile gelöscht : user_pref("CT2269050.ThirdPartyComponentsLastCheck", "Wed Jan 19 2011 10:43:52 GMT+0100");
Zeile gelöscht : user_pref("CT2269050.ThirdPartyComponentsLastUpdate", "1246790578");
Zeile gelöscht : user_pref("CT2269050.TrusteLinkUrl", "hxxp://www.truste.org/pvr.php?page=validate&softwareProgramId=101&sealid=112");
Zeile gelöscht : user_pref("CT2269050.UserID", "UN57756547937841944");
Zeile gelöscht : user_pref("CT2269050.ValidationData_Toolbar", 2);
Zeile gelöscht : user_pref("CT2269050.WeatherNetwork", "");
Zeile gelöscht : user_pref("CT2269050.WeatherPollDate", "Wed Jan 19 2011 12:13:54 GMT+0100");
Zeile gelöscht : user_pref("CT2269050.WeatherUnit", "C");
Zeile gelöscht : user_pref("CT2269050.alertChannelId", "666138");
Zeile gelöscht : user_pref("CT2269050.clientLogIsEnabled", true);
Zeile gelöscht : user_pref("CT2269050.clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.asmx/ReportDiagnosticsEvent");
Zeile gelöscht : user_pref("CT2269050.myStuffEnabled", true);
Zeile gelöscht : user_pref("CT2269050.myStuffPublihserMinWidth", 400);
Zeile gelöscht : user_pref("CT2269050.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOrigin=29&ctid=EB_TOOLBAR_ID&octid=EB_ORIGINAL_CTID");
Zeile gelöscht : user_pref("CT2269050.myStuffServiceIntervalMM", 1440);
Zeile gelöscht : user_pref("CT2269050.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?ComponentId=EB_MY_STUFF_INSTANCE_GUID&lut=EB_MY_STUFF_LUT");
Zeile gelöscht : user_pref("CT2269050.uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/RegisterToolbarUninstallation");
Zeile gelöscht : user_pref("CommunityToolbar.SearchFromAddressBarSavedUrl", "chrome://browser-region/locale/region.properties");
Zeile gelöscht : user_pref("CommunityToolbar.ToolbarsList", "CT2269050");
Zeile gelöscht : user_pref("CommunityToolbar.ToolbarsList2", "CT2269050");
Zeile gelöscht : user_pref("CommunityToolbar.keywordURLSelectedCTID", "CT2269050");
Zeile gelöscht : user_pref("browser.search.order.1", "Search-Results");
-\\ Google Chrome v34.0.1847.131
[ Datei : C:\Users\Gast\AppData\Local\Google\Chrome\User Data\Default\preferences ]
[ Datei : C:\Users\kefi\AppData\Local\Google\Chrome\User Data\Default\preferences ]
[ Datei : C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\preferences ]
*************************
AdwCleaner[R0].txt - [11939 octets] - [04/05/2014 12:57:13]
AdwCleaner[S0].txt - [11667 octets] - [04/05/2014 12:59:29]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [11728 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Professional x86
Ran by ***** on 04.05.2014 at 13:18:03,27
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
~~~ FireFox
Emptied folder: C:\Users\*****\AppData\Roaming\mozilla\firefox\profiles\g1vlkkbs.default\minidumps [1 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 04.05.2014 at 13:19:57,00
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:01-05-2014
Ran by ***** (administrator) on NICOLA on 04-05-2014 13:20:58
Running from C:\Users\*****\Desktop
Microsoft Windows 7 Professional Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv.exe
(Hewlett-Packard) C:\Windows\System32\hpservice.exe
(Validity Sensors, Inc.) C:\Windows\System32\vcsFPService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(ArcSoft Inc.) C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AEstSrv.exe
(LSI Corporation) C:\Program Files\LSI SoftModem\agrsmsvc.exe
() C:\Program Files\ALDITALKVerbindungsassistent\ALDITALKVerbindungsassistent_Service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(AVM Berlin) C:\Program Files\avmwlanstick\WLanNetService.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Cisco Systems, Inc.) C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
( ) C:\Windows\System32\dkabcoms.exe
(Teruten) C:\Windows\System32\FsUsbExService.Exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.EXE
(Motorola Mobility LLC) C:\Program Files\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe
(pdfforge GmbH) C:\Program Files\PDF Architect\HelperService.exe
(pdfforge GmbH) C:\Program Files\PDF Architect\ConversionService.exe
(Protexis Inc.) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
(Motorola) C:\Program Files\Motorola\MotForwardDaemon\ForwardDaemon.exe
() C:\Program Files\MTN Internet\AssistantServices.exe
() C:\Program Files\Verbindungsassistent\WTGService.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMON.EXE
(Motorola Mobility LLC) C:\Program Files\Motorola Mobility\Motorola Device Manager\MotoHelperAgent.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.EXE
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jucheck.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1578280 2009-10-10] (Synaptics Incorporated)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-28] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray.exe [495708 2010-09-08] (IDT, Inc.)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
Winlogon\Notify\ScCertProp: wlnotify.dll [X]
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x3338F3DED2B3CB01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
SearchScopes: HKLM - DefaultScope value is missing.
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files\PDF Architect\PDFIEHelper.dll (pdfforge GmbH)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{5AF65354-03AE-46C4-817B-B72FDF84E827}: [NameServer]134.147.222.4,134.147.32.4
FireFox:
========
FF ProfilePath: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\g1vlkkbs.default
FF Homepage: hxxp://ard.de/
FF NetworkProxy: "no_proxies_on", "fritz.box"
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF Plugin: @garmin.com/GpsControl - C:\Program Files\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @RIM.com/WebSLLauncher,version=1.0 - C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npnul32.dll (mozilla.org)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} [2011-03-23]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} [2011-06-22]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} [2012-04-17]
FF HKLM\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files\PDF Architect\FFPDFArchitectExt [2013-07-28]
Chrome:
=======
CHR HomePage: hxxp://internacional.elpais.com/
CHR StartupUrls: "hxxp://dict.leo.org/esde?lang=de&lp=esde", "hxxp://internacional.elpais.com/"
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\34.0.1847.131\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\34.0.1847.131\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\34.0.1847.131\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
CHR Plugin: (Skype Toolbars) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.9.0.9216_0\npSkypeChromePlugin.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java Deployment Toolkit 6.0.310.5) - C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U31) - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll No File
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll No File
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll No File
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll No File
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll No File
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll No File
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll No File
CHR Plugin: (RIM Handheld Application Loader) - C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
CHR Plugin: (Garmin Communicator Plug-In) - C:\Program Files\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Extension: (YouTube) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2011-12-15]
CHR Extension: (Adblock Plus) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2013-01-03]
CHR Extension: (Google-Suche) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2011-12-15]
CHR Extension: (DVDVideoSoft Browser Extension) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp [2012-11-26]
CHR Extension: (Google Wallet) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-02]
CHR Extension: (Google Mail) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2011-12-15]
CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Users\*****\AppData\Roaming\DVDVideoSoft\DVDVideoSoftBrowserExtension.crx [2012-11-19]
========================== Services (Whitelisted) =================
R2 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 AgereModemAudio; C:\Program Files\LSI SoftModem\agrsmsvc.exe [14336 2009-08-03] (LSI Corporation)
R2 ALDITALKVerbindungsassistent_Service; C:\Program Files\ALDITALKVerbindungsassistent\ALDITALKVerbindungsassistent_Service.exe [343024 2012-08-20] ()
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440400 2014-02-28] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-28] (Avira Operations GmbH & Co. KG)
R2 AVM WLAN Connection Service; C:\Program Files\avmwlanstick\WlanNetService.exe [364544 2008-02-25] (AVM Berlin)
R2 CVPND; C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe [1528624 2009-11-17] (Cisco Systems, Inc.)
R2 dkab_device; C:\Windows\system32\DKabcoms.exe [603376 2009-06-09] ( )
R2 Motorola Device Manager; C:\Program Files\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe [137528 2013-11-15] (Motorola Mobility LLC)
R2 PDF Architect Helper Service; C:\Program Files\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
R2 PDF Architect Service; C:\Program Files\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)
R2 PST Service; C:\Program Files\Motorola\MotForwardDaemon\ForwardDaemon.exe [65657 2011-09-02] (Motorola)
R2 STacSV; C:\Program Files\IDT\WDM\STacSV.exe [254034 2010-09-08] (IDT, Inc.)
R2 UI Assistant Service; C:\Program Files\MTN Internet\AssistantServices.exe [271696 2012-03-06] ()
R2 vcsFPService; C:\Windows\system32\vcsFPService.exe [1639728 2009-10-21] (Validity Sensors, Inc.)
R2 WTGService; C:\Program Files\Verbindungsassistent\WTGService.exe [296400 2009-03-03] ()
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-12-23] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135648 2013-12-23] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-27] (Avira Operations GmbH & Co. KG)
S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [4352 2007-11-07] (AVM Berlin)
S3 CVirtA; C:\Windows\System32\DRIVERS\CVirtA.sys [5275 2007-01-18] (Cisco Systems, Inc.)
R2 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [308859 2009-11-17] (Cisco Systems, Inc.)
R3 DNE; C:\Windows\System32\DRIVERS\dne2000.sys [131984 2008-11-16] (Deterministic Networks, Inc.)
R3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2010-06-14] ()
S3 fwlanusbn; C:\Windows\System32\DRIVERS\fwlanusbn.sys [401920 2007-12-19] (AVM GmbH)
S3 GKUPRO2D; C:\Windows\System32\Drivers\GKUPRO2D.sys [71168 2005-02-18] (Gemplus)
S3 massfilter; C:\Windows\System32\drivers\massfilter.sys [9216 2011-05-20] (MBB Incorporated)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [107736 2014-05-04] (Malwarebytes Corporation)
S3 OXSDIDRV_x32; C:\Windows\System32\DRIVERS\OXSDIDRV_x32.sys [52656 2009-09-28] ()
S3 OXUDIDRV; C:\Windows\system32\Drivers\OXUDIDRV_X32.sys [24880 2010-05-25] ()
S3 risdpcie; C:\Windows\system32\DRIVERS\risdpe86.sys [47616 2009-10-28] (REDC)
R3 rismc32; C:\Windows\System32\DRIVERS\rismc32.sys [49152 2009-07-20] (RICOH Company, Ltd.)
S3 rixdpcie; C:\Windows\system32\DRIVERS\rixdpe86.sys [38912 2009-09-28] (REDC)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1765168 2009-09-17] ()
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-08-05] (Avira GmbH)
S3 ss_bbus; C:\Windows\System32\DRIVERS\ss_bbus.sys [98432 2010-04-27] (MCCI)
S3 ss_bmdfl; C:\Windows\System32\DRIVERS\ss_bmdfl.sys [14848 2010-04-27] (MCCI Corporation)
S3 ss_bmdm; C:\Windows\System32\DRIVERS\ss_bmdm.sys [123648 2010-04-27] (MCCI Corporation)
S3 catchme; \??\C:\Users\NICOLA~1\AppData\Local\Temp\catchme.sys [X]
S3 flpydisk; \SystemRoot\system32\DRIVERS\flpydisk.sys [X]
S3 motccgpfl; system32\DRIVERS\motccgpfl.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-05-04 13:19 - 2014-05-04 13:19 - 00000776 _____ () C:\Users\*****\Desktop\JRT.txt
2014-05-04 13:09 - 2014-05-04 13:09 - 00000000 ____D () C:\Windows\ERUNT
2014-05-04 12:59 - 2014-05-04 12:59 - 00011939 _____ () C:\Users\*****\Desktop\AdwCleaner[R0].txt
2014-05-04 12:57 - 2014-05-04 12:59 - 00000000 ____D () C:\AdwCleaner
2014-05-04 12:57 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\system32\sqlite3.dll
2014-05-04 12:54 - 2014-05-04 12:56 - 00001149 _____ () C:\Users\*****\Desktop\mbam.txt
2014-05-04 12:24 - 2014-05-04 12:25 - 01016261 _____ (Thisisu) C:\Users\*****\Desktop\JRT.exe
2014-05-04 12:24 - 2014-05-04 12:24 - 01310621 _____ () C:\Users\*****\Desktop\adwcleaner.exe
2014-05-04 11:50 - 2014-05-04 11:50 - 00020950 _____ () C:\Users\*****\Desktop\comfix_mod.txt
2014-05-04 11:48 - 2014-05-04 11:48 - 00021120 _____ () C:\Users\*****\Desktop\comfix.txt
2014-05-04 11:47 - 2014-05-04 11:47 - 00021120 _____ () C:\ComboFix.txt
2014-05-04 11:29 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-05-04 11:26 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-05-04 11:26 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-05-04 11:26 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-05-04 11:26 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-05-04 11:26 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-05-04 11:26 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-05-04 11:26 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-05-04 11:24 - 2014-05-04 11:47 - 00000000 ____D () C:\Qoobox
2014-05-04 11:23 - 2014-05-04 11:45 - 00000000 ____D () C:\Windows\erdnt
2014-05-04 11:23 - 2014-04-29 14:48 - 17384448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-04 11:23 - 2014-04-29 14:34 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-04 11:19 - 2014-05-04 11:19 - 05197895 ____R (Swearware) C:\Users\*****\Desktop\ComboFix.exe
2014-05-04 01:10 - 2014-05-04 01:10 - 00017115 _____ () C:\Users\*****\Desktop\GMER.log
2014-05-04 00:39 - 2014-05-04 01:22 - 00035132 _____ () C:\Users\*****\Desktop\Addition.txt
2014-05-04 00:38 - 2014-05-04 13:20 - 00015924 _____ () C:\Users\*****\Desktop\FRST.txt
2014-05-04 00:37 - 2014-05-04 13:20 - 00000000 ____D () C:\FRST
2014-05-04 00:37 - 2014-05-04 01:11 - 00000450 _____ () C:\Users\*****\Desktop\defogger_disable.log
2014-05-04 00:37 - 2014-05-04 00:37 - 00000000 _____ () C:\Users\*****\defogger_reenable
2014-05-04 00:36 - 2014-05-04 00:36 - 01050624 _____ (Farbar) C:\Users\*****\Desktop\FRST.exe
2014-05-04 00:36 - 2014-05-04 00:36 - 00380416 _____ () C:\Users\*****\Desktop\vdolc97y.exe
2014-05-04 00:36 - 2014-05-04 00:36 - 00009850 _____ () C:\Users\*****\Desktop\Mappe1.xlsx
2014-05-04 00:35 - 2014-05-04 00:35 - 00050477 _____ () C:\Users\*****\Downloads\Defogger.exe
2014-05-03 23:28 - 2014-05-04 12:32 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-03 23:27 - 2014-05-03 23:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-05-03 23:27 - 2014-05-03 23:27 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware
2014-05-03 23:27 - 2014-04-03 09:51 - 00073432 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-03 23:27 - 2014-04-03 09:51 - 00051416 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-03 23:27 - 2014-04-03 09:50 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-03 23:22 - 2014-05-03 23:22 - 00613200 _____ (Chip Digital GmbH) C:\Users\*****\Downloads\Malwarebytes Anti Malware - CHIP-Downloader.exe
2014-04-16 22:48 - 2014-03-06 10:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-04-16 22:48 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-04-16 22:48 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-16 22:48 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-04-16 22:48 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-16 22:48 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-16 22:48 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-16 22:48 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-16 22:48 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-16 22:48 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-04-16 22:48 - 2014-03-06 09:38 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-04-16 22:48 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-04-16 22:48 - 2014-03-06 09:28 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-04-16 22:48 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-04-16 22:48 - 2014-03-06 09:18 - 00575488 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-16 22:48 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-04-16 22:48 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-16 22:48 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-04-16 22:48 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-16 22:48 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-04-16 22:48 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-16 22:48 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-04-16 22:48 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-16 22:48 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-16 22:28 - 2014-03-04 11:17 - 00868352 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
==================== One Month Modified Files and Folders =======
2014-05-04 13:21 - 2014-05-04 00:38 - 00015924 _____ () C:\Users\*****\Desktop\FRST.txt
2014-05-04 13:20 - 2014-05-04 00:37 - 00000000 ____D () C:\FRST
2014-05-04 13:20 - 2011-01-12 12:32 - 00005144 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-04 13:19 - 2014-05-04 13:19 - 00000776 _____ () C:\Users\*****\Desktop\JRT.txt
2014-05-04 13:15 - 2013-12-11 00:14 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cef5f52f0fe202.job
2014-05-04 13:15 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-04 13:15 - 2009-07-14 06:39 - 00192546 _____ () C:\Windows\setupact.log
2014-05-04 13:14 - 2011-01-13 21:31 - 01207720 _____ () C:\Windows\WindowsUpdate.log
2014-05-04 13:12 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\tracing
2014-05-04 13:09 - 2014-05-04 13:09 - 00000000 ____D () C:\Windows\ERUNT
2014-05-04 13:08 - 2009-07-14 06:34 - 00009920 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-04 13:08 - 2009-07-14 06:34 - 00009920 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-04 13:00 - 2011-01-13 21:22 - 00128148 _____ () C:\Windows\PFRO.log
2014-05-04 12:59 - 2014-05-04 12:59 - 00011939 _____ () C:\Users\*****\Desktop\AdwCleaner[R0].txt
2014-05-04 12:59 - 2014-05-04 12:57 - 00000000 ____D () C:\AdwCleaner
2014-05-04 12:56 - 2014-05-04 12:54 - 00001149 _____ () C:\Users\*****\Desktop\mbam.txt
2014-05-04 12:33 - 2011-01-14 20:20 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-04 12:32 - 2014-05-03 23:28 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-04 12:25 - 2014-05-04 12:24 - 01016261 _____ (Thisisu) C:\Users\*****\Desktop\JRT.exe
2014-05-04 12:24 - 2014-05-04 12:24 - 01310621 _____ () C:\Users\*****\Desktop\adwcleaner.exe
2014-05-04 11:50 - 2014-05-04 11:50 - 00020950 _____ () C:\Users\*****\Desktop\comfix_mod.txt
2014-05-04 11:48 - 2014-05-04 11:48 - 00021120 _____ () C:\Users\*****\Desktop\comfix.txt
2014-05-04 11:47 - 2014-05-04 11:47 - 00021120 _____ () C:\ComboFix.txt
2014-05-04 11:47 - 2014-05-04 11:24 - 00000000 ____D () C:\Qoobox
2014-05-04 11:47 - 2009-07-14 04:37 - 00000000 __RHD () C:\Users\Default
2014-05-04 11:47 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public
2014-05-04 11:45 - 2014-05-04 11:23 - 00000000 ____D () C:\Windows\erdnt
2014-05-04 11:41 - 2009-07-14 04:04 - 00000215 _____ () C:\Windows\system.ini
2014-05-04 11:19 - 2014-05-04 11:19 - 05197895 ____R (Swearware) C:\Users\*****\Desktop\ComboFix.exe
2014-05-04 11:16 - 2009-07-14 09:50 - 00000000 ____D () C:\Windows\CSC
2014-05-04 01:22 - 2014-05-04 00:39 - 00035132 _____ () C:\Users\*****\Desktop\Addition.txt
2014-05-04 01:11 - 2014-05-04 00:37 - 00000450 _____ () C:\Users\*****\Desktop\defogger_disable.log
2014-05-04 01:10 - 2014-05-04 01:10 - 00017115 _____ () C:\Users\*****\Desktop\GMER.log
2014-05-04 00:37 - 2014-05-04 00:37 - 00000000 _____ () C:\Users\*****\defogger_reenable
2014-05-04 00:36 - 2014-05-04 00:36 - 01050624 _____ (Farbar) C:\Users\*****\Desktop\FRST.exe
2014-05-04 00:36 - 2014-05-04 00:36 - 00380416 _____ () C:\Users\*****\Desktop\vdolc97y.exe
2014-05-04 00:36 - 2014-05-04 00:36 - 00009850 _____ () C:\Users\*****\Desktop\Mappe1.xlsx
2014-05-04 00:35 - 2014-05-04 00:35 - 00050477 _____ () C:\Users\*****\Downloads\Defogger.exe
2014-05-04 00:05 - 2005-07-03 22:15 - 00000000 ____D () C:\Users\*****\AppData\Roaming\install
2014-05-03 23:27 - 2014-05-03 23:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-05-03 23:27 - 2014-05-03 23:27 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware
2014-05-03 23:27 - 2012-12-19 19:13 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-03 23:22 - 2014-05-03 23:22 - 00613200 _____ (Chip Digital GmbH) C:\Users\*****\Downloads\Malwarebytes Anti Malware - CHIP-Downloader.exe
2014-05-03 21:53 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-04-29 14:48 - 2014-05-04 11:23 - 17384448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-29 14:34 - 2014-05-04 11:23 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-16 22:50 - 2011-01-14 00:48 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-04-16 22:47 - 2013-08-10 21:42 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-16 22:45 - 2011-04-17 15:33 - 88028728 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
Files to move or delete:
====================
C:\ProgramData\PKP_DLes.DAT
C:\ProgramData\PKP_DLet.DAT
C:\ProgramData\PKP_DLev.DAT
Some content of TEMP:
====================
C:\Users\*****\AppData\Local\temp\avgnt.exe
C:\Users\*****\AppData\Local\temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-03-15 14:45
==================== End Of Log ============================
--- --- --- |
|
04.05.2014, 20:02
| #6 |
| /// the machine /// TB-Ausbilder | Windwos 7: Backdoor.Agent.DCEGen, Trojan.Delf und noch ordentlich MalwareESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ --> Windwos 7: Backdoor.Agent.DCEGen, Trojan.Delf und noch ordentlich Malware |
|
| Themen zu Windwos 7: Backdoor.Agent.DCEGen, Trojan.Delf und noch ordentlich Malware |
| 4d36e972-e325-11ce-bfc1-08002be10318, antivirus, appdatalow, backdoor.agent.dcegen, desktop, device driver, downloader, dvdvideosoft ltd., flash player, hijack.userinit, internet explorer, malware, malware.trace, problem, pup.optional.conduit, pup.optional.conduit.a, pup.optional.opencandy, pup.optional.pricegong.a, pup.optional.softonic.a, software, stolen.data, svchost.exe, system, trojan.agent.gen, trojan.delf |
WARNUNG an die MITLESER: 
Linear-Darstellung
