Windows 7 hp-Laptop hat nach Start von windows BKA Bildschirm mit 100 Euro Zahlungsaufforderung

ioandar · 29.05.2014, 16:19

Hallo,

nach dem Windowsstart habe ich einen 'BKA-Bildschirm' über meinem Desktop.

Ich habe die Anleitung auf eurem Board gelesen und mit FRST über USB-Stick eine Logdatei erstellen lassen.

Wäre Klasse wenn mir jemand helfen könnte den Trojaner zu entfernen.

Ich bin zwar technisch nicht ganz unbeleckt, aber hier brauche ich echt hilfe.

Besten Dank und Grüße, Thomas

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-05-2014 02
Ran by SYSTEM on MININT-3RP3PMI on 29-05-2014 16:56:07
Running from I:\
Platform: Windows 7 Professional (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.


The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2804976 2013-10-29] (Synaptics Incorporated)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [348664 2012-07-18] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-20] (Adobe Systems Incorporated)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Startup: C:\Users\wgm\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk
ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\wgm\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk
ShortcutTarget: explorer.lnk -> C:\ProgramData\3C472871614128D3DA081A26B0A2C52F\8ogzfr.cpp ()

==================== Services (Whitelisted) =================

S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [375760 2012-07-18] (Avira Operations GmbH & Co. KG)
S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [86224 2012-07-18] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [110032 2012-07-18] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [465360 2012-07-18] (Avira Operations GmbH & Co. KG)
S2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2266296 2014-05-15] (Microsoft Corporation)
S2 ncpclcfg; C:\Program Files (x86)\LANCOM\Advanced VPN Client\ncpclcfg.exe [139344 2011-07-27] (NCP engineering GmbH)
S2 ncprwsnt; C:\Program Files (x86)\LANCOM\Advanced VPN Client\ncprwsnt.exe [1594448 2012-04-04] (NCP Engineering GmbH)
S2 NcpSec; C:\Program Files (x86)\LANCOM\Advanced VPN Client\NCPSEC.EXE [119808 2011-04-20] ()
S2 Winmgmt; C:\ProgramData\3C472871614128D3DA081A26B0A2C52F\rfzgo8.dot [332020 2014-05-29] (Microsoft Corporation)
S2 wltrysvc; C:\Program Files\Broadcom\Broadcom 802.11\bcmwltry.exe [4819968 2012-08-02] (Broadcom Corporation)
S2 HP Health Check Service; "C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe" [X]
S2 McAfee Endpoint Encryption Agent; "C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe" [X]

==================== Drivers (Whitelisted) ====================

S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98848 2012-07-18] (Avira GmbH)
S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132832 2012-07-18] (Avira GmbH)
S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [27760 2012-07-18] (Avira GmbH)
S3 johci; C:\Windows\System32\DRIVERS\johci.sys [26712 2011-02-08] (JMicron Technology Corp.)
S3 LGDDCDevice; C:\windows\SysWOW64\LGI2CDriver.sys [16384 2012-10-17] (LG Soft India)
S3 LGII2CDevice; C:\windows\SysWOW64\LGPII2CDriver.sys [10752 2012-11-23] (LG Soft India)
S3 ncpfilt; C:\Windows\System32\DRIVERS\ncplelhp.sys [103024 2012-04-03] (NCP Engineering GmbH)
S3 ncplelhp; C:\Windows\System32\DRIVERS\ncplelhp.sys [103024 2012-04-03] (NCP Engineering GmbH)
S3 SPUVCbv; C:\Windows\System32\Drivers\SPUVCbv_x64.sys [2611704 2011-01-12] (Sunplus Technology)
S3 ARCVCAM; system32\DRIVERS\ArcSoftVCapture.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-29 06:32 - 2014-05-29 06:34 - 152430976 _____ (AVG Technologies) C:\Users\wgm\Downloads\avg_free_x86_all_2014_4592a7484.exe
2014-05-29 06:18 - 2014-05-29 06:23 - 00023161 _____ () C:\Users\wgm\Desktop\Addition.txt
2014-05-29 06:17 - 2014-05-29 16:56 - 00000000 ____D () C:\FRST
2014-05-29 06:17 - 2014-05-29 06:23 - 00026632 _____ () C:\Users\wgm\Desktop\FRST.txt
2014-05-29 06:17 - 2014-05-29 06:17 - 02066944 _____ (Farbar) C:\Users\wgm\Desktop\FRST64.exe
2014-05-29 06:16 - 2014-05-29 06:16 - 00000468 _____ () C:\Users\wgm\Desktop\defogger_disable.log
2014-05-29 06:16 - 2014-05-29 06:16 - 00000000 _____ () C:\Users\wgm\defogger_reenable
2014-05-29 06:15 - 2014-05-29 06:15 - 00050477 _____ () C:\Users\wgm\Desktop\Defogger.exe
2014-05-29 06:04 - 2014-05-29 06:04 - 00002008 _____ () C:\Users\wgm\Desktop\Entfernen des Avira EU-Cleaners.lnk
2014-05-29 06:04 - 2014-05-29 06:04 - 00001952 _____ () C:\Users\wgm\Desktop\Avira EU-Cleaner.lnk
2014-05-29 06:03 - 2014-05-29 06:03 - 02209056 _____ () C:\Users\wgm\Desktop\avira-eu-cleaner_de.exe
2014-05-29 01:23 - 2014-05-29 06:37 - 00165947 _____ () C:\ProgramData\RUNDLL32.EXE-3124-F.txt
2014-05-29 01:18 - 2014-05-29 01:23 - 00000000 ____D () C:\ProgramData\3C472871614128D3DA081A26B0A2C52F
2014-05-24 07:36 - 2014-05-05 20:40 - 23544320 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2014-05-24 07:36 - 2014-05-05 20:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2014-05-24 07:36 - 2014-05-05 19:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-24 07:36 - 2014-05-05 19:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-24 07:36 - 2014-05-05 19:00 - 00084992 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2014-05-24 07:36 - 2014-05-05 18:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-24 07:33 - 2014-05-08 22:14 - 00477184 _____ (Microsoft Corporation) C:\Windows\System32\aepdu.dll
2014-05-24 07:33 - 2014-05-08 22:11 - 00424448 _____ (Microsoft Corporation) C:\Windows\System32\aeinv.dll
2014-05-24 07:33 - 2014-04-11 18:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys
2014-05-24 07:33 - 2014-04-11 18:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys
2014-05-24 07:33 - 2014-04-11 18:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\System32\lsasrv.dll
2014-05-24 07:33 - 2014-04-11 18:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\System32\sspicli.dll
2014-05-24 07:33 - 2014-04-11 18:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\System32\lsass.exe
2014-05-24 07:33 - 2014-04-11 18:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\System32\sspisrv.dll
2014-05-24 07:33 - 2014-04-11 18:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\System32\secur32.dll
2014-05-24 07:33 - 2014-04-11 18:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-05-24 07:33 - 2014-04-11 18:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-05-24 07:33 - 2014-03-24 18:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\System32\shell32.dll
2014-05-24 07:33 - 2014-03-24 18:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-05-24 07:33 - 2014-03-04 01:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2014-05-24 07:33 - 2014-03-04 01:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\System32\kerberos.dll
2014-05-24 07:33 - 2014-03-04 01:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\System32\objsel.dll
2014-05-24 07:33 - 2014-03-04 01:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\System32\KernelBase.dll
2014-05-24 07:33 - 2014-03-04 01:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\System32\schannel.dll
2014-05-24 07:33 - 2014-03-04 01:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\System32\msv1_0.dll
2014-05-24 07:33 - 2014-03-04 01:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\System32\wdigest.dll
2014-05-24 07:33 - 2014-03-04 01:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\System32\TSpkg.dll
2014-05-24 07:33 - 2014-03-04 01:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\wincredprovider.dll
2014-05-24 07:33 - 2014-03-04 01:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\System32\winlogon.exe
2014-05-24 07:33 - 2014-03-04 01:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\System32\cngprovider.dll
2014-05-24 07:33 - 2014-03-04 01:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\System32\adprovider.dll
2014-05-24 07:33 - 2014-03-04 01:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\System32\capiprovider.dll
2014-05-24 07:33 - 2014-03-04 01:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\System32\dpapiprovider.dll
2014-05-24 07:33 - 2014-03-04 01:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\System32\dimsroam.dll
2014-05-24 07:33 - 2014-03-04 01:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\System32\credssp.dll
2014-05-24 07:33 - 2014-03-04 01:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2014-05-24 07:33 - 2014-03-04 01:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2014-05-24 07:33 - 2014-03-04 01:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-05-24 07:33 - 2014-03-04 01:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll
2014-05-24 07:33 - 2014-03-04 01:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-05-24 07:33 - 2014-03-04 01:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-05-24 07:33 - 2014-03-04 01:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-05-24 07:33 - 2014-03-04 01:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-05-24 07:33 - 2014-03-04 01:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll
2014-05-24 07:33 - 2014-03-04 01:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll
2014-05-24 07:33 - 2014-03-04 01:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll
2014-05-24 07:33 - 2014-03-04 01:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll
2014-05-24 07:33 - 2014-03-04 01:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll
2014-05-24 07:33 - 2014-03-04 01:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll
2014-05-24 07:33 - 2014-03-04 01:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-05-24 07:33 - 2014-03-04 01:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2014-05-24 07:33 - 2014-01-08 18:22 - 05694464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-05-24 07:33 - 2014-01-03 14:44 - 06574592 _____ (Microsoft Corporation) C:\Windows\System32\mstscax.dll
2014-05-23 06:29 - 2014-05-23 06:29 - 00000000 ____D () C:\Users\wgm\AppData\Roaming\PC-FAX TX
2014-05-23 06:23 - 2014-05-23 06:23 - 00000000 ___RD () C:\Users\wgm\AppData\Roaming\Brother
2014-05-19 01:44 - 2014-05-19 04:55 - 00000000 ____D () C:\Users\wgm\AppData\OICE_15_974FA576_32C1D314_1781
2014-05-14 09:35 - 2014-05-14 09:35 - 436677762 _____ () C:\Windows\MEMORY.DMP
2014-05-14 09:35 - 2014-05-14 09:35 - 00442624 _____ () C:\Windows\Minidump\051414-19812-01.dmp
2014-05-14 09:35 - 2014-05-14 09:35 - 00000000 ____D () C:\Windows\Minidump
2014-05-02 05:39 - 2014-05-02 09:05 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-04-29 01:49 - 2014-04-29 01:49 - 00012262 _____ () C:\Users\wgm\Documents\Kopie von Preiszusammenstellung e shelter_STUCKE_2750 kVA.xlsx

==================== One Month Modified Files and Folders =======

2014-05-29 16:56 - 2014-05-29 06:17 - 00000000 ____D () C:\FRST
2014-05-29 06:47 - 2014-01-24 06:10 - 00021606 _____ () C:\Windows\setupact.log
2014-05-29 06:46 - 2009-07-13 21:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-29 06:37 - 2014-05-29 01:23 - 00165947 _____ () C:\ProgramData\RUNDLL32.EXE-3124-F.txt
2014-05-29 06:37 - 2012-08-02 18:30 - 01338307 _____ () C:\Windows\WindowsUpdate.log
2014-05-29 06:34 - 2014-05-29 06:32 - 152430976 _____ (AVG Technologies) C:\Users\wgm\Downloads\avg_free_x86_all_2014_4592a7484.exe
2014-05-29 06:23 - 2014-05-29 06:18 - 00023161 _____ () C:\Users\wgm\Desktop\Addition.txt
2014-05-29 06:23 - 2014-05-29 06:17 - 00026632 _____ () C:\Users\wgm\Desktop\FRST.txt
2014-05-29 06:22 - 2014-02-20 13:21 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-29 06:17 - 2014-05-29 06:17 - 02066944 _____ (Farbar) C:\Users\wgm\Desktop\FRST64.exe
2014-05-29 06:16 - 2014-05-29 06:16 - 00000468 _____ () C:\Users\wgm\Desktop\defogger_disable.log
2014-05-29 06:16 - 2014-05-29 06:16 - 00000000 _____ () C:\Users\wgm\defogger_reenable
2014-05-29 06:16 - 2014-02-10 02:28 - 00000000 ____D () C:\users\wgm
2014-05-29 06:15 - 2014-05-29 06:15 - 00050477 _____ () C:\Users\wgm\Desktop\Defogger.exe
2014-05-29 06:04 - 2014-05-29 06:04 - 00002008 _____ () C:\Users\wgm\Desktop\Entfernen des Avira EU-Cleaners.lnk
2014-05-29 06:04 - 2014-05-29 06:04 - 00001952 _____ () C:\Users\wgm\Desktop\Avira EU-Cleaner.lnk
2014-05-29 06:03 - 2014-05-29 06:03 - 02209056 _____ () C:\Users\wgm\Desktop\avira-eu-cleaner_de.exe
2014-05-29 01:45 - 2014-03-13 08:53 - 00005128 _____ () C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for STUCKE26-wgm NB021.stucke26.lokal
2014-05-29 01:31 - 2009-07-13 20:45 - 00020720 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-29 01:31 - 2009-07-13 20:45 - 00020720 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-29 01:23 - 2014-05-29 01:18 - 00000000 ____D () C:\ProgramData\3C472871614128D3DA081A26B0A2C52F
2014-05-29 00:14 - 2011-03-08 09:03 - 00742284 _____ () C:\Windows\System32\perfh007.dat
2014-05-29 00:14 - 2011-03-08 09:03 - 00163448 _____ () C:\Windows\System32\perfc007.dat
2014-05-29 00:14 - 2009-07-13 21:13 - 01703604 _____ () C:\Windows\System32\PerfStringBackup.INI
2014-05-28 09:14 - 2014-03-13 08:44 - 00005128 _____ () C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for {80b42046-c09a-4b3e-9538-4176a042811e} NB021.stucke26.lokal
2014-05-28 06:20 - 2014-02-10 02:11 - 00000128 _____ () C:\Windows\System32\config\netlogon.ftl
2014-05-27 04:55 - 2014-02-10 04:53 - 00000000 ____D () C:\Users\wgm\AppData\Local\Deployment
2014-05-24 22:58 - 2014-01-28 01:24 - 00173666 _____ () C:\Windows\PFRO.log
2014-05-24 08:58 - 2014-01-23 06:35 - 00003212 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForNB021$
2014-05-24 08:58 - 2014-01-23 06:35 - 00000336 _____ () C:\Windows\Tasks\HPCeeScheduleForNB021$.job
2014-05-24 08:37 - 2014-01-23 12:34 - 00000000 ____D () C:\Windows\rescache
2014-05-24 08:10 - 2014-01-28 01:41 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2014-05-24 07:51 - 2014-02-10 02:29 - 00000000 ___RD () C:\Users\wgm\Virtual Machines
2014-05-24 07:48 - 2014-04-26 06:03 - 00000000 ___SD () C:\Windows\System32\CompatTel
2014-05-24 07:48 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-05-24 07:36 - 2014-01-23 11:48 - 00000000 ____D () C:\Windows\System32\MRT
2014-05-24 07:35 - 2014-01-23 11:48 - 93223848 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2014-05-23 06:30 - 2014-02-04 02:43 - 00000851 _____ () C:\Windows\Brpfx04a.ini
2014-05-23 06:29 - 2014-05-23 06:29 - 00000000 ____D () C:\Users\wgm\AppData\Roaming\PC-FAX TX
2014-05-23 06:29 - 2014-02-04 02:43 - 00000159 _____ () C:\Windows\brpcfx.ini
2014-05-23 06:23 - 2014-05-23 06:23 - 00000000 ___RD () C:\Users\wgm\AppData\Roaming\Brother
2014-05-19 04:55 - 2014-05-19 01:44 - 00000000 ____D () C:\Users\wgm\AppData\OICE_15_974FA576_32C1D314_1781
2014-05-14 23:22 - 2014-02-20 13:21 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-05-14 23:22 - 2014-02-10 05:09 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-05-14 23:22 - 2014-02-10 05:09 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-14 09:38 - 2009-07-13 21:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2014-05-14 09:35 - 2014-05-14 09:35 - 436677762 _____ () C:\Windows\MEMORY.DMP
2014-05-14 09:35 - 2014-05-14 09:35 - 00442624 _____ () C:\Windows\Minidump\051414-19812-01.dmp
2014-05-14 09:35 - 2014-05-14 09:35 - 00000000 ____D () C:\Windows\Minidump
2014-05-13 08:39 - 2009-07-13 19:20 - 00000000 __RHD () C:\Users\Public\Libraries
2014-05-09 02:49 - 2014-04-22 02:06 - 00025621 _____ () C:\Users\wgm\Desktop\winmail.dat
2014-05-08 22:14 - 2014-05-24 07:33 - 00477184 _____ (Microsoft Corporation) C:\Windows\System32\aepdu.dll
2014-05-08 22:11 - 2014-05-24 07:33 - 00424448 _____ (Microsoft Corporation) C:\Windows\System32\aeinv.dll
2014-05-05 20:40 - 2014-05-24 07:36 - 23544320 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2014-05-05 20:17 - 2014-05-24 07:36 - 02724864 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2014-05-05 19:25 - 2014-05-24 07:36 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-05 19:07 - 2014-05-24 07:36 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-05 19:00 - 2014-05-24 07:36 - 00084992 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2014-05-05 18:10 - 2014-05-24 07:36 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-02 23:37 - 2014-03-10 01:45 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-05-02 09:05 - 2014-05-02 05:39 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-04-29 01:49 - 2014-04-29 01:49 - 00012262 _____ () C:\Users\wgm\Documents\Kopie von Preiszusammenstellung e shelter_STUCKE_2750 kVA.xlsx

Some content of TEMP:
====================
C:\Users\User01\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\User01\AppData\Local\Temp\install_reader11_de_mssd_aaa_aih.exe
C:\Users\User01\AppData\Local\Temp\MouseKeyboardCenterx64_1031.exe
C:\Users\User01\AppData\Local\Temp\MSNF77A.exe
C:\Users\User01\AppData\Local\Temp\OfficeSetup.exe
C:\Users\User01\AppData\Local\Temp\Setup.X86.de-DE_HomeBusinessRetail_10e42936-8c3a-4bb0-b237-708a60784538_TX_DB_.exe
C:\Users\wgm\AppData\Local\Temp\0147.dll
C:\Users\wgm\AppData\Local\Temp\uninstall.exe


==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== Restore Points  =========================

Restore point made on: 2014-05-29 02:58:27
Restore point made on: 2014-05-29 05:23:10
Restore point made on: 2014-05-29 05:41:17
Restore point made on: 2014-05-29 06:36:27

==================== Memory info =========================== 

Percentage of memory in use: 14%
Total physical RAM: 4030.36 MB
Available physical RAM: 3437.98 MB
Total Pagefile: 4028.5 MB
Available Pagefile: 3431.54 MB
Total Virtual: 8192 MB
Available Virtual: 8191.89 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:60 GB) (Free:14.3 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Daten) (Fixed) (Total:218.76 GB) (Free:217.73 GB) NTFS
Drive e: (HP_RECOVERY) (Fixed) (Total:16.18 GB) (Free:2.43 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive f: (HP_TOOLS) (Fixed) (Total:2.86 GB) (Free:2.85 GB) FAT32
Drive g: (SYSTEM) (Fixed) (Total:0.29 GB) (Free:0.25 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive i: (MY STICK) (Removable) (Total:14.92 GB) (Free:4.58 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.13 GB) (Free:0.12 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: 8DC080E5)
Partition 1: (Active) - (Size=298 MB) - (Type=42)
Partition 2: (Not Active) - (Size=60 GB) - (Type=42)
Partition 3: (Not Active) - (Size=238 GB) - (Type=42)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 15 GB) (Disk ID: C3072E18)
Partition 1: (Active) - (Size=15 GB) - (Type=0C)


LastRegBack: 2014-05-29 00:54

==================== End Of Log ============================

schrauber · 29.05.2014, 16:46

hi,

Drücke bitte die

+ R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

Startup: C:\Users\wgm\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk
ShortcutTarget: explorer.lnk -> C:\ProgramData\3C472871614128D3DA081A26B0A2C52F\8ogzfr.cpp ()
S2 Winmgmt; C:\ProgramData\3C472871614128D3DA081A26B0A2C52F\rfzgo8.dot [332020 2014-05-29] (Microsoft Corporation)
2014-05-29 01:18 - 2014-05-29 01:23 - 00000000 ____D () C:\ProgramData\3C472871614128D3DA081A26B0A2C52F

Speichere diese bitte als Fixlist.txt auf deinem USB Stick.

Starte deinen Rechner erneut in die Reparaturoptionen
Starte nun die FRST.exe erneut und klicke den Entfernen Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

Rechner normal starten.

ioandar · 29.05.2014, 17:09

Heya,

besten dank für die schnelle Hilfe! Ich habe die Datei via USB kopiert und auf dem Laptop mit FRST ausgeführt.

Hier das Logfile nach dem Lauf

gruss thomas

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 25-05-2014 02
Ran by SYSTEM at 2014-05-29 18:02:28 Run:1
Running from I:\
Boot Mode: Recovery
==============================================

Content of fixlist:
*****************
Startup: C:\Users\wgm\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk 
ShortcutTarget: explorer.lnk -> C:\ProgramData\3C472871614128D3DA081A26B0A2C52F\8ogzfr.cpp () 
S2 Winmgmt; C:\ProgramData\3C472871614128D3DA081A26B0A2C52F\rfzgo8.dot [332020 2014-05-29] (Microsoft Corporation) 
2014-05-29 01:18 - 2014-05-29 01:23 - 00000000 ____D () C:\ProgramData\3C472871614128D3DA081A26B0A2C52F

*****************

C:\Users\wgm\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.lnk => Moved successfully.
C:\ProgramData\3C472871614128D3DA081A26B0A2C52F\8ogzfr.cpp => Moved successfully.
Winmgmt => Service restored successfully.
C:\ProgramData\3C472871614128D3DA081A26B0A2C52F => Moved successfully.

==== End of Fixlog ====

schrauber · 30.05.2014, 15:45

STartet der Rechner normal?

ioandar · 30.05.2014, 15:55

Hallo,

sorry das ich nicht gleich geantwortet habe.

ja, der bildschirm ist weg. super! vielen vielen dank für die schnelle hilfe!

ich habe meinen virenscanner (avira) geprüft ob er aktuell ist. er ist es. findet aber nichts.

dann habe ich den avira rootkit scanner probiert. der findest auch nichts.

Ich bin echt froh das ich hier hilfe gefunden habe!

was sollte ich jetzt tun (ausser in zukunft vorsichtiger zu sein)?

danke und gruss, thomas

schrauber · 31.05.2014, 15:07

Wir sind noch nit fertig, ab jetzt alles im normalen MOdus:

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

ioandar · 04.06.2014, 14:05

Hallo,

hier die Dateien nach dem scan...

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-06-2014
Ran by wgm (administrator) on NB021 on 04-06-2014 15:01:19
Running from C:\Users\wgm\Desktop
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(Validity Sensors, Inc.) C:\Windows\System32\vcsFPService.exe
(Broadcom Corporation) C:\Program Files\Broadcom\Broadcom 802.11\WLTRYSVC.EXE
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Broadcom Corporation) C:\Program Files\Broadcom\Broadcom 802.11\BCMWLTRY.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(LSI Corporation) C:\Program Files\LSI SoftModem\agr64svc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(NCP engineering GmbH) C:\Program Files (x86)\LANCOM\Advanced VPN Client\ncpclcfg.exe
(NCP Engineering GmbH) C:\Program Files (x86)\LANCOM\Advanced VPN Client\ncprwsnt.exe
() C:\Program Files (x86)\LANCOM\Advanced VPN Client\NCPSEC.EXE
(Portrait Displays, Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfcMon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\BrccMCtl.exe
(NCP engineering GmbH) C:\Program Files (x86)\LANCOM\Advanced VPN Client\NCPMON.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\OUTLOOK.EXE
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2804976 2013-10-30] (Synaptics Incorporated)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [348664 2012-07-18] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
HKU\.DEFAULT\...\RunOnce: [SPReview] - C:\windows\System32\SPReview\SPReview.exe [301568 2014-01-24] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Status Monitor.lnk
ShortcutTarget: Status Monitor.lnk -> C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe (Brother Industries, Ltd.)
Startup: C:\Users\wgm\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk
ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPCOM/10
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCOM/10
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=CMNTDF
SearchScopes: HKLM - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=CMNTDF
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=CMNTDF
SearchScopes: HKLM-x32 - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=CMNTDF
SearchScopes: HKCU - DefaultScope {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL = 
BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL (Microsoft Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.113.10 192.168.113.11 192.168.113.10

FireFox:
========
FF ProfilePath: C:\Users\wgm\AppData\Roaming\Mozilla\Firefox\Profiles\ubxhfdhc.default
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Adblock Plus - C:\Users\wgm\AppData\Roaming\Mozilla\Firefox\Profiles\ubxhfdhc.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-02-10]

==================== Services (Whitelisted) =================

R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [375760 2012-07-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [86224 2012-07-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [110032 2012-07-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [465360 2012-07-18] (Avira Operations GmbH & Co. KG)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2266296 2014-05-16] (Microsoft Corporation)
R2 ncpclcfg; C:\Program Files (x86)\LANCOM\Advanced VPN Client\ncpclcfg.exe [139344 2011-07-27] (NCP engineering GmbH)
R2 ncprwsnt; C:\Program Files (x86)\LANCOM\Advanced VPN Client\ncprwsnt.exe [1594448 2012-04-04] (NCP Engineering GmbH)
R2 NcpSec; C:\Program Files (x86)\LANCOM\Advanced VPN Client\NCPSEC.EXE [119808 2011-04-21] ()
R2 wltrysvc; C:\Program Files\Broadcom\Broadcom 802.11\bcmwltry.exe [4819968 2012-08-03] (Broadcom Corporation)
S2 HP Health Check Service; "C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe" [X]
S2 McAfee Endpoint Encryption Agent; "C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe" [X]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98848 2012-07-18] (Avira GmbH)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132832 2012-07-18] (Avira GmbH)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [27760 2012-07-18] (Avira GmbH)
R3 johci; C:\Windows\System32\DRIVERS\johci.sys [26712 2011-02-08] (JMicron Technology Corp.)
S3 LGDDCDevice; C:\windows\SysWOW64\LGI2CDriver.sys [16384 2012-10-17] (LG Soft India)
S3 LGII2CDevice; C:\windows\SysWOW64\LGPII2CDriver.sys [10752 2012-11-23] (LG Soft India)
S3 ncpfilt; C:\Windows\System32\DRIVERS\ncplelhp.sys [103024 2012-04-03] (NCP Engineering GmbH)
R3 ncplelhp; C:\Windows\System32\DRIVERS\ncplelhp.sys [103024 2012-04-03] (NCP Engineering GmbH)
R3 SPUVCbv; C:\Windows\System32\Drivers\SPUVCbv_x64.sys [2611704 2011-01-12] (Sunplus Technology)
S3 ARCVCAM; system32\DRIVERS\ArcSoftVCapture.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-04 15:00 - 2014-06-04 15:01 - 00010588 _____ () C:\Users\wgm\Desktop\FRST.txt
2014-06-04 14:59 - 2014-06-04 14:59 - 02068992 _____ (Farbar) C:\Users\wgm\Desktop\FRST64.exe
2014-06-04 14:59 - 2014-06-04 14:59 - 00000000 ____D () C:\Users\wgm\Desktop\FRST-OlderVersion
2014-05-29 18:33 - 2014-05-29 18:33 - 00000303 _____ () C:\Users\wgm\Desktop\Trojaner.URL
2014-05-29 16:32 - 2014-05-29 16:34 - 152430976 _____ (AVG Technologies) C:\Users\wgm\Downloads\avg_free_x86_all_2014_4592a7484.exe
2014-05-29 16:17 - 2014-06-04 15:01 - 00000000 ____D () C:\FRST
2014-05-29 16:16 - 2014-05-29 16:16 - 00000000 _____ () C:\Users\wgm\defogger_reenable
2014-05-29 11:23 - 2014-05-29 16:37 - 00165947 _____ () C:\ProgramData\RUNDLL32.EXE-3124-F.txt
2014-05-24 17:36 - 2014-05-06 06:40 - 23544320 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-05-24 17:36 - 2014-05-06 06:17 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-05-24 17:36 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2014-05-24 17:36 - 2014-05-06 05:07 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2014-05-24 17:36 - 2014-05-06 05:00 - 00084992 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-05-24 17:36 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2014-05-24 17:33 - 2014-05-09 08:14 - 00477184 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2014-05-24 17:33 - 2014-05-09 08:11 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2014-05-24 17:33 - 2014-04-12 04:22 - 00155072 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
2014-05-24 17:33 - 2014-04-12 04:22 - 00095680 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys
2014-05-24 17:33 - 2014-04-12 04:19 - 01460736 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
2014-05-24 17:33 - 2014-04-12 04:19 - 00136192 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll
2014-05-24 17:33 - 2014-04-12 04:19 - 00031232 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe
2014-05-24 17:33 - 2014-04-12 04:19 - 00029184 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll
2014-05-24 17:33 - 2014-04-12 04:19 - 00028160 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll
2014-05-24 17:33 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\windows\SysWOW64\secur32.dll
2014-05-24 17:33 - 2014-04-12 04:10 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\sspicli.dll
2014-05-24 17:33 - 2014-03-25 04:43 - 14175744 _____ (Microsoft Corporation) C:\windows\system32\shell32.dll
2014-05-24 17:33 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\windows\SysWOW64\shell32.dll
2014-05-24 17:33 - 2014-03-04 11:47 - 05550016 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2014-05-24 17:33 - 2014-03-04 11:44 - 00728064 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll
2014-05-24 17:33 - 2014-03-04 11:44 - 00722944 _____ (Microsoft Corporation) C:\windows\system32\objsel.dll
2014-05-24 17:33 - 2014-03-04 11:44 - 00424960 _____ (Microsoft Corporation) C:\windows\system32\KernelBase.dll
2014-05-24 17:33 - 2014-03-04 11:44 - 00340992 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2014-05-24 17:33 - 2014-03-04 11:44 - 00314880 _____ (Microsoft Corporation) C:\windows\system32\msv1_0.dll
2014-05-24 17:33 - 2014-03-04 11:44 - 00210944 _____ (Microsoft Corporation) C:\windows\system32\wdigest.dll
2014-05-24 17:33 - 2014-03-04 11:44 - 00086528 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll
2014-05-24 17:33 - 2014-03-04 11:44 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\wincredprovider.dll
2014-05-24 17:33 - 2014-03-04 11:43 - 00455168 _____ (Microsoft Corporation) C:\windows\system32\winlogon.exe
2014-05-24 17:33 - 2014-03-04 11:43 - 00057344 _____ (Microsoft Corporation) C:\windows\system32\cngprovider.dll
2014-05-24 17:33 - 2014-03-04 11:43 - 00056832 _____ (Microsoft Corporation) C:\windows\system32\adprovider.dll
2014-05-24 17:33 - 2014-03-04 11:43 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\capiprovider.dll
2014-05-24 17:33 - 2014-03-04 11:43 - 00052736 _____ (Microsoft Corporation) C:\windows\system32\dpapiprovider.dll
2014-05-24 17:33 - 2014-03-04 11:43 - 00044544 _____ (Microsoft Corporation) C:\windows\system32\dimsroam.dll
2014-05-24 17:33 - 2014-03-04 11:43 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll
2014-05-24 17:33 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe
2014-05-24 17:33 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe
2014-05-24 17:33 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll
2014-05-24 17:33 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\windows\SysWOW64\objsel.dll
2014-05-24 17:33 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\windows\SysWOW64\msv1_0.dll
2014-05-24 17:33 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
2014-05-24 17:33 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\windows\SysWOW64\wdigest.dll
2014-05-24 17:33 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\windows\SysWOW64\TSpkg.dll
2014-05-24 17:33 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\windows\SysWOW64\cngprovider.dll
2014-05-24 17:33 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\windows\SysWOW64\adprovider.dll
2014-05-24 17:33 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\windows\SysWOW64\capiprovider.dll
2014-05-24 17:33 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\windows\SysWOW64\dpapiprovider.dll
2014-05-24 17:33 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\windows\SysWOW64\dimsroam.dll
2014-05-24 17:33 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\windows\SysWOW64\wincredprovider.dll
2014-05-24 17:33 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\windows\SysWOW64\credssp.dll
2014-05-24 17:33 - 2014-03-04 11:16 - 00274944 _____ (Microsoft Corporation) C:\windows\SysWOW64\KernelBase.dll
2014-05-24 17:33 - 2014-01-09 04:22 - 05694464 _____ (Microsoft Corporation) C:\windows\SysWOW64\mstscax.dll
2014-05-24 17:33 - 2014-01-04 00:44 - 06574592 _____ (Microsoft Corporation) C:\windows\system32\mstscax.dll
2014-05-23 16:29 - 2014-05-23 16:29 - 00000000 ____D () C:\Users\wgm\AppData\Roaming\PC-FAX TX
2014-05-23 16:23 - 2014-05-23 16:23 - 00000000 ___RD () C:\Users\wgm\AppData\Roaming\Brother
2014-05-19 11:44 - 2014-05-19 14:55 - 00000000 ____D () C:\Users\wgm\AppData\OICE_15_974FA576_32C1D314_1781
2014-05-14 19:35 - 2014-05-14 19:35 - 436677762 _____ () C:\windows\MEMORY.DMP
2014-05-14 19:35 - 2014-05-14 19:35 - 00442624 _____ () C:\windows\Minidump\051414-19812-01.dmp
2014-05-14 19:35 - 2014-05-14 19:35 - 00000000 ____D () C:\windows\Minidump

==================== One Month Modified Files and Folders =======

2014-06-04 15:01 - 2014-06-04 15:00 - 00010588 _____ () C:\Users\wgm\Desktop\FRST.txt
2014-06-04 15:01 - 2014-05-29 16:17 - 00000000 ____D () C:\FRST
2014-06-04 15:01 - 2014-02-10 12:28 - 00000000 ____D () C:\Users\wgm\AppData\Local\Temp
2014-06-04 15:01 - 2011-03-08 19:03 - 00742284 _____ () C:\windows\system32\perfh007.dat
2014-06-04 15:01 - 2011-03-08 19:03 - 00163448 _____ () C:\windows\system32\perfc007.dat
2014-06-04 15:01 - 2009-07-14 07:13 - 01703604 _____ () C:\windows\system32\PerfStringBackup.INI
2014-06-04 14:59 - 2014-06-04 14:59 - 02068992 _____ (Farbar) C:\Users\wgm\Desktop\FRST64.exe
2014-06-04 14:59 - 2014-06-04 14:59 - 00000000 ____D () C:\Users\wgm\Desktop\FRST-OlderVersion
2014-06-04 14:35 - 2014-02-10 12:11 - 00000128 _____ () C:\windows\system32\config\netlogon.ftl
2014-06-04 14:22 - 2014-02-20 23:21 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-06-04 14:18 - 2014-03-13 18:44 - 00005126 _____ () C:\windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for {80b42046-c09a-4b3e-9538-4176a042811e} NB021.stucke26.lokal
2014-06-04 13:56 - 2014-02-10 14:53 - 00000000 ____D () C:\Users\wgm\AppData\Local\Deployment
2014-06-04 12:05 - 2012-08-03 04:30 - 01445198 _____ () C:\windows\WindowsUpdate.log
2014-06-04 11:41 - 2009-07-14 06:45 - 00020720 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-04 11:41 - 2009-07-14 06:45 - 00020720 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-04 11:37 - 2014-03-13 18:53 - 00005128 _____ () C:\windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for STUCKE26-wgm NB021.stucke26.lokal
2014-06-04 11:34 - 2014-01-24 16:10 - 00022054 _____ () C:\windows\setupact.log
2014-06-04 11:34 - 2009-07-14 07:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-06-03 19:05 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
2014-06-01 12:02 - 2014-02-10 12:28 - 00000000 ____D () C:\Users\wgm
2014-06-01 12:01 - 2014-01-23 16:35 - 00000000 ____D () C:\Users\User01
2014-06-01 12:01 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\system32\NDF
2014-06-01 12:01 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\registration
2014-05-30 04:02 - 2014-02-10 12:29 - 00000000 ___RD () C:\Users\wgm\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-29 18:33 - 2014-05-29 18:33 - 00000303 _____ () C:\Users\wgm\Desktop\Trojaner.URL
2014-05-29 16:37 - 2014-05-29 11:23 - 00165947 _____ () C:\ProgramData\RUNDLL32.EXE-3124-F.txt
2014-05-29 16:34 - 2014-05-29 16:32 - 152430976 _____ (AVG Technologies) C:\Users\wgm\Downloads\avg_free_x86_all_2014_4592a7484.exe
2014-05-29 16:16 - 2014-05-29 16:16 - 00000000 _____ () C:\Users\wgm\defogger_reenable
2014-05-25 08:58 - 2014-01-28 11:24 - 00173666 _____ () C:\windows\PFRO.log
2014-05-24 18:58 - 2014-01-23 16:35 - 00003212 _____ () C:\windows\System32\Tasks\HPCeeScheduleForNB021$
2014-05-24 18:58 - 2014-01-23 16:35 - 00000336 _____ () C:\windows\Tasks\HPCeeScheduleForNB021$.job
2014-05-24 18:37 - 2014-01-23 22:34 - 00000000 ____D () C:\windows\rescache
2014-05-24 18:10 - 2014-01-28 11:41 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2014-05-24 17:51 - 2014-02-10 12:29 - 00000000 ___RD () C:\Users\wgm\Virtual Machines
2014-05-24 17:51 - 2014-02-10 12:29 - 00000000 ___RD () C:\Users\wgm\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-24 17:48 - 2014-04-26 16:03 - 00000000 ___SD () C:\windows\system32\CompatTel
2014-05-24 17:48 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\PolicyDefinitions
2014-05-24 17:36 - 2014-01-23 21:48 - 00000000 ____D () C:\windows\system32\MRT
2014-05-24 17:35 - 2014-01-23 21:48 - 93223848 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-05-23 16:30 - 2014-02-04 12:43 - 00000851 _____ () C:\windows\Brpfx04a.ini
2014-05-23 16:29 - 2014-05-23 16:29 - 00000000 ____D () C:\Users\wgm\AppData\Roaming\PC-FAX TX
2014-05-23 16:29 - 2014-02-04 12:43 - 00000159 _____ () C:\windows\brpcfx.ini
2014-05-23 16:23 - 2014-05-23 16:23 - 00000000 ___RD () C:\Users\wgm\AppData\Roaming\Brother
2014-05-19 14:55 - 2014-05-19 11:44 - 00000000 ____D () C:\Users\wgm\AppData\OICE_15_974FA576_32C1D314_1781
2014-05-15 17:52 - 2014-01-24 15:45 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-05-15 09:22 - 2014-02-20 23:21 - 00003822 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2014-05-15 09:22 - 2014-02-10 15:09 - 00692400 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2014-05-15 09:22 - 2014-02-10 15:09 - 00070832 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-14 19:38 - 2009-07-14 07:09 - 00000000 ____D () C:\windows\System32\Tasks\WPD
2014-05-14 19:35 - 2014-05-14 19:35 - 436677762 _____ () C:\windows\MEMORY.DMP
2014-05-14 19:35 - 2014-05-14 19:35 - 00442624 _____ () C:\windows\Minidump\051414-19812-01.dmp
2014-05-14 19:35 - 2014-05-14 19:35 - 00000000 ____D () C:\windows\Minidump
2014-05-13 18:39 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Public\Libraries
2014-05-13 18:28 - 2009-07-14 06:57 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2014-05-09 12:49 - 2014-04-22 12:06 - 00025621 _____ () C:\Users\wgm\Desktop\winmail.dat
2014-05-09 08:14 - 2014-05-24 17:33 - 00477184 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2014-05-09 08:11 - 2014-05-24 17:33 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2014-05-06 06:40 - 2014-05-24 17:36 - 23544320 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-05-06 06:17 - 2014-05-24 17:36 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-05-06 05:25 - 2014-05-24 17:36 - 17382912 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2014-05-06 05:07 - 2014-05-24 17:36 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2014-05-06 05:00 - 2014-05-24 17:36 - 00084992 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-05-06 04:10 - 2014-05-24 17:36 - 00069632 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll

Some content of TEMP:
====================
C:\Users\User01\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\User01\AppData\Local\Temp\install_reader11_de_mssd_aaa_aih.exe
C:\Users\User01\AppData\Local\Temp\MouseKeyboardCenterx64_1031.exe
C:\Users\User01\AppData\Local\Temp\MSNF77A.exe
C:\Users\User01\AppData\Local\Temp\OfficeSetup.exe
C:\Users\User01\AppData\Local\Temp\Setup.X86.de-DE_HomeBusinessRetail_10e42936-8c3a-4bb0-b237-708a60784538_TX_DB_.exe
C:\Users\wgm\AppData\Local\Temp\0147.dll
C:\Users\wgm\AppData\Local\Temp\uninstall.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-05-29 10:54

==================== End Of Log ============================

--- --- ---

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 02-06-2014
Ran by wgm at 2014-06-04 15:01:39
Running from C:\Users\wgm\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: LANCOM Advanced VPN Client (Disabled) {2E93E888-9DAC-5065-8626-9C7F7A0820C2}

==================== Installed Programs ======================

2007 Microsoft Office Suite Service Pack 1 (SP1) (x32 Version:  - Microsoft) Hidden
ActiveCheck component for HP Active Support Library (x32 Version: 3.0.0.3 - Hewlett-Packard) Hidden
Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.07) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)
Alcor Micro Smart Card Reader Driver (HKLM-x32\...\SZCCID) (Version: 1.7.16.0 - Alcor Micro Corp.)
Alcor Micro Smart Card Reader Driver (x32 Version: 1.7.16.0 - Alcor Micro Corp.) Hidden
Avira Professional Security (HKLM-x32\...\Avira AntiVir Desktop) (Version: 12.1.9.1580 - Avira)
Broadcom 2070 Bluetooth 3.0 (HKLM\...\{436E0B79-2CFB-4E5F-9380-E17C1B25D0C5}) (Version: 6.3.0.6300 - Broadcom Corporation)
Broadcom 802.11 Wireless LAN Adapter (HKLM\...\Broadcom 802.11 Wireless LAN Adapter) (Version: 5.60.48.61 - Broadcom Corporation)
Broadcom Wireless Utility (HKLM\...\Broadcom Wireless Utility) (Version: 5.60.48.61 - Broadcom Corporation)
Brother MFL-Pro Suite MFC-5890CN (HKLM-x32\...\{20E970DF-A7B2-4345-9DEB-72213A29645E}) (Version: 1.0.1.0 - Brother Industries, Ltd.)
CA 01 - der interaktive Katalog von Industry Automation and Drive Technologies (x32 Version: 25.00.0001 - SIEMENS AG) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.09 - Piriform)
Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
DirectX 9 Runtime (x32 Version: 1.00.0000 - Sonic Solutions) Hidden
Dual Smart Solution (HKLM-x32\...\{E61F7C73-277C-44CE-87C4-B574BF0F3803}) (Version: 2.5 - LG Soft India Pvt Ltd)
Fließtexteditor 1.6 (NAV 2009) (HKLM-x32\...\ST6UNST #1) (Version:  - )
German Module for Microsoft Dynamics NAV Documentation (x32 Version: 7.0.33781.0 - Microsoft Corporation) Hidden
German Module for Microsoft Dynamics NAV Role Tailored Client (x32 Version: 7.0.33781.0 - Microsoft Corporation) Hidden
HP 3D DriveGuard (HKLM\...\{83DA38AB-1014-41C2-A3CD-E2B93832A71A}) (Version: 4.1.4.1 - Hewlett-Packard Company)
HP Auto (Version: 1.0.12494.3472 - Hewlett-Packard Company) Hidden
HP Customer Experience Enhancements (x32 Version: 6.0.1.7 - Hewlett-Packard) Hidden
HP HD Webcam [Fixed] (HKLM-x32\...\Sunplus SPUVCb) (Version: 3.3.4.07 - SunplusIT)
HP Web Camera (Version: 1.0.0 - Hewlett-Packard) Hidden
HP Webcam (HKLM-x32\...\{1D61E881-43CD-447B-9E6B-D2C6138B2862}) (Version: 1.0.25.0 - Roxio)
HPAsset component for HP Active Support Library (x32 Version: 3.0.0.3 - Hewlett-Packard) Hidden
IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6325.0 - IDT)
Intel(R) Identity Protection Technology 1.0.71.0 (HKLM-x32\...\{2C43790E-8470-1027-82D3-DF319F3C410F}) (Version: 1.0.71.0 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
Intel(R) Network Connections Drivers (HKLM\...\PROSet) (Version: 15.4 - Intel)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2291 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.1.2.1004 - Intel Corporation)
JMicron 1394 Filter Driver (HKLM-x32\...\{13C96625-28E4-4c58-ADE0-CDAFC64752EB}) (Version: 1.00.21.00 - JMicron Technology Corp.)
JMicron Flash Media Controller Driver (HKLM-x32\...\{26604C7E-A313-4D12-867F-7C6E7820BE4C}) (Version: 1.0.57.2 - JMicron Technology Corp.)
LANCOM Advanced VPN Client (HKLM-x32\...\NCP RWS/GA) (Version: 2.30 Build 146 - LANCOM Systems GmbH)
LSI HDA Modem (HKLM\...\LSI Soft Modem) (Version: 2.2.100 - LSI Corporation)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Chart Controls for Microsoft .NET Framework 3.5 (KB2500170) (HKLM-x32\...\{41785C66-90F2-40CE-8CB5-1C94BFC97280}) (Version: 3.5.30730.0 - Microsoft Corporation)
Microsoft Dynamics NAV 2013 (HKLM-x32\...\DynamicsNav70) (Version: 7.0.33781.0 - Microsoft Corporation)
Microsoft Dynamics NAV Documentation (x32 Version: 7.0.33781.0 - Microsoft Corporation) Hidden
Microsoft Dynamics NAV RoleTailored Client (x32 Version: 7.0.33781.0 - Microsoft Corporation) Hidden
Microsoft Dynamics NAV Setup (x32 Version: 7.0.33781.0 - Microsoft Corporation) Hidden
Microsoft Exchange Web Services Managed API 1.1 (HKLM\...\{CD1E6306-E482-4403-801C-F93409324634}) (Version: 14.2.51.0 - Microsoft Corporation)
Microsoft Office 2007 Primary Interop Assemblies (HKLM-x32\...\{50120000-1105-0000-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Office Home and Business 2013 - de-de (HKLM\...\HomeBusinessRetail - de-de) (Version: 15.0.4615.1002 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6215.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6213.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6213.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6213.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6213.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6215.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6215.1000 - Microsoft Corporation) Hidden
Microsoft Office SharePoint Designer 2007 (HKLM-x32\...\SharePointDesigner) (Version: 12.0.6215.1000 - Microsoft Corporation)
Microsoft Office SharePoint Designer 2007 (x32 Version: 12.0.6215.1000 - Microsoft Corporation) Hidden
Microsoft Office SharePoint Designer 2007 Service Pack 1 (SP1) (HKLM-x32\...\{90120000-0017-0000-0000-0000000FF1CE}_SharePointDesigner_{37180755-CA2B-40AD-9637-89FB0CE7CB36}) (Version:  - Microsoft)
Microsoft Office SharePoint Designer 2007 Service Pack 1 (SP1) (x32 Version:  - Microsoft) Hidden
Microsoft Office SharePoint Designer MUI (German) 2007 (x32 Version: 12.0.6215.1000 - Microsoft Corporation) Hidden
Microsoft OneDrive (HKCU\...\OneDriveSetup.exe) (Version: 17.0.4029.0217 - Microsoft Corporation)
Microsoft ReportViewer 2010 SP1 Redistributable (HKLM-x32\...\{72DEBE5A-5667-3966-8E8D-2FD5FBCCB7DD}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft SharePoint Client Runtime (HKLM\...\{90140000-1013-0409-1000-0000000FF1CE}) (Version: 14.0.4763.1041 - Microsoft Corporation)
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 4.0.50401.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (Version: 10.0.30319 - Microsoft Corporation) Hidden
Microsoft-Maus- und Tastatur-Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.2.173.0 - Microsoft Corporation)
Microsoft-Maus- und Tastatur-Center (Version: 2.2.173.0 - Microsoft Corporation) Hidden
Mozilla Firefox 28.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 28.0 (x86 de)) (Version: 28.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 24.5.0 - Mozilla)
Mozilla Thunderbird 24.5.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 24.5.0 (x86 de)) (Version: 24.5.0 - Mozilla)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4615.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4615.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4615.1002 - Microsoft Corporation) Hidden
Open XML SDK 2.0 for Microsoft Office (HKLM-x32\...\{171D8D76-3F05-455A-A8AF-C561C2679905}) (Version: 2.0.5022 - Microsoft Corporation)
SDK (x32 Version: 2.24.025 - Portrait Displays, Inc.) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.18.8 - Synaptics Incorporated)
Validity Fingerprint Sensor Driver (HKLM\...\{FFC3E41D-2C2B-45B7-9AD9-5EA19572DD26}) (Version: 4.3.117.0 - Validity Sensors, Inc.)
Zetadocs Express (HKLM-x32\...\{AA6B2E36-18DA-44FE-8C78-4EFCC03DD72C}) (Version: 5.5.305.89 - Equisys plc)

==================== Restore Points  =========================

04-06-2014 10:20:40 Geplanter Prüfpunkt

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {19093BE3-7970-49A9-BC48-B27F9E21C7D6} - System32\Tasks\Hewlett-Packard\HP Support Assistant\First Boot => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF_Utils.exe
Task: {24A164A9-9052-4BE0-AE25-976CB9E40960} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2013-05-13] (Microsoft Corporation)
Task: {479D032D-1769-4B25-951D-8923086573D9} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2013-05-13] (Microsoft Corporation)
Task: {54BC9917-DD4C-4159-A70E-BF130274B5B4} - System32\Tasks\HPCeeScheduleForNB021$ => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14] (Hewlett-Packard)
Task: {59E82598-3BD6-4E4F-9C13-BC4DBE903B72} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-15] (Adobe Systems Incorporated)
Task: {67B115FC-C6A9-4DAB-A4B0-8E0888D410D0} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {68103C66-DD2A-4BD6-B0AF-AB076440F7C5} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2013-05-13] (Microsoft Corporation)
Task: {6A66F954-82C4-4C49-877D-5155D858A2D9} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2014-04-15] (Microsoft Corporation)
Task: {8BAF7632-3B22-49BF-98D4-F577F21EAB65} - System32\Tasks\Microsoft Office 15 Sync Maintenance for {80b42046-c09a-4b3e-9538-4176a042811e} NB021.stucke26.lokal => C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [2014-05-24] (Microsoft Corporation)
Task: {904CDACF-A42E-4E23-B7F6-14F2580A9543} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2013-05-13] (Microsoft)
Task: {9DEA6EAC-7CC7-45BC-B830-58B7D77F60DA} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2013-05-13] (Microsoft Corporation)
Task: {BC0AFFAF-7617-40C3-8444-1E088ECF434A} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-12-17] (Piriform Ltd)
Task: {EF68FEB4-943F-4737-BF1C-460250BB6903} - System32\Tasks\Microsoft Office 15 Sync Maintenance for STUCKE26-wgm NB021.stucke26.lokal => C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [2014-05-24] (Microsoft Corporation)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\HPCeeScheduleForNB021$.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

==================== Loaded Modules (whitelisted) =============

2014-03-30 10:31 - 2013-10-31 18:13 - 00102568 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2014-01-28 11:41 - 2014-04-15 03:39 - 00630952 _____ () C:\Program Files\Microsoft Office 15\ClientX64\StreamServer.dll
2014-01-24 11:25 - 2010-04-14 13:56 - 01742336 _____ () C:\Program Files (x86)\LANCOM\Advanced VPN Client\x64\libeay32.dll
2014-01-24 11:25 - 2011-10-12 17:43 - 00165888 _____ () C:\Program Files (x86)\LANCOM\Advanced VPN Client\x64\ncpbudget2008.dll
2014-01-24 11:25 - 2012-03-07 16:01 - 00102912 _____ () C:\Program Files (x86)\LANCOM\Advanced VPN Client\x64\ncpmif32.dll
2014-01-24 11:25 - 2011-04-21 09:11 - 00119808 _____ () C:\Program Files (x86)\LANCOM\Advanced VPN Client\NCPSEC.EXE
2014-01-23 17:44 - 2012-07-18 19:08 - 00398288 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2014-01-24 11:25 - 2012-03-07 15:59 - 00098304 _____ () C:\Program Files (x86)\LANCOM\Advanced VPN Client\ncpmif32.dll
2014-01-24 11:25 - 2011-12-22 17:28 - 01724416 _____ () C:\Program Files (x86)\LANCOM\Advanced VPN Client\ncpgacc.dll
2014-02-04 12:43 - 2009-02-27 17:38 - 00139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll
2014-01-28 11:41 - 2014-04-09 12:42 - 00316584 _____ () C:\Program Files\Microsoft Office 15\root\office15\AppVIsvStream32.dll
2014-02-24 12:33 - 2014-02-24 12:33 - 00169472 _____ () C:\windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\3e27ac2000641918e7215d97c63e957d\IsdiInterop.ni.dll
2012-08-03 04:35 - 2011-01-13 03:56 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2014-01-24 11:25 - 2011-12-01 13:55 - 00195072 _____ () C:\Program Files (x86)\LANCOM\Advanced VPN Client\ncpdlg.dll
2014-01-24 11:25 - 2002-06-28 12:16 - 00151552 _____ () C:\Program Files (x86)\LANCOM\Advanced VPN Client\ncpcfg.dll
2014-01-24 11:25 - 2002-09-04 17:27 - 00102400 _____ () C:\Program Files (x86)\LANCOM\Advanced VPN Client\ncpcry.dll
2014-05-24 17:45 - 2014-05-24 18:07 - 01032360 _____ () C:\Program Files\Microsoft Office 15\Root\Office15\ADDINS\UmOutlookAddin.dll
2014-04-25 09:25 - 2014-04-25 09:25 - 03642480 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== EXE Association (whitelisted) =============


==================== Disabled items from MSCONFIG ==============

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Bluetooth.lnk => C:\windows\pss\Bluetooth.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Dual Smart Solution.lnk => C:\windows\pss\Dual Smart Solution.lnk.CommonStartup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: BrMfcWnd => C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
MSCONFIG\startupreg: Broadcom Wireless Manager UI => C:\Program Files\Broadcom\Broadcom 802.11\WLTRAY.exe
MSCONFIG\startupreg: ControlCenter3 => C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe /autorun
MSCONFIG\startupreg: File Sanitizer => C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\CoreShredder.exe
MSCONFIG\startupreg: HotKeysCmds => C:\windows\system32\hkcmd.exe
MSCONFIG\startupreg: HP HD Webcam [Fixed]_Monitor => C:\Program Files (x86)\HP HD Webcam [Fixed]\monitor.exe
MSCONFIG\startupreg: IAStorIcon => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
MSCONFIG\startupreg: IgfxTray => C:\windows\system32\igfxtray.exe
MSCONFIG\startupreg: LightScribe Control Panel => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
MSCONFIG\startupreg: NcpBudgetGui => "C:\Program Files (x86)\LANCOM\Advanced VPN Client\NcpBudgetGui.exe" -start
MSCONFIG\startupreg: NcpMonitor => "C:\Program Files (x86)\LANCOM\Advanced VPN Client\ncpmon.exe" autorun
MSCONFIG\startupreg: NcpPopup => "C:\Program Files (x86)\LANCOM\Advanced VPN Client\ncppopup.exe" noerrmsg
MSCONFIG\startupreg: PDF Complete => C:\Program Files (x86)\PDF Complete\pdfsty.exe
MSCONFIG\startupreg: Persistence => C:\windows\system32\igfxpers.exe
MSCONFIG\startupreg: SynTPEnh => %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
MSCONFIG\startupreg: SysTrayApp => C:\Program Files\IDT\WDM\sttray64.exe

==================== Faulty Device Manager Devices =============

Name: Broadcom 2070 Bluetooth
Description: Broadcom 2070 Bluetooth
Class Guid: {e0cbf06c-cd8b-4647-bb8a-263b43f0f974}
Manufacturer: Broadcom
Service: BTHUSB
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (06/04/2014 11:44:49 AM) (Source: AutoEnrollment) (EventID: 6) (User: )
Description: STUCKE26\wgm0x8007041dDer Dienst antwortete nicht rechtzeitig auf die Start- oder Steuerungsanforderung.

Error: (06/03/2014 00:52:53 PM) (Source: AutoEnrollment) (EventID: 6) (User: )
Description: STUCKE26\wgm0x8007003aDer angegebene Server kann den angeforderten Vorgang nicht ausführen.

Error: (06/02/2014 04:56:45 PM) (Source: AutoEnrollment) (EventID: 6) (User: )
Description: STUCKE26\wgm0x8007003aDer angegebene Server kann den angeforderten Vorgang nicht ausführen.

Error: (06/02/2014 09:04:52 AM) (Source: AutoEnrollment) (EventID: 6) (User: )
Description: STUCKE26\wgm0x8007041dDer Dienst antwortete nicht rechtzeitig auf die Start- oder Steuerungsanforderung.

Error: (06/01/2014 06:50:22 PM) (Source: Avira Antivirus) (EventID: 4129) (User: NT-AUTORITÄT)
Description: Das Update von NB021 (192.168.2.102) ist fehlgeschlagen.
Während des Herunterladens ist ein Fehler aufgetreten. .
Es wurden keine neuen Dateien geladen.

Error: (06/01/2014 05:50:08 PM) (Source: Avira Antivirus) (EventID: 4129) (User: NT-AUTORITÄT)
Description: Das Update von NB021 (192.168.2.102) ist fehlgeschlagen.
Während des Herunterladens ist ein Fehler aufgetreten. .
Es wurden keine neuen Dateien geladen.

Error: (06/01/2014 04:50:09 PM) (Source: Avira Antivirus) (EventID: 4129) (User: NT-AUTORITÄT)
Description: Das Update von NB021 (192.168.2.102) ist fehlgeschlagen.
Während des Herunterladens ist ein Fehler aufgetreten. .
Es wurden keine neuen Dateien geladen.

Error: (06/01/2014 03:50:08 PM) (Source: Avira Antivirus) (EventID: 4129) (User: NT-AUTORITÄT)
Description: Das Update von NB021 (192.168.2.102) ist fehlgeschlagen.
Während des Herunterladens ist ein Fehler aufgetreten. .
Es wurden keine neuen Dateien geladen.

Error: (06/01/2014 02:50:07 PM) (Source: Avira Antivirus) (EventID: 4129) (User: NT-AUTORITÄT)
Description: Das Update von NB021 (192.168.2.102) ist fehlgeschlagen.
Während des Herunterladens ist ein Fehler aufgetreten. .
Es wurden keine neuen Dateien geladen.

Error: (06/01/2014 01:50:07 PM) (Source: Avira Antivirus) (EventID: 4129) (User: NT-AUTORITÄT)
Description: Das Update von NB021 (192.168.2.102) ist fehlgeschlagen.
Während des Herunterladens ist ein Fehler aufgetreten. .
Es wurden keine neuen Dateien geladen.


System errors:
=============
Error: (06/04/2014 01:16:43 PM) (Source: Microsoft-Windows-GroupPolicy) (EventID: 1129) (User: NT-AUTORITÄT)
Description: Bei der Verarbeitung der Gruppenrichtlinie ist aufgrund fehlender Netzwerkkonnektivität mit einem Domänencontroller ein Fehler aufgetreten. Dies kann eine vorübergehende Bedingung sein. Es wird eine Erfolgsmeldung generiert, wenn die Verbindung des Computers mit dem Domänencontroller wiederhergestellt wurde und wenn die Gruppenrichtlinie erfolgreich verarbeitet wurde. Falls für mehrere Stunden keine Erfolgsmeldung angezeigt wird, wenden Sie sich an den Administrator.

Error: (06/04/2014 01:16:41 PM) (Source: Microsoft-Windows-GroupPolicy) (EventID: 1129) (User: STUCKE26)
Description: Bei der Verarbeitung der Gruppenrichtlinie ist aufgrund fehlender Netzwerkkonnektivität mit einem Domänencontroller ein Fehler aufgetreten. Dies kann eine vorübergehende Bedingung sein. Es wird eine Erfolgsmeldung generiert, wenn die Verbindung des Computers mit dem Domänencontroller wiederhergestellt wurde und wenn die Gruppenrichtlinie erfolgreich verarbeitet wurde. Falls für mehrere Stunden keine Erfolgsmeldung angezeigt wird, wenden Sie sich an den Administrator.

Error: (06/04/2014 00:20:33 PM) (Source: volsnap) (EventID: 36) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.

Error: (06/04/2014 11:42:11 AM) (Source: Microsoft-Windows-GroupPolicy) (EventID: 1030) (User: STUCKE26)
Description: Fehler bei der Verarbeitung der Gruppenrichtlinie. Es wurde versucht, neue Gruppenrichtlinieneinstellungen für diesen Benutzer oder Computer abzurufen. Den Fehlercode und eine Beschreibung finden Sie auf der Registerkarte "Details". Dieser Vorgang wird automatisch beim nächsten Aktualisierungszyklus wiederholt. Computer, die der Domäne beigetreten sind, müssen über eine geeignete Namensauflösung sowie über eine Netzwerkverbindung zu einem Domänencontroller zum Ermitteln von neuen Gruppenrichtlinienobjekten und -einstellungen verfügen. Wenn die Gruppenrichtlinie erfolgreich ist, wird ein Ereignis protokolliert.

Error: (06/04/2014 11:37:06 AM) (Source: Microsoft-Windows-GroupPolicy) (EventID: 1129) (User: STUCKE26)
Description: Bei der Verarbeitung der Gruppenrichtlinie ist aufgrund fehlender Netzwerkkonnektivität mit einem Domänencontroller ein Fehler aufgetreten. Dies kann eine vorübergehende Bedingung sein. Es wird eine Erfolgsmeldung generiert, wenn die Verbindung des Computers mit dem Domänencontroller wiederhergestellt wurde und wenn die Gruppenrichtlinie erfolgreich verarbeitet wurde. Falls für mehrere Stunden keine Erfolgsmeldung angezeigt wird, wenden Sie sich an den Administrator.

Error: (06/04/2014 11:37:04 AM) (Source: Microsoft-Windows-GroupPolicy) (EventID: 1129) (User: NT-AUTORITÄT)
Description: Bei der Verarbeitung der Gruppenrichtlinie ist aufgrund fehlender Netzwerkkonnektivität mit einem Domänencontroller ein Fehler aufgetreten. Dies kann eine vorübergehende Bedingung sein. Es wird eine Erfolgsmeldung generiert, wenn die Verbindung des Computers mit dem Domänencontroller wiederhergestellt wurde und wenn die Gruppenrichtlinie erfolgreich verarbeitet wurde. Falls für mehrere Stunden keine Erfolgsmeldung angezeigt wird, wenden Sie sich an den Administrator.

Error: (06/04/2014 11:36:47 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "HP Health Check Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (06/04/2014 11:34:30 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "McAfee Endpoint Encryption Agent" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (06/04/2014 11:34:29 AM) (Source: NETLOGON) (EventID: 5719) (User: )
Description: Der Computer konnte eine sichere Sitzung mit einem
Domänencontroller in der Domäne STUCKE26 aufgrund der folgenden
Ursache nicht einrichten: 
%%1311

Dies kann zu Authentifizierungsproblemen führen. Stellen
Sie sicher, dass der Computer mit dem Netzwerk verbunden ist.
Wenden Sie sich an den Domänenadministrator, wenn das Problem
weiterhin besteht.



ZUSÄTZLICHE INFORMATIONEN

Wenn dieser Computer ein Domänencontroller der bestimmten
Domäne ist, wird eine sichere Sitzung zum primären
Domänencontrolleremulator in der bestimmten Domäne eingerichtet.
Andernfalls richtet dieser Computer eine sichere Sitzung zu
einem beliebigen Domänencontroller in der bestimmten Domäne ein.

Error: (06/03/2014 06:12:40 PM) (Source: Microsoft-Windows-GroupPolicy) (EventID: 1129) (User: STUCKE26)
Description: Bei der Verarbeitung der Gruppenrichtlinie ist aufgrund fehlender Netzwerkkonnektivität mit einem Domänencontroller ein Fehler aufgetreten. Dies kann eine vorübergehende Bedingung sein. Es wird eine Erfolgsmeldung generiert, wenn die Verbindung des Computers mit dem Domänencontroller wiederhergestellt wurde und wenn die Gruppenrichtlinie erfolgreich verarbeitet wurde. Falls für mehrere Stunden keine Erfolgsmeldung angezeigt wird, wenden Sie sich an den Administrator.


Microsoft Office Sessions:
=========================

==================== Memory info =========================== 

Percentage of memory in use: 46%
Total physical RAM: 4030.36 MB
Available physical RAM: 2137.35 MB
Total Pagefile: 8058.89 MB
Available Pagefile: 5967.69 MB
Total Virtual: 8192 MB
Available Virtual: 8191.86 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:60 GB) (Free:14.08 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Daten) (Fixed) (Total:218.76 GB) (Free:217.73 GB) NTFS
Drive e: (HP_RECOVERY) (Fixed) (Total:16.18 GB) (Free:2.43 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive f: (HP_TOOLS) (Fixed) (Total:2.86 GB) (Free:2.85 GB) FAT32
Drive h: (MY STICK) (Removable) (Total:14.92 GB) (Free:4.58 GB) FAT32
Drive z: (root) (Network) (Total:495.06 GB) (Free:495.06 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: 8DC080E5)
Partition 1: (Active) - (Size=298 MB) - (Type=42)
Partition 2: (Not Active) - (Size=60 GB) - (Type=42)
Partition 3: (Not Active) - (Size=238 GB) - (Type=42)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 15 GB) (Disk ID: C3072E18)
Partition 1: (Active) - (Size=15 GB) - (Type=0C)

==================== End Of Log ============================

schrauber · 05.06.2014, 11:50

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

ioandar · 05.06.2014, 16:06

Hallo,

hier die Dateien

AdwCleaner.txt
AdwCleaner Logfile:

Code:

ATTFilter

# AdwCleaner v3.211 - Bericht erstellt am 05/06/2014 um 16:46:10
# Aktualisiert 26/05/2014 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : wgm - NB021
# Gestartet von : C:\Users\wgm\Desktop\adwcleaner_3.211.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Datei Gelöscht : C:\Users\wgm\AppData\Local\Temp\Uninstall.exe

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17041


-\\ Mozilla Firefox v29.0.1 (de)

[ Datei : C:\Users\User01\AppData\Roaming\Mozilla\Firefox\Profiles\ry7320ca.default\prefs.js ]


[ Datei : C:\Users\wgm\AppData\Roaming\Mozilla\Firefox\Profiles\ubxhfdhc.default\prefs.js ]


*************************

AdwCleaner[R0].txt - [1500 octets] - [05/06/2014 16:42:58]
AdwCleaner[S0].txt - [1413 octets] - [05/06/2014 16:46:10]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1473 octets] ##########

--- --- ---

mbam.txt

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 05.06.2014
Suchlauf-Zeit: 16:22:25
Logdatei: mbam.txt
Administrator: Ja

Version: 2.00.2.1012
Malware Datenbank: v2014.06.05.08
Rootkit Datenbank: v2014.06.02.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: wgm

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 296601
Verstrichene Zeit: 11 Min, 7 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 0
(No malicious items detected)

Registrierungswerte: 0
(No malicious items detected)

Registrierungsdaten: 0
(No malicious items detected)

Ordner: 0
(No malicious items detected)

Dateien: 1
Trojan.Ransom.ED, C:\Users\wgm\AppData\Local\Temp\0147.dll, , [508ccea65e1d10264f91087961a0fe02], 

Physische Sektoren: 0
(No malicious items detected)


(end)

jrt.txt

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Professional x64
Ran by wgm on 05.06.2014 at 16:50:28,16
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ FireFox

Emptied folder: C:\Users\wgm\AppData\Roaming\mozilla\firefox\profiles\ubxhfdhc.default\minidumps [8 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 05.06.2014 at 16:56:03,83
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST.txt

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-06-2014
Ran by wgm (administrator) on NB021 on 05-06-2014 16:56:44
Running from C:\Users\wgm\Desktop
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(Validity Sensors, Inc.) C:\Windows\System32\vcsFPService.exe
(Broadcom Corporation) C:\Program Files\Broadcom\Broadcom 802.11\WLTRYSVC.EXE
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Broadcom Corporation) C:\Program Files\Broadcom\Broadcom 802.11\BCMWLTRY.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(LSI Corporation) C:\Program Files\LSI SoftModem\agr64svc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(NCP engineering GmbH) C:\Program Files (x86)\LANCOM\Advanced VPN Client\ncpclcfg.exe
(NCP Engineering GmbH) C:\Program Files (x86)\LANCOM\Advanced VPN Client\ncprwsnt.exe
() C:\Program Files (x86)\LANCOM\Advanced VPN Client\NCPSEC.EXE
(Portrait Displays, Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfcMon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\MSOSYNC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2804976 2013-10-30] (Synaptics Incorporated)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [348664 2012-07-18] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
HKU\.DEFAULT\...\RunOnce: [SPReview] - C:\windows\System32\SPReview\SPReview.exe [301568 2014-01-24] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Status Monitor.lnk
ShortcutTarget: Status Monitor.lnk -> C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe (Brother Industries, Ltd.)
Startup: C:\Users\wgm\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk
ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPCOM/10
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCOM/10
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL (Microsoft Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\wgm\AppData\Roaming\Mozilla\Firefox\Profiles\ubxhfdhc.default
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Adblock Plus - C:\Users\wgm\AppData\Roaming\Mozilla\Firefox\Profiles\ubxhfdhc.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-02-10]

==================== Services (Whitelisted) =================

S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [375760 2012-07-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [86224 2012-07-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [110032 2012-07-18] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [465360 2012-07-18] (Avira Operations GmbH & Co. KG)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2266296 2014-05-16] (Microsoft Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 ncpclcfg; C:\Program Files (x86)\LANCOM\Advanced VPN Client\ncpclcfg.exe [139344 2011-07-27] (NCP engineering GmbH)
R2 ncprwsnt; C:\Program Files (x86)\LANCOM\Advanced VPN Client\ncprwsnt.exe [1594448 2012-04-04] (NCP Engineering GmbH)
R2 NcpSec; C:\Program Files (x86)\LANCOM\Advanced VPN Client\NCPSEC.EXE [119808 2011-04-21] ()
R2 wltrysvc; C:\Program Files\Broadcom\Broadcom 802.11\bcmwltry.exe [4819968 2012-08-03] (Broadcom Corporation)
S2 HP Health Check Service; "C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe" [X]
S2 McAfee Endpoint Encryption Agent; "C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe" [X]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98848 2012-07-18] (Avira GmbH)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132832 2012-07-18] (Avira GmbH)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [27760 2012-07-18] (Avira GmbH)
R3 johci; C:\Windows\System32\DRIVERS\johci.sys [26712 2011-02-08] (JMicron Technology Corp.)
S3 LGDDCDevice; C:\windows\SysWOW64\LGI2CDriver.sys [16384 2012-10-17] (LG Soft India)
S3 LGII2CDevice; C:\windows\SysWOW64\LGPII2CDriver.sys [10752 2012-11-23] (LG Soft India)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-06-05] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)
S3 ncpfilt; C:\Windows\System32\DRIVERS\ncplelhp.sys [103024 2012-04-03] (NCP Engineering GmbH)
R3 ncplelhp; C:\Windows\System32\DRIVERS\ncplelhp.sys [103024 2012-04-03] (NCP Engineering GmbH)
R3 SPUVCbv; C:\Windows\System32\Drivers\SPUVCbv_x64.sys [2611704 2011-01-12] (Sunplus Technology)
S3 ARCVCAM; system32\DRIVERS\ArcSoftVCapture.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-05 16:56 - 2014-06-05 16:56 - 00010261 _____ () C:\Users\wgm\Desktop\FRST.txt
2014-06-05 16:56 - 2014-06-05 16:56 - 00000752 _____ () C:\Users\wgm\Desktop\JRT.txt
2014-06-05 16:50 - 2014-06-05 16:50 - 00000000 ____D () C:\windows\ERUNT
2014-06-05 16:49 - 2014-06-05 16:49 - 01016261 _____ (Thisisu) C:\Users\wgm\Downloads\JRT.exe
2014-06-05 16:49 - 2014-06-05 16:49 - 00001561 _____ () C:\Users\wgm\Desktop\AdwCleaner.txt
2014-06-05 16:42 - 2014-06-05 16:46 - 00000000 ____D () C:\AdwCleaner
2014-06-05 16:41 - 2014-06-05 16:41 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-06-05 16:37 - 2014-06-05 16:37 - 01327971 _____ () C:\Users\wgm\Downloads\adwcleaner_3.211.exe
2014-06-05 16:35 - 2014-06-05 16:35 - 00001223 _____ () C:\Users\wgm\Desktop\mbam.txt
2014-06-05 16:21 - 2014-06-05 16:49 - 00122584 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-05 16:20 - 2014-06-05 16:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-05 16:20 - 2014-06-05 16:20 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-05 16:20 - 2014-06-05 16:20 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-06-05 16:20 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2014-06-05 16:20 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2014-06-05 16:20 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2014-06-05 16:16 - 2014-06-05 16:16 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\wgm\Downloads\mbam-setup-2.0.2.1012.exe
2014-06-04 14:59 - 2014-06-05 16:13 - 00000000 ____D () C:\Users\wgm\Desktop\FRST-OlderVersion
2014-05-29 18:33 - 2014-05-29 18:33 - 00000303 _____ () C:\Users\wgm\Desktop\Trojaner.URL
2014-05-29 16:32 - 2014-05-29 16:34 - 152430976 _____ (AVG Technologies) C:\Users\wgm\Downloads\avg_free_x86_all_2014_4592a7484.exe
2014-05-29 16:17 - 2014-06-05 16:56 - 00000000 ____D () C:\FRST
2014-05-29 16:17 - 2014-06-05 16:13 - 02068992 _____ (Farbar) C:\Users\wgm\Desktop\FRST64.exe
2014-05-29 16:16 - 2014-05-29 16:16 - 00000000 _____ () C:\Users\wgm\defogger_reenable
2014-05-29 11:23 - 2014-05-29 16:37 - 00165947 _____ () C:\ProgramData\RUNDLL32.EXE-3124-F.txt
2014-05-24 17:36 - 2014-05-06 06:40 - 23544320 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-05-24 17:36 - 2014-05-06 06:17 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-05-24 17:36 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2014-05-24 17:36 - 2014-05-06 05:07 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2014-05-24 17:36 - 2014-05-06 05:00 - 00084992 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-05-24 17:36 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2014-05-24 17:33 - 2014-05-09 08:14 - 00477184 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2014-05-24 17:33 - 2014-05-09 08:11 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2014-05-24 17:33 - 2014-04-12 04:22 - 00155072 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
2014-05-24 17:33 - 2014-04-12 04:22 - 00095680 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys
2014-05-24 17:33 - 2014-04-12 04:19 - 01460736 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
2014-05-24 17:33 - 2014-04-12 04:19 - 00136192 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll
2014-05-24 17:33 - 2014-04-12 04:19 - 00031232 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe
2014-05-24 17:33 - 2014-04-12 04:19 - 00029184 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll
2014-05-24 17:33 - 2014-04-12 04:19 - 00028160 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll
2014-05-24 17:33 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\windows\SysWOW64\secur32.dll
2014-05-24 17:33 - 2014-04-12 04:10 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\sspicli.dll
2014-05-24 17:33 - 2014-03-25 04:43 - 14175744 _____ (Microsoft Corporation) C:\windows\system32\shell32.dll
2014-05-24 17:33 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\windows\SysWOW64\shell32.dll
2014-05-24 17:33 - 2014-03-04 11:47 - 05550016 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2014-05-24 17:33 - 2014-03-04 11:44 - 00728064 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll
2014-05-24 17:33 - 2014-03-04 11:44 - 00722944 _____ (Microsoft Corporation) C:\windows\system32\objsel.dll
2014-05-24 17:33 - 2014-03-04 11:44 - 00424960 _____ (Microsoft Corporation) C:\windows\system32\KernelBase.dll
2014-05-24 17:33 - 2014-03-04 11:44 - 00340992 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2014-05-24 17:33 - 2014-03-04 11:44 - 00314880 _____ (Microsoft Corporation) C:\windows\system32\msv1_0.dll
2014-05-24 17:33 - 2014-03-04 11:44 - 00210944 _____ (Microsoft Corporation) C:\windows\system32\wdigest.dll
2014-05-24 17:33 - 2014-03-04 11:44 - 00086528 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll
2014-05-24 17:33 - 2014-03-04 11:44 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\wincredprovider.dll
2014-05-24 17:33 - 2014-03-04 11:43 - 00455168 _____ (Microsoft Corporation) C:\windows\system32\winlogon.exe
2014-05-24 17:33 - 2014-03-04 11:43 - 00057344 _____ (Microsoft Corporation) C:\windows\system32\cngprovider.dll
2014-05-24 17:33 - 2014-03-04 11:43 - 00056832 _____ (Microsoft Corporation) C:\windows\system32\adprovider.dll
2014-05-24 17:33 - 2014-03-04 11:43 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\capiprovider.dll
2014-05-24 17:33 - 2014-03-04 11:43 - 00052736 _____ (Microsoft Corporation) C:\windows\system32\dpapiprovider.dll
2014-05-24 17:33 - 2014-03-04 11:43 - 00044544 _____ (Microsoft Corporation) C:\windows\system32\dimsroam.dll
2014-05-24 17:33 - 2014-03-04 11:43 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll
2014-05-24 17:33 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe
2014-05-24 17:33 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe
2014-05-24 17:33 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll
2014-05-24 17:33 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\windows\SysWOW64\objsel.dll
2014-05-24 17:33 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\windows\SysWOW64\msv1_0.dll
2014-05-24 17:33 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
2014-05-24 17:33 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\windows\SysWOW64\wdigest.dll
2014-05-24 17:33 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\windows\SysWOW64\TSpkg.dll
2014-05-24 17:33 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\windows\SysWOW64\cngprovider.dll
2014-05-24 17:33 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\windows\SysWOW64\adprovider.dll
2014-05-24 17:33 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\windows\SysWOW64\capiprovider.dll
2014-05-24 17:33 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\windows\SysWOW64\dpapiprovider.dll
2014-05-24 17:33 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\windows\SysWOW64\dimsroam.dll
2014-05-24 17:33 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\windows\SysWOW64\wincredprovider.dll
2014-05-24 17:33 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\windows\SysWOW64\credssp.dll
2014-05-24 17:33 - 2014-03-04 11:16 - 00274944 _____ (Microsoft Corporation) C:\windows\SysWOW64\KernelBase.dll
2014-05-24 17:33 - 2014-01-09 04:22 - 05694464 _____ (Microsoft Corporation) C:\windows\SysWOW64\mstscax.dll
2014-05-24 17:33 - 2014-01-04 00:44 - 06574592 _____ (Microsoft Corporation) C:\windows\system32\mstscax.dll
2014-05-23 16:29 - 2014-05-23 16:29 - 00000000 ____D () C:\Users\wgm\AppData\Roaming\PC-FAX TX
2014-05-23 16:23 - 2014-05-23 16:23 - 00000000 ___RD () C:\Users\wgm\AppData\Roaming\Brother
2014-05-19 11:44 - 2014-05-19 14:55 - 00000000 ____D () C:\Users\wgm\AppData\OICE_15_974FA576_32C1D314_1781
2014-05-14 19:35 - 2014-05-14 19:35 - 436677762 _____ () C:\windows\MEMORY.DMP
2014-05-14 19:35 - 2014-05-14 19:35 - 00442624 _____ () C:\windows\Minidump\051414-19812-01.dmp
2014-05-14 19:35 - 2014-05-14 19:35 - 00000000 ____D () C:\windows\Minidump

==================== One Month Modified Files and Folders =======

2014-06-05 16:56 - 2014-06-05 16:56 - 00010261 _____ () C:\Users\wgm\Desktop\FRST.txt
2014-06-05 16:56 - 2014-06-05 16:56 - 00000752 _____ () C:\Users\wgm\Desktop\JRT.txt
2014-06-05 16:56 - 2014-05-29 16:17 - 00000000 ____D () C:\FRST
2014-06-05 16:56 - 2014-02-10 12:28 - 00000000 ____D () C:\Users\wgm\AppData\Local\Temp
2014-06-05 16:54 - 2011-03-08 19:03 - 00742284 _____ () C:\windows\system32\perfh007.dat
2014-06-05 16:54 - 2011-03-08 19:03 - 00163448 _____ () C:\windows\system32\perfc007.dat
2014-06-05 16:54 - 2009-07-14 07:13 - 01703604 _____ () C:\windows\system32\PerfStringBackup.INI
2014-06-05 16:54 - 2009-07-14 06:45 - 00020720 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-05 16:54 - 2009-07-14 06:45 - 00020720 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-05 16:50 - 2014-06-05 16:50 - 00000000 ____D () C:\windows\ERUNT
2014-06-05 16:49 - 2014-06-05 16:49 - 01016261 _____ (Thisisu) C:\Users\wgm\Downloads\JRT.exe
2014-06-05 16:49 - 2014-06-05 16:49 - 00001561 _____ () C:\Users\wgm\Desktop\AdwCleaner.txt
2014-06-05 16:49 - 2014-06-05 16:21 - 00122584 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-05 16:49 - 2014-03-13 18:53 - 00005128 _____ () C:\windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for STUCKE26-wgm NB021.stucke26.lokal
2014-06-05 16:47 - 2014-01-24 16:10 - 00022222 _____ () C:\windows\setupact.log
2014-06-05 16:47 - 2009-07-14 07:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-06-05 16:46 - 2014-06-05 16:42 - 00000000 ____D () C:\AdwCleaner
2014-06-05 16:46 - 2014-03-10 11:45 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-06-05 16:46 - 2014-01-28 11:24 - 00174546 _____ () C:\windows\PFRO.log
2014-06-05 16:46 - 2012-08-03 04:30 - 01474475 _____ () C:\windows\WindowsUpdate.log
2014-06-05 16:41 - 2014-06-05 16:41 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-06-05 16:39 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
2014-06-05 16:37 - 2014-06-05 16:37 - 01327971 _____ () C:\Users\wgm\Downloads\adwcleaner_3.211.exe
2014-06-05 16:35 - 2014-06-05 16:35 - 00001223 _____ () C:\Users\wgm\Desktop\mbam.txt
2014-06-05 16:35 - 2014-02-10 12:26 - 00000000 ____D () C:\windows\pss
2014-06-05 16:22 - 2014-02-20 23:21 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-06-05 16:20 - 2014-06-05 16:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-05 16:20 - 2014-06-05 16:20 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-05 16:20 - 2014-06-05 16:20 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-06-05 16:16 - 2014-06-05 16:16 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\wgm\Downloads\mbam-setup-2.0.2.1012.exe
2014-06-05 16:13 - 2014-06-04 14:59 - 00000000 ____D () C:\Users\wgm\Desktop\FRST-OlderVersion
2014-06-05 16:13 - 2014-05-29 16:17 - 02068992 _____ (Farbar) C:\Users\wgm\Desktop\FRST64.exe
2014-06-05 15:36 - 2014-02-10 14:53 - 00000000 ____D () C:\Users\wgm\AppData\Local\Deployment
2014-06-05 15:00 - 2014-02-10 12:11 - 00000128 _____ () C:\windows\system32\config\netlogon.ftl
2014-06-04 17:59 - 2014-03-13 18:44 - 00005128 _____ () C:\windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for {80b42046-c09a-4b3e-9538-4176a042811e} NB021.stucke26.lokal
2014-06-01 12:02 - 2014-02-10 12:28 - 00000000 ____D () C:\Users\wgm
2014-06-01 12:01 - 2014-01-23 16:35 - 00000000 ____D () C:\Users\User01
2014-06-01 12:01 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\system32\NDF
2014-06-01 12:01 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\registration
2014-05-30 04:02 - 2014-02-10 12:29 - 00000000 ___RD () C:\Users\wgm\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-29 18:33 - 2014-05-29 18:33 - 00000303 _____ () C:\Users\wgm\Desktop\Trojaner.URL
2014-05-29 16:37 - 2014-05-29 11:23 - 00165947 _____ () C:\ProgramData\RUNDLL32.EXE-3124-F.txt
2014-05-29 16:34 - 2014-05-29 16:32 - 152430976 _____ (AVG Technologies) C:\Users\wgm\Downloads\avg_free_x86_all_2014_4592a7484.exe
2014-05-29 16:16 - 2014-05-29 16:16 - 00000000 _____ () C:\Users\wgm\defogger_reenable
2014-05-24 18:58 - 2014-01-23 16:35 - 00003212 _____ () C:\windows\System32\Tasks\HPCeeScheduleForNB021$
2014-05-24 18:58 - 2014-01-23 16:35 - 00000336 _____ () C:\windows\Tasks\HPCeeScheduleForNB021$.job
2014-05-24 18:37 - 2014-01-23 22:34 - 00000000 ____D () C:\windows\rescache
2014-05-24 18:10 - 2014-01-28 11:41 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2014-05-24 17:51 - 2014-02-10 12:29 - 00000000 ___RD () C:\Users\wgm\Virtual Machines
2014-05-24 17:51 - 2014-02-10 12:29 - 00000000 ___RD () C:\Users\wgm\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-24 17:48 - 2014-04-26 16:03 - 00000000 ___SD () C:\windows\system32\CompatTel
2014-05-24 17:48 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\PolicyDefinitions
2014-05-24 17:36 - 2014-01-23 21:48 - 00000000 ____D () C:\windows\system32\MRT
2014-05-24 17:35 - 2014-01-23 21:48 - 93223848 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-05-23 16:30 - 2014-02-04 12:43 - 00000851 _____ () C:\windows\Brpfx04a.ini
2014-05-23 16:29 - 2014-05-23 16:29 - 00000000 ____D () C:\Users\wgm\AppData\Roaming\PC-FAX TX
2014-05-23 16:29 - 2014-02-04 12:43 - 00000159 _____ () C:\windows\brpcfx.ini
2014-05-23 16:23 - 2014-05-23 16:23 - 00000000 ___RD () C:\Users\wgm\AppData\Roaming\Brother
2014-05-19 14:55 - 2014-05-19 11:44 - 00000000 ____D () C:\Users\wgm\AppData\OICE_15_974FA576_32C1D314_1781
2014-05-15 17:52 - 2014-01-24 15:45 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-05-15 09:22 - 2014-02-20 23:21 - 00003822 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2014-05-15 09:22 - 2014-02-10 15:09 - 00692400 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2014-05-15 09:22 - 2014-02-10 15:09 - 00070832 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-14 19:38 - 2009-07-14 07:09 - 00000000 ____D () C:\windows\System32\Tasks\WPD
2014-05-14 19:35 - 2014-05-14 19:35 - 436677762 _____ () C:\windows\MEMORY.DMP
2014-05-14 19:35 - 2014-05-14 19:35 - 00442624 _____ () C:\windows\Minidump\051414-19812-01.dmp
2014-05-14 19:35 - 2014-05-14 19:35 - 00000000 ____D () C:\windows\Minidump
2014-05-13 18:39 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Public\Libraries
2014-05-13 18:28 - 2009-07-14 06:57 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2014-05-12 07:26 - 2014-06-05 16:20 - 00091352 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2014-05-12 07:26 - 2014-06-05 16:20 - 00063704 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2014-05-12 07:25 - 2014-06-05 16:20 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2014-05-09 12:49 - 2014-04-22 12:06 - 00025621 _____ () C:\Users\wgm\Desktop\winmail.dat
2014-05-09 08:14 - 2014-05-24 17:33 - 00477184 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2014-05-09 08:11 - 2014-05-24 17:33 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2014-05-06 06:40 - 2014-05-24 17:36 - 23544320 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-05-06 06:17 - 2014-05-24 17:36 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-05-06 05:25 - 2014-05-24 17:36 - 17382912 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2014-05-06 05:07 - 2014-05-24 17:36 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2014-05-06 05:00 - 2014-05-24 17:36 - 00084992 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-05-06 04:10 - 2014-05-24 17:36 - 00069632 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll

Some content of TEMP:
====================
C:\Users\User01\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\User01\AppData\Local\Temp\install_reader11_de_mssd_aaa_aih.exe
C:\Users\User01\AppData\Local\Temp\MouseKeyboardCenterx64_1031.exe
C:\Users\User01\AppData\Local\Temp\MSNF77A.exe
C:\Users\User01\AppData\Local\Temp\OfficeSetup.exe
C:\Users\User01\AppData\Local\Temp\Setup.X86.de-DE_HomeBusinessRetail_10e42936-8c3a-4bb0-b237-708a60784538_TX_DB_.exe
C:\Users\wgm\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-05-29 10:54

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

schrauber · 06.06.2014, 11:47

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

30.05.2014, 15:45	#4
schrauber /// the machine /// TB-Ausbilder	Windows 7 hp-Laptop hat nach Start von windows BKA Bildschirm mit 100 Euro Zahlungsaufforderung STartet der Rechner normal? __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Windows 7 hp-Laptop hat nach Start von windows BKA Bildschirm mit 100 Euro Zahlungsaufforderung

Log-Analyse und Auswertung: Windows 7 hp-Laptop hat nach Start von windows BKA Bildschirm mit 100 Euro Zahlungsaufforderung