| |
| |||||||
Log-Analyse und Auswertung: WINDOWS 7: Phishing-Mail von Bank angeklicktWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
08.06.2014, 14:01
| #1 |
| |  WINDOWS 7: Phishing-Mail von Bank angeklickt Hallo, Habe vor einiger Zeit eine Aktualisierungmail bekommen wo verlangt wurde die Handyapp zu installieren da sonst mein Konto gelöscht wird! Da ich leider im Stress war habe ich natürlich in der Eile draufgeklickt (hat aber nichts funktioniert) Plötzlich ging der Computer nur mehr sehr langsam! -> auf jeder Internet Seite poppen sofort 4 Werbungen auf! AVIRA sagt mir zwar das mein Computer sicher ist aber das glaube ich nicht wirklich!! Habe dann unter eurem HILFETHEMA einmal MBAM drüberlaufen lassen mit folgendem Ergebnis: Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Scan Date: 08.06.2014 Scan Time: 13:19:24 Logfile: mbam.txt Administrator: Yes Version: 2.00.2.1012 Malware Database: v2014.03.04.09 Rootkit Database: v2014.02.20.01 License: Free Malware Protection: Disabled Malicious Website Protection: Disabled Self-protection: Disabled OS: Windows 7 Service Pack 1 CPU: x64 File System: NTFS User: Barbara Scan Type: Threat Scan Result: Completed Objects Scanned: 244992 Time Elapsed: 17 min, 31 sec Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Disabled Heuristics: Enabled PUP: Enabled PUM: Enabled Processes: 0 (No malicious items detected) Modules: 0 (No malicious items detected) Registry Keys: 0 (No malicious items detected) Registry Values: 0 (No malicious items detected) Registry Data: 0 (No malicious items detected) Folders: 0 (No malicious items detected) Files: 0 (No malicious items detected) Physical Sectors: 0 (No malicious items detected) (end) Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 13:55 on 08/06/2014 (Barbara)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Habe Beides gemacht mit folgenden Ergebnissen: FRST: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 06-06-2014 Ran by Barbara (administrator) on BARBARA-HP on 08-06-2014 13:58:08 Running from C:\Users\Barbara\Desktop Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal The only official download link for FRST: Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe (AMD) C:\Windows\System32\atiesrxx.exe (IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe (AMD) C:\Windows\System32\atieclxx.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (PriceMeter) C:\Program Files (x86)\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe (Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe (Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe (Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe () C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.141\SSScheduler.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe (CANON INC.) C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE (CANON INC.) C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (Microsoft Corporation) C:\Windows\splwow64.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (CANON INC.) C:\Program Files (x86)\Canon\Quick Menu\CNQMUPDT.EXE (CANON INC.) C:\Program Files (x86)\Canon\Quick Menu\CNQMSWCS.EXE (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe (Nico Mak Computing) C:\Program Files (x86)\WinZip Malware Protector\WinZipMalwareProtector.exe (McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.141\McUICnt.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2799912 2011-06-10] (Synaptics Incorporated) HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [525312 2010-12-17] (IDT, Inc.) HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation) HKLM-x32\...\Run: [HPQuickWebProxy] => C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe [168504 2011-06-27] (Hewlett-Packard Company) HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [40312 2014-05-08] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Easybits Recovery] => C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [61112 2011-05-17] (EasyBits Software AS) HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-05-30] (Apple Inc.) HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [421776 2012-06-07] (Apple Inc.) HKLM-x32\...\Run: [TrayServer] => C:\Program Files (x86)\MAGIX\Video_deluxe_15_Plus\TrayServer.exe [90112 2008-08-07] (MAGIX AG) HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [578944 2012-03-05] (Hewlett-Packard Development Company, L.P.) HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2011-09-28] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [HPOSD] => C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960 2011-08-19] (Hewlett-Packard Development Company, L.P.) HKLM-x32\...\Run: [Magic Desktop for HP notification] => C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe [1258504 2013-12-29] (Easybits) HKLM-x32\...\Run: [CanonQuickMenu] => C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE [1282632 2013-04-02] (CANON INC.) HKLM-x32\...\Run: [IJNetworkScannerSelectorEX] => C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe [453736 2013-02-19] (CANON INC.) HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [737872 2014-05-09] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [TrojanScanner] => C:\Program Files (x86)\Trojan Remover\Trjscan.exe [1704720 2014-01-23] (Simply Super Software) HKLM\...\RunOnce: [NCPluginUpdater] - "C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe" Update [21720 2014-05-27] (Hewlett-Packard) HKLM-x32\...\RunOnce: [ChicaPC-Shield] - C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsgui.exe /install /silent [788040 2013-06-09] (ChicaLogic) HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1 HKU\S-1-5-21-3093502883-2195938575-2196997416-1001\...\Run: [Rainlendar2] => C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe HKU\S-1-5-21-3093502883-2195938575-2196997416-1001\...\Run: [iLivid] => "C:\Users\Barbara\AppData\Local\iLivid\iLivid.exe" -autorun HKU\S-1-5-21-3093502883-2195938575-2196997416-1001\...\Run: [PriceMeterW] => "C:\Users\Barbara\AppData\Local\PriceMeter\pricemeterw.exe" HKU\S-1-5-21-3093502883-2195938575-2196997416-1001\...\Run: [68BEmoyz] => C:\ProgramData\68BEmoyz.exe HKU\S-1-5-21-3093502883-2195938575-2196997416-1001\...\Policies\system: [DisableLockWorkstation] 0 HKU\S-1-5-21-3093502883-2195938575-2196997416-1001\...\Policies\system: [DisableChangePassword] 0 HKU\S-1-5-21-3093502883-2195938575-2196997416-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Rainlendar2] => C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe HKU\S-1-5-21-3093502883-2195938575-2196997416-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [iLivid] => "C:\Users\Barbara\AppData\Local\iLivid\iLivid.exe" -autorun HKU\S-1-5-21-3093502883-2195938575-2196997416-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [PriceMeterW] => "C:\Users\Barbara\AppData\Local\PriceMeter\pricemeterw.exe" HKU\S-1-5-21-3093502883-2195938575-2196997416-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [68BEmoyz] => C:\ProgramData\68BEmoyz.exe HKU\S-1-5-21-3093502883-2195938575-2196997416-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Policies\system: [DisableLockWorkstation] 0 HKU\S-1-5-21-3093502883-2195938575-2196997416-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Policies\system: [DisableChangePassword] 0 HKU\S-1-5-21-3093502883-2195938575-2196997416-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [Rainlendar2] => C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe HKU\S-1-5-21-3093502883-2195938575-2196997416-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [iLivid] => "C:\Users\Barbara\AppData\Local\iLivid\iLivid.exe" -autorun HKU\S-1-5-21-3093502883-2195938575-2196997416-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [PriceMeterW] => "C:\Users\Barbara\AppData\Local\PriceMeter\pricemeterw.exe" HKU\S-1-5-21-3093502883-2195938575-2196997416-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [68BEmoyz] => C:\ProgramData\68BEmoyz.exe HKU\S-1-5-21-3093502883-2195938575-2196997416-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Policies\system: [DisableLockWorkstation] 0 HKU\S-1-5-21-3093502883-2195938575-2196997416-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Policies\system: [DisableChangePassword] 0 HKU\S-1-5-21-3093502883-2195938575-2196997416-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2\...\Run: [Rainlendar2] => C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe HKU\S-1-5-21-3093502883-2195938575-2196997416-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2\...\Run: [iLivid] => "C:\Users\Barbara\AppData\Local\iLivid\iLivid.exe" -autorun HKU\S-1-5-21-3093502883-2195938575-2196997416-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2\...\Run: [PriceMeterW] => "C:\Users\Barbara\AppData\Local\PriceMeter\pricemeterw.exe" HKU\S-1-5-21-3093502883-2195938575-2196997416-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2\...\Run: [68BEmoyz] => C:\ProgramData\68BEmoyz.exe HKU\S-1-5-21-3093502883-2195938575-2196997416-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2\...\Policies\system: [DisableLockWorkstation] 0 HKU\S-1-5-21-3093502883-2195938575-2196997416-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-2\...\Policies\system: [DisableChangePassword] 0 IFEO\bitguard.exe: [Debugger] tasklist.exe IFEO\bprotect.exe: [Debugger] tasklist.exe IFEO\bpsvc.exe: [Debugger] tasklist.exe IFEO\browsemngr.exe: [Debugger] tasklist.exe IFEO\browserdefender.exe: [Debugger] tasklist.exe IFEO\browsermngr.exe: [Debugger] tasklist.exe IFEO\browserprotect.exe: [Debugger] tasklist.exe IFEO\browsersafeguard.exe: [Debugger] tasklist.exe IFEO\bundlesweetimsetup.exe: [Debugger] tasklist.exe IFEO\delta babylon.exe: [Debugger] tasklist.exe IFEO\delta tb.exe: [Debugger] tasklist.exe IFEO\delta2.exe: [Debugger] tasklist.exe IFEO\deltainstaller.exe: [Debugger] tasklist.exe IFEO\deltasetup.exe: [Debugger] tasklist.exe IFEO\deltatb.exe: [Debugger] tasklist.exe IFEO\deltatb_2501-c733154b.exe: [Debugger] tasklist.exe IFEO\dprotectsvc.exe: [Debugger] tasklist.exe IFEO\iminentsetup.exe: [Debugger] tasklist.exe IFEO\jumpflip: [Debugger] tasklist.exe IFEO\protectedsearch.exe: [Debugger] tasklist.exe IFEO\rjatydimofu.exe: [Debugger] tasklist.exe IFEO\searchinstaller.exe: [Debugger] tasklist.exe IFEO\searchprotection.exe: [Debugger] tasklist.exe IFEO\searchprotector.exe: [Debugger] tasklist.exe IFEO\searchsettings.exe: [Debugger] tasklist.exe IFEO\searchsettings64.exe: [Debugger] tasklist.exe IFEO\snapdo.exe: [Debugger] tasklist.exe IFEO\stinst32.exe: [Debugger] tasklist.exe IFEO\stinst64.exe: [Debugger] tasklist.exe IFEO\sweetimsetup.exe: [Debugger] tasklist.exe IFEO\tbdelta.exetoolbar783881609.exe: [Debugger] tasklist.exe IFEO\umbrella.exe: [Debugger] tasklist.exe IFEO\utiljumpflip.exe: [Debugger] tasklist.exe IFEO\volaro: [Debugger] tasklist.exe IFEO\vonteera: [Debugger] tasklist.exe IFEO\websteroids.exe: [Debugger] tasklist.exe IFEO\websteroidsservice.exe: [Debugger] tasklist.exe Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.141\SSScheduler.exe (McAfee, Inc.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk ShortcutTarget: Microsoft Office.lnk -> C:\Program Files (x86)\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation) HKLM\...\AppCertDlls: [x86] -> C:\Program Files (x86)\Movies Toolbar\SafetyNut\safetycrt.dll HKLM\...\AppCertDlls: [x64] -> C:\Program Files (x86)\Movies Toolbar\SafetyNut\x64\safetycrt.dll ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.at/ HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCON/1 SearchScopes: HKLM - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF SearchScopes: HKLM - {52db1893-8a90-4192-aede-08e00b8f8473} URL = hxxp://dts.search.ask.com/sr?src=ieb&gct=ds&appid=114&systemid=473&v=a12627-308&apn_uid=9411110305954883&apn_dtid=BND101&o=APN10640&apn_ptnrs=AG1&q={searchTerms} SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search.ask.com/sr?src=ieb&gct=ds&appid=575&systemid=406&v=n11551-290&apn_uid=1411082157004724&apn_dtid=BND406&o=APN10645&apn_ptnrs=AG6&q={searchTerms} SearchScopes: HKLM - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://at.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF SearchScopes: HKLM - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms} SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/5221-111072-7833-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms} SearchScopes: HKLM - {E470252B-2B36-4497-8AFE-F39C17A4E358} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de3-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms} SearchScopes: HKLM-x32 - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF SearchScopes: HKLM-x32 - {52db1893-8a90-4192-aede-08e00b8f8473} URL = hxxp://dts.search.ask.com/sr?src=ieb&gct=ds&appid=114&systemid=473&v=a12627-308&apn_uid=9411110305954883&apn_dtid=BND101&o=APN10640&apn_ptnrs=AG1&q={searchTerms} SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search.ask.com/sr?src=ieb&gct=ds&appid=575&systemid=406&v=n11551-290&apn_uid=1411082157004724&apn_dtid=BND406&o=APN10645&apn_ptnrs=AG6&q={searchTerms} SearchScopes: HKLM-x32 - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://at.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF SearchScopes: HKLM-x32 - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms} SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/5221-111072-7833-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms} SearchScopes: HKLM-x32 - {E470252B-2B36-4497-8AFE-F39C17A4E358} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de3-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms} SearchScopes: HKCU - URL hxxp://search.conduit.com/Results.aspx?ctid=CT3324760&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=5&UP=SP4D3F4BC0-2AB9-4401-AA2F-CF2C2A05B600&q={searchTerms}&SSPV= SearchScopes: HKCU - SuggestionsURL_JSON hxxp://suggest.search.conduit.com/CSuggestJson.ashx?prefix={searchTerms} SearchScopes: HKCU - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF SearchScopes: HKCU - {52db1893-8a90-4192-aede-08e00b8f8473} URL = hxxp://dts.search.ask.com/sr?src=ieb&gct=ds&appid=114&systemid=473&v=a12627-308&apn_uid=9411110305954883&apn_dtid=BND101&o=APN10640&apn_ptnrs=AG1&q={searchTerms} SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search.ask.com/sr?src=ieb&gct=ds&appid=575&systemid=406&v=n11551-290&apn_uid=1411082157004724&apn_dtid=BND406&o=APN10645&apn_ptnrs=AG6&q={searchTerms} SearchScopes: HKCU - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://at.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF SearchScopes: HKCU - {BB5BE563-6BE3-473B-96FE-66E09EEE33A9} URL = hxxp://search.softonic.com/MOY00621/tb_v1?q={searchTerms}&SearchSource=4&cc=&mi=defcf2ea000000000000ac81129fcd74&r=303 SearchScopes: HKCU - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms} SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/5221-111072-7833-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms} SearchScopes: HKCU - {E470252B-2B36-4497-8AFE-F39C17A4E358} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de3-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms} BHO: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\addon64\ewpexbho.dll (CANON INC.) BHO: SteadyVideoBHO Class - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard) BHO: DVDVideoSoft IE Extension - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.) BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.141\McAfeeMSS_IE.dll (McAfee, Inc.) BHO-x32: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.) BHO-x32: SteadyVideoBHO Class - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices) BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Avira Savings Advisor BHO - {A18A516C-AA41-46A9-92DB-60208917E442} - C:\Program Files (x86)\avira\Internet Explorer\avira32.dll () BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard) BHO-x32: Softonic Helper Object - {E87806B5-E908-45FD-AF5E-957D83E58E68} - C:\Program Files (x86)\Softonic\Softonic\1.8.21.14\bh\Softonic.dll (Softonic.com) BHO-x32: DVDVideoSoft IE Extension - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.) Toolbar: HKLM - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\addon64\ewpexhlp.dll (CANON INC.) Toolbar: HKLM-x32 - Softonic Toolbar - {5018CFD2-804D-4C99-9F81-25EAEA2769DE} - C:\Program Files (x86)\Softonic\Softonic\1.8.21.14\SoftonicTlbr.dll (Softonic.com) Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.) Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File Handler: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - No File Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: http\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: https\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices) Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices) Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices) Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices) ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52920 2011-07-24] (EasyBits Software Corp.) Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 Tcpip\..\Interfaces\{49DA899B-1780-412F-8703-22283B704288}: [NameServer]5.39.219.212 Tcpip\..\Interfaces\{846ee342-7039-11de-9d20-806e6f6e6963}: [NameServer]5.39.219.212 Tcpip\..\Interfaces\{9A9D1FBC-87CA-4829-BC09-82D62CCE9B59}: [NameServer]5.39.219.212 Tcpip\..\Interfaces\{CC169F16-7B04-4A88-957B-6A93AE37389A}: [NameServer]5.39.219.212 FireFox: ======== FF ProfilePath: C:\Users\Barbara\AppData\Roaming\Mozilla\Firefox\Profiles\o0chjimb.default FF DefaultSearchEngine: Ask.com FF SearchEngineOrder.1: Ask.com FF SelectedSearchEngine: Ask.com FF Homepage: hxxp://www.google.at/ FF Keyword.URL: hxxp://dts.search.ask.com/sr?src=ffb&gct=ds&appid=114&systemid=473&v=a12627-308&apn_dtid=BND101&apn_ptnrs=AG1&apn_uid=9411110305954883&o=APN10640&q= FF NetworkProxy: "type", 4 FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll () FF Plugin: @microsoft.com/GENUINE - disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll No File FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll (CANON INC.) FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.141\npMcAfeeMss.dll (McAfee, Inc.) FF Plugin-x32: @microsoft.com/GENUINE - disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @tools.updatepm.com/PriceMeterLiveUpdate Update;version=3 - C:\Program Files (x86)\PriceMeterLiveUpdate\Update\1.3.23.0\npGoogleUpdate3.dll (PriceMeter) FF Plugin-x32: @tools.updatepm.com/PriceMeterLiveUpdate Update;version=9 - C:\Program Files (x86)\PriceMeterLiveUpdate\Update\1.3.23.0\npGoogleUpdate3.dll (PriceMeter) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF user.js: detected! => C:\Users\Barbara\AppData\Roaming\Mozilla\Firefox\Profiles\o0chjimb.default\user.js FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np32dsw.dll (Macromedia, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Users\Barbara\AppData\Roaming\Mozilla\Firefox\Profiles\o0chjimb.default\searchplugins\Ask.xml FF SearchPlugin: C:\Users\Barbara\AppData\Roaming\Mozilla\Firefox\Profiles\o0chjimb.default\searchplugins\conduit-search.xml FF SearchPlugin: C:\Users\Barbara\AppData\Roaming\Mozilla\Firefox\Profiles\o0chjimb.default\searchplugins\softonic.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\Ask.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: Avira Savings Advisor - C:\Users\Barbara\AppData\Roaming\Mozilla\Firefox\Profiles\o0chjimb.default\Extensions\ciuvo-extension@avira.de [2014-05-26] FF Extension: softonic.com - C:\Users\Barbara\AppData\Roaming\Mozilla\Firefox\Profiles\o0chjimb.default\Extensions\ffxtlbra@softonic.com [2012-05-24] FF Extension: Ask New Tabs - C:\Users\Barbara\AppData\Roaming\Mozilla\Firefox\Profiles\o0chjimb.default\Extensions\{8E69E270-96C8-161B-D584-8E724EEC279D} [2014-04-05] FF Extension: Value Apps - C:\Users\Barbara\AppData\Roaming\Mozilla\Firefox\Profiles\o0chjimb.default\Extensions\{94cd2cc3-083f-49ba-a218-4cda4b4829fd} [2014-03-19] FF Extension: Movies Toolbar (Dist. by Somoto Ltd.) - C:\Users\Barbara\AppData\Roaming\Mozilla\Firefox\Profiles\o0chjimb.default\Extensions\{c75a2d66-6d1d-4735-8f63-9d85dcc026a6} [2014-04-05] FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\Barbara\AppData\Roaming\Mozilla\Firefox\Profiles\o0chjimb.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi [2012-11-22] FF HKLM-x32\...\Firefox\Extensions: [{ACAA314B-EEBA-48e4-AD47-84E31C44796C}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\ FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\ [] Chrome: ======= Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION CHR Extension: (Softonic Chrome Toolbar) - C:\Users\Barbara\AppData\Local\Google\Chrome\User Data\Default\Extensions\elchiiiejkobdbblfejjkbphbddgmljf [2013-11-13] CHR HKLM-x32\...\Chrome\Extension: [elchiiiejkobdbblfejjkbphbddgmljf] - C:\Program Files (x86)\Softonic\Softonic\1.8.21.14\Softonic.crx [2013-06-11] ==================== Services (Whitelisted) ================= R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2011-09-28] (Advanced Micro Devices, Inc.) R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-05-09] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-05-09] (Avira Operations GmbH & Co. KG) S2 CPCSScheduler; C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsscheduler.exe [418376 2013-06-09] (ChicaLogic) S2 CPCSService; C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\cpcsservice.exe [701512 2013-06-09] (ChicaLogic) S3 FirebirdServerMAGIXInstance; C:\Program Files (x86)\MAGIX\Common\Database\bin\fbserver.exe [1527900 2005-11-17] (MAGIX®) R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [140936 2013-05-14] () S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.141\McCHSvc.exe [289256 2014-01-16] (McAfee, Inc.) R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation) S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation) S2 pricemeterliveUpdate; C:\Program Files (x86)\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe [150504 2014-03-19] (PriceMeter) S3 pricemeterliveUpdatem; C:\Program Files (x86)\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe [150504 2014-03-19] (PriceMeter) S2 TorchCrashHandler; C:\Users\Barbara\AppData\Local\Torch\Update\TorchCrashHandler.exe [X] ==================== Drivers (Whitelisted) ==================== R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [112080 2014-05-09] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-05-09] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-05-09] (Avira Operations GmbH & Co. KG) S3 CPCSProtector; C:\Windows\system32\drivers\cpcs.sys [25928 2013-04-04] (ChicaLogic) R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation) S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-06-08 13:58 - 2014-06-08 13:58 - 00030385 _____ () C:\Users\Barbara\Desktop\FRST.txt 2014-06-08 13:57 - 2014-06-08 13:58 - 00000000 ____D () C:\FRST 2014-06-08 13:56 - 2014-06-08 13:56 - 02072576 _____ (Farbar) C:\Users\Barbara\Desktop\FRST64.exe 2014-06-08 13:55 - 2014-06-08 13:55 - 00000476 _____ () C:\Users\Barbara\Desktop\defogger_disable.log 2014-06-08 13:55 - 2014-06-08 13:55 - 00000000 _____ () C:\Users\Barbara\defogger_reenable 2014-06-08 13:53 - 2014-06-08 13:54 - 00050477 _____ () C:\Users\Barbara\Desktop\Defogger.exe 2014-06-08 13:52 - 2014-06-08 13:52 - 00001058 _____ () C:\Users\Barbara\Desktop\mbam.txt 2014-06-08 13:17 - 2014-06-08 13:17 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-05-29 20:02 - 2014-05-29 20:02 - 00027386 _____ () C:\Users\Barbara\Documents\trojaner.xml 2014-05-29 19:40 - 2014-06-08 07:40 - 00000454 _____ () C:\Windows\Tasks\ChicaPC-Shield-Notification.job 2014-05-29 19:40 - 2014-05-29 19:40 - 00003526 _____ () C:\Windows\System32\Tasks\ChicaPC-Shield-Notification 2014-05-29 19:39 - 2014-05-29 19:39 - 00000000 ____D () C:\Users\Barbara\AppData\Roaming\ChicaLogic 2014-05-29 19:39 - 2014-05-29 19:39 - 00000000 ____D () C:\ProgramData\ChicaLogic 2014-05-29 19:39 - 2014-05-29 19:39 - 00000000 ____D () C:\Program Files (x86)\ChicaLogic 2014-05-29 19:39 - 2013-04-04 14:51 - 00025928 _____ (ChicaLogic) C:\Windows\system32\Drivers\cpcs.sys 2014-05-29 19:37 - 2014-05-29 19:37 - 00000000 ____D () C:\Users\Barbara\AppData\Roaming\Fighters 2014-05-29 19:37 - 2014-05-29 19:37 - 00000000 ____D () C:\ProgramData\clp 2014-05-29 19:35 - 2014-05-29 20:01 - 00000000 ____D () C:\ProgramData\Fighters 2014-05-29 19:35 - 2014-05-29 19:35 - 00000000 ____D () C:\ProgramData\Common Toolkit Suite 2014-05-29 19:31 - 2014-05-29 19:31 - 00000000 ____D () C:\Users\Barbara\Documents\Simply Super Software 2014-05-29 19:31 - 2014-05-29 19:31 - 00000000 ____D () C:\ProgramData\Licenses 2014-05-29 19:30 - 2014-05-29 19:30 - 00000000 ____D () C:\ProgramData\Simply Super Software 2014-05-29 19:30 - 2014-05-29 19:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trojan Remover 2014-05-29 19:30 - 2014-05-29 19:30 - 00000000 ____D () C:\Program Files (x86)\Trojan Remover 2014-05-29 18:47 - 2014-05-29 18:47 - 00003116 _____ () C:\Windows\System32\Tasks\WinZip Malware Protector_startup 2014-05-29 18:46 - 2014-05-29 18:46 - 04892480 _____ (WinZip International LLC ) C:\Users\Barbara\Desktop\wzmp_8.exe 2014-05-29 18:46 - 2014-05-29 18:46 - 00001153 _____ () C:\Users\Public\Desktop\WinZip Malware Protector.lnk 2014-05-29 18:46 - 2014-05-29 18:46 - 00000000 ____D () C:\Users\Barbara\AppData\Roaming\Nico Mak Computing 2014-05-29 18:46 - 2014-05-29 18:46 - 00000000 ____D () C:\ProgramData\Nico Mak Computing 2014-05-29 18:46 - 2014-05-29 18:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Malware Protector 2014-05-29 18:46 - 2014-05-29 18:46 - 00000000 ____D () C:\Program Files (x86)\WinZip Malware Protector 2014-05-29 18:46 - 2013-03-15 17:10 - 00020480 _____ () C:\Windows\system32\wsusnative64.exe 2014-05-27 14:29 - 2014-05-27 14:28 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys 2014-05-26 22:00 - 2014-05-26 22:00 - 00000000 ____D () C:\ProgramData\HitmanPro 2014-05-26 19:19 - 2014-05-26 19:19 - 00003408 _____ () C:\Windows\System32\Tasks\aviraSWU 2014-05-26 19:19 - 2014-05-26 19:19 - 00000000 ____D () C:\Users\Barbara\AppData\Roaming\Avira 2014-05-26 19:17 - 2014-05-26 19:19 - 00000000 ____D () C:\Program Files (x86)\Avira 2014-05-26 19:17 - 2014-05-26 19:17 - 00002030 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk 2014-05-26 19:17 - 2014-05-26 19:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira 2014-05-26 19:17 - 2014-05-26 19:17 - 00000000 ____D () C:\ProgramData\Avira 2014-05-26 19:17 - 2014-05-09 11:16 - 00130584 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys 2014-05-26 19:17 - 2014-05-09 11:16 - 00112080 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys 2014-05-26 19:17 - 2014-05-09 11:16 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys 2014-05-22 17:45 - 2014-05-22 17:45 - 00000000 ____D () C:\Program Files\Microsoft Security Client 2014-05-22 17:45 - 2014-05-22 17:45 - 00000000 ____D () C:\Program Files (x86)\Microsoft Security Client 2014-05-22 16:57 - 2014-05-22 16:57 - 00001066 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-05-22 16:57 - 2014-05-22 16:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-05-22 16:57 - 2014-05-22 16:57 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-05-22 16:57 - 2014-05-22 16:57 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-05-22 16:57 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-05-22 16:57 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-05-22 16:57 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-05-22 16:29 - 2014-05-22 17:46 - 00001912 _____ () C:\Windows\epplauncher.mif 2014-05-21 15:44 - 2014-05-21 15:45 - 00000000 ___HD () C:\ProgramData\CanonIJMIG 2014-05-21 15:34 - 2014-05-21 15:34 - 00000000 ___HD () C:\ProgramData\CanonIJEGV 2014-05-21 15:31 - 2014-05-21 15:32 - 00000000 ___HD () C:\ProgramData\CanonIJScan 2014-05-21 15:26 - 2014-05-21 15:26 - 00000000 ___HD () C:\ProgramData\CanonIJQuickMenu 2014-05-21 15:23 - 2014-05-21 15:23 - 00000000 ____D () C:\ProgramData\Canon IJ Network Tool 2014-05-21 15:23 - 2013-02-04 15:10 - 00321536 _____ (CANON INC.) C:\Windows\SysWOW64\CNC_BVL.dll 2014-05-21 15:23 - 2012-11-26 12:32 - 00088576 _____ () C:\Windows\SysWOW64\CNC176ED.TBL 2014-05-21 15:23 - 2008-08-25 18:02 - 00015872 _____ (CANON INC.) C:\Windows\SysWOW64\CNHMCA.dll 2014-05-21 15:22 - 2014-05-21 15:22 - 00001985 _____ () C:\Users\Public\Desktop\Canon Quick Menu.lnk 2014-05-21 15:22 - 2014-05-21 15:22 - 00000000 ____D () C:\Windows\system32\STRING 2014-05-21 15:22 - 2014-05-21 15:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MG3500 series Benutzerregistrierung 2014-05-21 15:22 - 2014-05-21 15:22 - 00000000 ____D () C:\ProgramData\CanonIJWSpt 2014-05-21 15:22 - 2013-01-24 09:24 - 00359936 _____ (CANON INC.) C:\Windows\system32\CNMN6PPM.DLL 2014-05-21 15:22 - 2013-01-24 09:24 - 00039424 _____ (CANON INC.) C:\Windows\system32\CNMN6UI.DLL 2014-05-21 15:22 - 2013-01-24 09:23 - 00366592 _____ (CANON INC.) C:\Windows\SysWOW64\CNMNPPM.DLL 2014-05-21 15:17 - 2014-05-21 15:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon Utilities 2014-05-21 15:17 - 2014-05-21 15:17 - 00002320 _____ () C:\Users\Public\Desktop\Canon MG3500 series On-Screen-Handbuch.lnk 2014-05-21 15:17 - 2014-05-21 15:17 - 00000000 ___HD () C:\ProgramData\CanonBJ 2014-05-21 15:17 - 2014-05-21 15:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MG3500 series Manual 2014-05-21 15:17 - 2014-05-21 15:17 - 00000000 ____D () C:\Program Files\Canon 2014-05-21 15:16 - 2014-05-21 15:16 - 00000000 ___HD () C:\Program Files\CanonBJ 2014-05-21 15:16 - 2013-04-04 05:00 - 00391168 _____ (CANON INC.) C:\Windows\system32\CNMLMBV.DLL 2014-05-21 15:13 - 2014-06-01 09:11 - 00000000 ____D () C:\ProgramData\CanonIJPLM 2014-05-21 15:13 - 2014-05-21 15:13 - 00000000 ___HD () C:\ProgramData\CanonIJETV 2014-05-21 15:12 - 2014-05-21 15:25 - 00000000 ____D () C:\Program Files (x86)\Canon 2014-05-12 20:41 - 2014-05-22 16:38 - 00003120 _____ () C:\Windows\System32\Tasks\Advanced System Protector_startup 2014-05-11 15:23 - 2014-05-11 15:23 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox ==================== One Month Modified Files and Folders ======= 2014-06-08 13:58 - 2014-06-08 13:58 - 00030385 _____ () C:\Users\Barbara\Desktop\FRST.txt 2014-06-08 13:58 - 2014-06-08 13:57 - 00000000 ____D () C:\FRST 2014-06-08 13:58 - 2011-10-22 13:01 - 00000000 ____D () C:\Users\Barbara\AppData\Local\Temp 2014-06-08 13:57 - 2011-07-15 00:59 - 01298888 _____ () C:\Windows\WindowsUpdate.log 2014-06-08 13:56 - 2014-06-08 13:56 - 02072576 _____ (Farbar) C:\Users\Barbara\Desktop\FRST64.exe 2014-06-08 13:55 - 2014-06-08 13:55 - 00000476 _____ () C:\Users\Barbara\Desktop\defogger_disable.log 2014-06-08 13:55 - 2014-06-08 13:55 - 00000000 _____ () C:\Users\Barbara\defogger_reenable 2014-06-08 13:55 - 2011-10-22 13:01 - 00000000 ____D () C:\Users\Barbara 2014-06-08 13:54 - 2014-06-08 13:53 - 00050477 _____ () C:\Users\Barbara\Desktop\Defogger.exe 2014-06-08 13:52 - 2014-06-08 13:52 - 00001058 _____ () C:\Users\Barbara\Desktop\mbam.txt 2014-06-08 13:39 - 2014-03-19 14:34 - 00000968 _____ () C:\Windows\Tasks\PriceMeterLiveUpdateUpdateTaskMachineUA.job 2014-06-08 13:39 - 2014-03-19 14:34 - 00000964 _____ () C:\Windows\Tasks\PriceMeterLiveUpdateUpdateTaskMachineCore.job 2014-06-08 13:35 - 2014-03-19 14:34 - 00000300 _____ () C:\Windows\Tasks\PriceMeterUpdater.job 2014-06-08 13:17 - 2014-06-08 13:17 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-06-08 13:17 - 2011-11-19 12:31 - 00000000 ____D () C:\Users\Barbara\AppData\Local\CrashDumps 2014-06-08 13:06 - 2012-06-14 11:16 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-06-08 12:59 - 2009-07-14 06:45 - 00032064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-06-08 12:59 - 2009-07-14 06:45 - 00032064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-06-08 07:40 - 2014-05-29 19:40 - 00000454 _____ () C:\Windows\Tasks\ChicaPC-Shield-Notification.job 2014-06-07 21:39 - 2013-11-13 19:35 - 00092160 ___SH () C:\Users\Barbara\Desktop\Thumbs.db 2014-06-07 13:50 - 2012-07-02 16:56 - 00003198 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForBarbara 2014-06-07 13:50 - 2012-07-02 16:56 - 00000340 _____ () C:\Windows\Tasks\HPCeeScheduleForBarbara.job 2014-06-07 13:50 - 2011-10-22 13:05 - 00003946 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{C9177807-72A8-4EF1-B4BF-EF146260FFFE} 2014-06-06 08:24 - 2011-07-24 17:40 - 00699666 _____ () C:\Windows\system32\perfh007.dat 2014-06-06 08:24 - 2011-07-24 17:40 - 00149774 _____ () C:\Windows\system32\perfc007.dat 2014-06-06 08:24 - 2009-07-14 07:13 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-06-01 09:11 - 2014-05-21 15:13 - 00000000 ____D () C:\ProgramData\CanonIJPLM 2014-05-29 20:02 - 2014-05-29 20:02 - 00027386 _____ () C:\Users\Barbara\Documents\trojaner.xml 2014-05-29 20:01 - 2014-05-29 19:35 - 00000000 ____D () C:\ProgramData\Fighters 2014-05-29 19:54 - 2011-07-15 01:18 - 00000000 ____D () C:\ProgramData\Temp 2014-05-29 19:40 - 2014-05-29 19:40 - 00003526 _____ () C:\Windows\System32\Tasks\ChicaPC-Shield-Notification 2014-05-29 19:39 - 2014-05-29 19:39 - 00000000 ____D () C:\Users\Barbara\AppData\Roaming\ChicaLogic 2014-05-29 19:39 - 2014-05-29 19:39 - 00000000 ____D () C:\ProgramData\ChicaLogic 2014-05-29 19:39 - 2014-05-29 19:39 - 00000000 ____D () C:\Program Files (x86)\ChicaLogic 2014-05-29 19:37 - 2014-05-29 19:37 - 00000000 ____D () C:\Users\Barbara\AppData\Roaming\Fighters 2014-05-29 19:37 - 2014-05-29 19:37 - 00000000 ____D () C:\ProgramData\clp 2014-05-29 19:35 - 2014-05-29 19:35 - 00000000 ____D () C:\ProgramData\Common Toolkit Suite 2014-05-29 19:31 - 2014-05-29 19:31 - 00000000 ____D () C:\Users\Barbara\Documents\Simply Super Software 2014-05-29 19:31 - 2014-05-29 19:31 - 00000000 ____D () C:\ProgramData\Licenses 2014-05-29 19:30 - 2014-05-29 19:30 - 00000000 ____D () C:\ProgramData\Simply Super Software 2014-05-29 19:30 - 2014-05-29 19:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trojan Remover 2014-05-29 19:30 - 2014-05-29 19:30 - 00000000 ____D () C:\Program Files (x86)\Trojan Remover 2014-05-29 18:47 - 2014-05-29 18:47 - 00003116 _____ () C:\Windows\System32\Tasks\WinZip Malware Protector_startup 2014-05-29 18:46 - 2014-05-29 18:46 - 04892480 _____ (WinZip International LLC ) C:\Users\Barbara\Desktop\wzmp_8.exe 2014-05-29 18:46 - 2014-05-29 18:46 - 00001153 _____ () C:\Users\Public\Desktop\WinZip Malware Protector.lnk 2014-05-29 18:46 - 2014-05-29 18:46 - 00000000 ____D () C:\Users\Barbara\AppData\Roaming\Nico Mak Computing 2014-05-29 18:46 - 2014-05-29 18:46 - 00000000 ____D () C:\ProgramData\Nico Mak Computing 2014-05-29 18:46 - 2014-05-29 18:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip Malware Protector 2014-05-29 18:46 - 2014-05-29 18:46 - 00000000 ____D () C:\Program Files (x86)\WinZip Malware Protector 2014-05-29 18:41 - 2011-07-24 08:54 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information 2014-05-28 20:50 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF 2014-05-28 14:55 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-05-28 14:55 - 2009-07-14 06:51 - 00079208 _____ () C:\Windows\setupact.log 2014-05-27 14:28 - 2014-05-27 14:29 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys 2014-05-26 22:16 - 2010-11-21 05:47 - 01241398 _____ () C:\Windows\PFRO.log 2014-05-26 22:00 - 2014-05-26 22:00 - 00000000 ____D () C:\ProgramData\HitmanPro 2014-05-26 19:19 - 2014-05-26 19:19 - 00003408 _____ () C:\Windows\System32\Tasks\aviraSWU 2014-05-26 19:19 - 2014-05-26 19:19 - 00000000 ____D () C:\Users\Barbara\AppData\Roaming\Avira 2014-05-26 19:19 - 2014-05-26 19:17 - 00000000 ____D () C:\Program Files (x86)\Avira 2014-05-26 19:17 - 2014-05-26 19:17 - 00002030 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk 2014-05-26 19:17 - 2014-05-26 19:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira 2014-05-26 19:17 - 2014-05-26 19:17 - 00000000 ____D () C:\ProgramData\Avira 2014-05-25 19:52 - 2012-04-30 08:07 - 00000000 _____ () C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt 2014-05-25 19:52 - 2012-03-05 08:47 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log 2014-05-22 17:46 - 2014-05-22 16:29 - 00001912 _____ () C:\Windows\epplauncher.mif 2014-05-22 17:45 - 2014-05-22 17:45 - 00000000 ____D () C:\Program Files\Microsoft Security Client 2014-05-22 17:45 - 2014-05-22 17:45 - 00000000 ____D () C:\Program Files (x86)\Microsoft Security Client 2014-05-22 17:39 - 2012-01-24 09:26 - 00001979 _____ () C:\Users\Public\Desktop\Adobe Reader X.lnk 2014-05-22 17:39 - 2011-07-24 08:47 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk 2014-05-22 17:28 - 2014-04-05 19:14 - 00000000 ____D () C:\Program Files (x86)\Movies Toolbar 2014-05-22 17:28 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\L2Schemas 2014-05-22 17:27 - 2014-03-19 20:16 - 00000000 ____D () C:\Users\Barbara\AppData\Local\Conduit 2014-05-22 17:27 - 2014-03-19 20:16 - 00000000 ____D () C:\Program Files\Conduit 2014-05-22 17:27 - 2014-03-19 20:16 - 00000000 ____D () C:\Program Files (x86)\Conduit 2014-05-22 17:27 - 2012-10-01 10:31 - 00000000 ____D () C:\Users\Barbara\AppData\Roaming\Systweak 2014-05-22 17:27 - 2012-10-01 10:31 - 00000000 ____D () C:\ProgramData\Systweak 2014-05-22 16:57 - 2014-05-22 16:57 - 00001066 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-05-22 16:57 - 2014-05-22 16:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-05-22 16:57 - 2014-05-22 16:57 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-05-22 16:57 - 2014-05-22 16:57 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-05-22 16:38 - 2014-05-12 20:41 - 00003120 _____ () C:\Windows\System32\Tasks\Advanced System Protector_startup 2014-05-21 15:45 - 2014-05-21 15:44 - 00000000 ___HD () C:\ProgramData\CanonIJMIG 2014-05-21 15:44 - 2013-05-20 13:12 - 00000000 ____D () C:\Users\Barbara\AppData\Roaming\canon 2014-05-21 15:34 - 2014-05-21 15:34 - 00000000 ___HD () C:\ProgramData\CanonIJEGV 2014-05-21 15:32 - 2014-05-21 15:31 - 00000000 ___HD () C:\ProgramData\CanonIJScan 2014-05-21 15:26 - 2014-05-21 15:26 - 00000000 ___HD () C:\ProgramData\CanonIJQuickMenu 2014-05-21 15:25 - 2014-05-21 15:12 - 00000000 ____D () C:\Program Files (x86)\Canon 2014-05-21 15:23 - 2014-05-21 15:23 - 00000000 ____D () C:\ProgramData\Canon IJ Network Tool 2014-05-21 15:23 - 2014-05-21 15:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon Utilities 2014-05-21 15:23 - 2009-07-14 05:20 - 00000000 __RSD () C:\Windows\Media 2014-05-21 15:22 - 2014-05-21 15:22 - 00001985 _____ () C:\Users\Public\Desktop\Canon Quick Menu.lnk 2014-05-21 15:22 - 2014-05-21 15:22 - 00000000 ____D () C:\Windows\system32\STRING 2014-05-21 15:22 - 2014-05-21 15:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MG3500 series Benutzerregistrierung 2014-05-21 15:22 - 2014-05-21 15:22 - 00000000 ____D () C:\ProgramData\CanonIJWSpt 2014-05-21 15:17 - 2014-05-21 15:17 - 00002320 _____ () C:\Users\Public\Desktop\Canon MG3500 series On-Screen-Handbuch.lnk 2014-05-21 15:17 - 2014-05-21 15:17 - 00000000 ___HD () C:\ProgramData\CanonBJ 2014-05-21 15:17 - 2014-05-21 15:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MG3500 series Manual 2014-05-21 15:17 - 2014-05-21 15:17 - 00000000 ____D () C:\Program Files\Canon 2014-05-21 15:16 - 2014-05-21 15:16 - 00000000 ___HD () C:\Program Files\CanonBJ 2014-05-21 15:13 - 2014-05-21 15:13 - 00000000 ___HD () C:\ProgramData\CanonIJETV 2014-05-15 15:19 - 2012-06-14 11:16 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-05-15 15:19 - 2012-06-14 11:16 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-05-15 15:19 - 2011-07-24 08:30 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-05-12 20:36 - 2013-05-22 15:27 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2014-05-12 07:26 - 2014-05-22 16:57 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-05-12 07:26 - 2014-05-22 16:57 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-05-12 07:25 - 2014-05-22 16:57 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-05-11 15:23 - 2014-05-11 15:23 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-05-09 11:16 - 2014-05-26 19:17 - 00130584 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys 2014-05-09 11:16 - 2014-05-26 19:17 - 00112080 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys 2014-05-09 11:16 - 2014-05-26 19:17 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys Some content of TEMP: ==================== C:\Users\Barbara\AppData\Local\Temp\AskSLib.dll C:\Users\Barbara\AppData\Local\Temp\avgnt.exe C:\Users\Barbara\AppData\Local\Temp\BackupSetup.exe C:\Users\Barbara\AppData\Local\Temp\BundleSweetIMSetup.exe C:\Users\Barbara\AppData\Local\Temp\contentDATs.exe C:\Users\Barbara\AppData\Local\Temp\CopyUpdate.exe C:\Users\Barbara\AppData\Local\Temp\CPCShield_Setup.exe C:\Users\Barbara\AppData\Local\Temp\Delta.exe C:\Users\Barbara\AppData\Local\Temp\DeltaTB.exe C:\Users\Barbara\AppData\Local\Temp\dltr.exe C:\Users\Barbara\AppData\Local\Temp\EnableExtDll.dll C:\Users\Barbara\AppData\Local\Temp\Extract.exe C:\Users\Barbara\AppData\Local\Temp\FP_PL_PFS_INSTALLER.exe C:\Users\Barbara\AppData\Local\Temp\FreeGamesSetup.exe C:\Users\Barbara\AppData\Local\Temp\GCVerifier.dll C:\Users\Barbara\AppData\Local\Temp\HPHelpUpdater.exe C:\Users\Barbara\AppData\Local\Temp\mgxfonts.exe C:\Users\Barbara\AppData\Local\Temp\mgxoschk.dll C:\Users\Barbara\AppData\Local\Temp\MgxVistaTools.dll C:\Users\Barbara\AppData\Local\Temp\MSETUP4.EXE C:\Users\Barbara\AppData\Local\Temp\MybabylonTB.exe C:\Users\Barbara\AppData\Local\Temp\Resource.exe C:\Users\Barbara\AppData\Local\Temp\SecurityScan_Release.exe C:\Users\Barbara\AppData\Local\Temp\sp54620.exe C:\Users\Barbara\AppData\Local\Temp\SP54714.exe C:\Users\Barbara\AppData\Local\Temp\SP55081.exe C:\Users\Barbara\AppData\Local\Temp\SP55083.exe C:\Users\Barbara\AppData\Local\Temp\SP55085.exe C:\Users\Barbara\AppData\Local\Temp\SP55152.exe C:\Users\Barbara\AppData\Local\Temp\SP56215.exe C:\Users\Barbara\AppData\Local\Temp\SP56878.exe C:\Users\Barbara\AppData\Local\Temp\SP56929.exe C:\Users\Barbara\AppData\Local\Temp\SP57049.exe C:\Users\Barbara\AppData\Local\Temp\sp58915.exe C:\Users\Barbara\AppData\Local\Temp\SP59202.exe C:\Users\Barbara\AppData\Local\Temp\SP59792.exe C:\Users\Barbara\AppData\Local\Temp\SP62234.exe C:\Users\Barbara\AppData\Local\Temp\sp64126.exe C:\Users\Barbara\AppData\Local\Temp\uninstall.exe C:\Users\Barbara\AppData\Local\Temp\UninstallHPSA.exe C:\Users\Barbara\AppData\Local\Temp\WSSetup.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-05-29 10:06 ==================== End Of Log ============================ Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 06-06-2014
Ran by Barbara at 2014-06-08 13:58:52
Running from C:\Users\Barbara\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Microsoft Security Essentials (Enabled - Out of date) {641105E6-77ED-3F35-A304-765193BCB75F}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Microsoft Security Essentials (Enabled - Out of date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
==================== Installed Programs ======================
Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Reader X (10.1.10) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.10 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.5 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.5.9.620 - Adobe Systems, Inc.)
AMD APP SDK Runtime (Version: 2.5.775.2 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Install Manager (HKLM\...\{ACD449FA-9DF3-779D-DA68-11D486963225}) (Version: 3.0.847.0 - Advanced Micro Devices, Inc.)
AMD Fuel (Version: 2011.0928.607.9079 - Ihr Firmenname) Hidden
AMD Media Foundation Decoders (Version: 1.0.60928.0618 - Advanced Micro Devices, Inc.) Hidden
AMD Steady Video Plug-In (Version: 1.00.0000 - AMD) Hidden
AMD System Monitor (HKLM-x32\...\{4144F415-7434-4501-97DE-CED4FAF64E7D}) (Version: 1.0.6 - Advanced Micro Devices, Inc.)
AMD VISION Engine Control Center (x32 Version: 2011.0928.607.9079 - Ihr Firmenname) Hidden
Apple Application Support (HKLM-x32\...\{122ADF8C-DDA1-480C-9936-C88F2825B265}) (Version: 2.1.9 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{6A76BEAF-6D1F-4273-A79B-DA8410A2E56B}) (Version: 5.2.0.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Audacity 1.2.6 (HKLM-x32\...\Audacity_is1) (Version: - )
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.4.642 - Avira)
Avira Savings Advisor (HKLM-x32\...\{A18A516C-AA41-46A9-92DB-60208917E442}) (Version: 1.5.14 - Avira) <==== ATTENTION
BIPA FotoShop (HKLM-x32\...\BIPA FotoShop) (Version: - )
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Bundled software uninstaller (HKLM-x32\...\bi_uninstaller) (Version: - ) <==== ATTENTION
Caillous Vorschule (HKLM-x32\...\{32180A3A-F7F0-4BD9-924A-B3A271DD35AE}) (Version: 1.00.000 - )
Canon Easy-WebPrint EX (HKLM-x32\...\Easy-WebPrint EX) (Version: 1.4.1.0 - Canon Inc.)
Canon IJ Network Scanner Selector EX (HKLM-x32\...\Canon_IJ_Network_Scanner_Selector_EX) (Version: - Canon Inc.)
Canon IJ Network Tool (HKLM-x32\...\Canon_IJ_Network_UTILITY) (Version: 3.3.0 - Canon Inc.)
Canon IJ Scan Utility (HKLM-x32\...\Canon_IJ_Scan_Utility) (Version: - Canon Inc.)
Canon Inkjet Printer/Scanner/Fax Extended Survey Program (HKLM-x32\...\CANONIJPLM100) (Version: 4.1.0 - Canon Inc.)
Canon MG3500 series Benutzerregistrierung (HKLM-x32\...\Canon MG3500 series Benutzerregistrierung) (Version: - *Canon Inc.)
Canon MG3500 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG3500_series) (Version: 1.00 - Canon Inc.)
Canon MG3500 series On-screen Manual (HKLM-x32\...\Canon MG3500 series On-screen Manual) (Version: 7.6.1 - Canon Inc.)
Canon My Image Garden (HKLM-x32\...\Canon My Image Garden) (Version: 2.0.1 - Canon Inc.)
Canon My Image Garden Design Files (HKLM-x32\...\Canon My Image Garden Design Files) (Version: 2.0.0 - Canon Inc.)
Canon My Printer (HKLM-x32\...\CanonMyPrinter) (Version: 3.1.0 - Canon Inc.)
Canon Quick Menu (HKLM-x32\...\CanonQuickMenu) (Version: 2.2.0 - Canon Inc.)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2011.0928.607.9079 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2011.0928.607.9079 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2011.0928.607.9079 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2011.0928.0606.9079 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2011.0928.0606.9079 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2011.0928.0606.9079 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2011.0928.0606.9079 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2011.0928.0606.9079 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2011.0928.0606.9079 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2011.0928.0606.9079 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2011.0928.0606.9079 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2011.0928.0606.9079 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2011.0928.0606.9079 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2011.0928.0606.9079 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2011.0928.0606.9079 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2011.0928.0606.9079 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2011.0928.0606.9079 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2011.0928.0606.9079 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2011.0928.0606.9079 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2011.0928.0606.9079 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2011.0928.0606.9079 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2011.0928.0606.9079 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2011.0928.0606.9079 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2011.0928.0606.9079 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2011.0928.0606.9079 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2011.0928.607.9079 - Advanced Micro Devices, Inc.) Hidden
ChicaPC-Shield Version 1.75.0.1400 (x32 Version: 1.75.0.1400 - ChicaLogic) Hidden
Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.5.1.4119 - CyberLink Corp.)
CyberLink YouCam (x32 Version: 3.5.1.4119 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DriverTuner 3.1.0.0 (HKLM-x32\...\{520C1D80-935C-42B9-9340-E883849D804F}_is1) (Version: 3.1.0.0 - LionSea SoftWare)
ESU for Microsoft Windows 7 SP1 (HKLM-x32\...\{E96CAA2A-0244-4A2A-8403-0C3C9534778B}) (Version: 2.1.1 - Hewlett-Packard)
Firebird SQL Server - MAGIX Edition (HKLM-x32\...\Firebird SQL Server D) (Version: 2.0.1.13 - MAGIX AG)
Free YouTube to MP3 Converter version 3.12.16.1030 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.16.1030 - DVDVideoSoft Ltd.)
Google Update Helper (x32 Version: 1.3.23.0 - PriceMeter) Hidden <==== ATTENTION
Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
HP Auto (Version: 1.0.12935.3667 - Hewlett-Packard Company) Hidden
HP Client Services (Version: 1.1.12938.3539 - Hewlett-Packard) Hidden
HP Customer Experience Enhancements (x32 Version: 6.0.1.7 - Hewlett-Packard) Hidden
HP On Screen Display (HKLM-x32\...\{ED1BD69A-07E3-418C-91F1-D856582581BF}) (Version: 1.3.5 - Hewlett-Packard Company)
HP Power Manager (HKLM-x32\...\{D8BCE5B9-67CF-4F3F-93AE-3ACC754C72EB}) (Version: 1.4.7 - Hewlett-Packard Company)
HP Quick Launch (HKLM-x32\...\{53B17A98-5BF0-40BC-AAFF-850A357975AC}) (Version: 2.7.2 - Hewlett-Packard Company)
HP QuickWeb (HKLM-x32\...\{999164B6-5B78-4DD3-BACE-7292640AD0DD}) (Version: 3.1.0.9760 - Hewlett-Packard Company)
HP Setup (HKLM-x32\...\{5036764A-435D-40C9-869C-31085A3D741D}) (Version: 8.7.4751.3798 - Hewlett-Packard Company)
HP Setup Manager (HKLM-x32\...\{AE856388-AFAD-4753-81DF-D96B19D0A17C}) (Version: 1.1.13476.3753 - Hewlett-Packard Company)
HP Software Framework (HKLM-x32\...\{D2462056-BA75-4B2C-8267-DFEA2B6AC4AE}) (Version: 4.6.10.1 - Hewlett-Packard Company)
HP Support Assistant (HKLM-x32\...\{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}) (Version: 7.4.45.4 - Hewlett-Packard Company)
IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6319.0 - IDT)
iTunes (HKLM\...\{840A3BAA-4C68-4581-9C7A-6F8D6CF531B9}) (Version: 10.6.3.25 - Apple Inc.)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
L&H TTS3000 Deutsch (HKLM-x32\...\LHTTSGED) (Version: - )
Macromedia Shockwave Player (HKLM-x32\...\Macromedia Shockwave Player) (Version: - )
Magic Desktop (HKLM-x32\...\EasyBits Magic Desktop) (Version: 3.0 - EasyBits Software AS)
MAGIX 3D Maker (embeded) (HKLM-x32\...\MAGIX 3D Maker D) (Version: 6.0.0.2 - MAGIX AG)
MAGIX Burn routines (HKLM-x32\...\{7F2B12E7-2302-4A86-AE26-33DDD84E478A}) (Version: 9.0.0.193 - MAGIX AG)
MAGIX Foto Manager 8 6.0.1.457 (D) (HKLM-x32\...\MAGIX Foto Manager 8 D) (Version: 6.0.1.457 - MAGIX AG)
MAGIX Fotobuch 3.6 (HKLM-x32\...\MAGIX Fotobuch) (Version: 3.6 - MAGIX AG)
MAGIX Online Druck Service 3.4.3.0 (D) (HKLM-x32\...\MAGIX Online Druck Service D) (Version: 3.4.3.0 - MAGIX AG)
MAGIX Screenshare 4.3.6.1987 (D) (HKLM-x32\...\MAGIX Screenshare D) (Version: 4.3.6.1987 - MAGIX AG)
MAGIX Video deluxe 15 Plus 8.0.0.62 (D) (HKLM-x32\...\MAGIX Video deluxe 15 Plus D) (Version: 8.0.0.62 - MAGIX AG)
MAGIX Xtreme Foto Designer 6 6.0.25.0 (D) (HKLM-x32\...\MAGIX Xtreme Foto Designer 6 D) (Version: 6.0.25.0 - MAGIX AG)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.141.11 - McAfee, Inc.)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office 2000 Premium (HKLM-x32\...\{00000407-78E1-11D2-B60F-006097C998E7}) (Version: 9.00.2816 - Microsoft Corporation)
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Security Client (Version: 4.5.0216.0 - Microsoft Corporation) Hidden
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.5.216.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ Run Time Lib Setup (HKLM-x32\...\{AAF4238F-7C29-451D-9925-C753271A5728}) (Version: 1.0.0 - Microsoft)
Mozilla Firefox 29.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 29.0.1 (x86 de)) (Version: 29.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Mozilla Thunderbird 24.5.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 24.5.0 (x86 de)) (Version: 24.5.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Mufin MusicFinder Base 1.5.3.255 (D) (HKLM-x32\...\Mufin MusicFinder Base D) (Version: 1.5.3.255 - MAGIX AG)
Ravensburger tiptoi (HKLM-x32\...\Ravensburger tiptoi) (Version: - )
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.40.126.2011 - Realtek)
Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.1.7601.83 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver (HKLM-x32\...\{9D3D8C60-A55F-4123-B2B9-173F09590E16}) (Version: 1.00.11.0706 - REALTEK Semiconductor Corp.)
Recovery Manager (x32 Version: 2.0.0 - Hewlett-Packard) Hidden
Softonic toolbar on IE and Chrome (HKLM-x32\...\Softonic) (Version: 1.8.21.14 - Softonic) <==== ATTENTION
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.3.11.0 - Synaptics Incorporated)
Trojan Remover 6.9.0 (HKLM-x32\...\Trojan Remover_is1) (Version: 6.9.0 - Simply Super Software)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
WinZip Malware Protector (HKLM-x32\...\WinZip Malware Protector_is1) (Version: 2.1.1000.10798 - WinZip International LLC)
==================== Restore Points =========================
26-05-2014 17:11:41 TuneUp Utilities 2014 wird entfernt
26-05-2014 17:12:52 TuneUp Utilities 2014 (de-DE) wird entfernt
28-05-2014 12:50:53 Entfernt Caillous Vorschule
29-05-2014 16:40:49 Entfernt Schreibwerkstatt
29-05-2014 17:36:12 Installed Fighters.
08-06-2014 08:20:20 Geplanter Prüfpunkt
==================== Hosts content: ==========================
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {10F4889C-4043-4B55-8D18-38AED14504C3} - System32\Tasks\HPCeeScheduleForBarbara => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-13] (Hewlett-Packard)
Task: {1E1A9442-9D9C-4933-8154-51FC541A1C39} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {41BA2CDE-5FD2-4948-AE06-B7BCD6E63A11} - System32\Tasks\PriceMeterLiveUpdateUpdateTaskMachineCore => C:\Program Files (x86)\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe [2014-03-19] (PriceMeter) <==== ATTENTION
Task: {61BC80C9-A993-4FFD-81AA-D2EB34D268BA} - System32\Tasks\aviraSWU => Cscript.exe "C:\Program Files (x86)\avira\Internet Explorer\swu.vbs"
Task: {73353FBE-2D58-4D65-876A-2A6CC96CD3C0} - System32\Tasks\WinZip Malware Protector_startup => C:\Program Files (x86)\WinZip Malware Protector\WinZipMalwareProtector.exe [2013-07-15] (Nico Mak Computing)
Task: {753E670C-9DD0-47AA-AF90-C3124262802A} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {8AE665EB-41FC-4D28-ACA9-4D7973F1E064} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2014-03-21] (Hewlett-Packard)
Task: {96239A02-A250-48AC-AC95-BD611379BBDB} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2011-06-15] (CyberLink)
Task: {97116147-22F4-48EF-90AD-8BF0B9C39C89} - System32\Tasks\Advanced System Protector_startup => C:\Program Files (x86)\Advanced System Protector\AdvancedSystemProtector.exe <==== ATTENTION
Task: {B97ABC14-C081-40D4-95FE-8666316AD0BB} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2013-12-12] (Hewlett-Packard Company)
Task: {BC403985-E341-453D-BD48-90BC5B6E9AF0} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {BF4B4483-9CA7-4525-9EE2-01FACBE12844} - System32\Tasks\PriceMeterUpdater => C:\Users\Barbara\AppData\Roaming\PriceMeterUpdater\UpdateProc\UpdateTask.exe [2013-04-12] () <==== ATTENTION
Task: {CEEC6B99-BD72-4075-910E-B36D33F25533} - System32\Tasks\Registration => C:\Program Files (x86)\Hewlett-Packard\HP Setup\RemEngine.exe [2011-06-27] ()
Task: {DDCE964B-9C72-42CA-B86F-D10D38B222FD} - System32\Tasks\ChicaPC-Shield-Notification => C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\Toolkit\Sync.exe [2014-05-29] (SPAMfighter ApS)
Task: {E07A3D5F-0A8F-42AD-8C43-04AB6B2A5549} - System32\Tasks\pricemeterdownloader => C:\Users\Barbara\AppData\Local\PriceMeter\pricemeterd.exe <==== ATTENTION
Task: {E383725F-BD42-44CB-835F-3AE4F7B2983A} - System32\Tasks\{1B67B452-3D3B-4A57-9F66-7C53F3ECDBBB} => Firefox.exe
Task: {E4B2FD4C-FDFA-4104-A6D9-57BA6831A903} - System32\Tasks\PriceMeterLiveUpdateUpdateTaskMachineUA => C:\Program Files (x86)\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe [2014-03-19] (PriceMeter) <==== ATTENTION
Task: {F443360C-0D5C-4A4F-934B-27B975FBD02E} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-15] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\ChicaPC-Shield-Notification.job => C:\Program Files (x86)\ChicaLogic\ChicaPC-Shield\Toolkit\Sync.exe
Task: C:\Windows\Tasks\HPCeeScheduleForBarbara.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
Task: C:\Windows\Tasks\PriceMeterLiveUpdateUpdateTaskMachineCore.job => C:\Program Files (x86)\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe <==== ATTENTION
Task: C:\Windows\Tasks\PriceMeterLiveUpdateUpdateTaskMachineUA.job => C:\Program Files (x86)\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe <==== ATTENTION
Task: C:\Windows\Tasks\PriceMeterUpdater.job => C:\Users\Barbara\AppData\Roaming\PRICEM~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
==================== Loaded Modules (whitelisted) =============
2011-09-28 06:19 - 2011-09-28 06:19 - 00073728 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll
2014-05-21 15:24 - 2013-05-14 11:50 - 00140936 _____ () C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE
2011-09-28 06:19 - 2011-09-28 06:19 - 00103424 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2011-09-28 06:06 - 2011-09-28 06:06 - 00369152 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2011-06-17 13:42 - 2011-06-17 13:42 - 00016384 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2012-05-30 20:06 - 2012-05-30 20:06 - 00087912 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2012-05-30 20:06 - 2012-05-30 20:06 - 01242512 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-05-29 18:46 - 2013-02-28 16:53 - 00886272 _____ () C:\Program Files (x86)\WinZip Malware Protector\System.Data.SQLite.dll
2014-05-29 18:46 - 2013-07-15 16:53 - 01717936 _____ () C:\Program Files (x86)\WinZip Malware Protector\aspsys.dll
2014-05-29 18:46 - 2013-02-28 16:53 - 00168448 _____ () C:\Program Files (x86)\WinZip Malware Protector\UNRAR.DLL
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\ProgramData\Temp:373E1720
AlternateDataStreams: C:\ProgramData\Temp:CB0AACC9
==================== Safe Mode (whitelisted) ===================
==================== EXE Association (whitelisted) =============
==================== Disabled items from MSCONFIG ==============
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (06/08/2014 01:51:19 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 681584
Error: (06/08/2014 01:51:19 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 681584
Error: (06/08/2014 01:51:19 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (06/08/2014 01:51:18 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 680586
Error: (06/08/2014 01:51:18 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 680586
Error: (06/08/2014 01:51:18 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (06/08/2014 01:51:17 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 679572
Error: (06/08/2014 01:51:17 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 679572
Error: (06/08/2014 01:51:17 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (06/08/2014 01:40:04 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 7036
System errors:
=============
Error: (06/08/2014 00:55:23 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von %NT-AUTORITÄT60 ein Fehler festgestellt.
Neue Signaturversion:
Vorherige Signaturversion: 0.0.0.0
Aktualisierungsquelle: %NT-AUTORITÄT51
Aktualisierungsphase: 4.5.0216.00
Quellpfad: 4.5.0216.01
Signaturtyp: %NT-AUTORITÄT602
Aktualisierungstyp: %NT-AUTORITÄT604
Benutzer: NT-AUTORITÄT\NETZWERKDIENST
Aktuelle Modulversion: %NT-AUTORITÄT605
Vorherige Modulversion: %NT-AUTORITÄT606
Fehlercode: %NT-AUTORITÄT607
Fehlerbeschreibung: %NT-AUTORITÄT608
Error: (06/08/2014 00:54:57 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von %NT-AUTORITÄT60 ein Fehler festgestellt.
Neue Signaturversion:
Vorherige Signaturversion: 0.0.0.0
Aktualisierungsquelle: %NT-AUTORITÄT51
Aktualisierungsphase: 4.5.0216.00
Quellpfad: 4.5.0216.01
Signaturtyp: %NT-AUTORITÄT602
Aktualisierungstyp: %NT-AUTORITÄT604
Benutzer: NT-AUTORITÄT\NETZWERKDIENST
Aktuelle Modulversion: %NT-AUTORITÄT605
Vorherige Modulversion: %NT-AUTORITÄT606
Fehlercode: %NT-AUTORITÄT607
Fehlerbeschreibung: %NT-AUTORITÄT608
Error: (06/08/2014 00:54:57 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von %NT-AUTORITÄT60 ein Fehler festgestellt.
Neue Signaturversion:
Vorherige Signaturversion: 0.0.0.0
Aktualisierungsquelle: %NT-AUTORITÄT51
Aktualisierungsphase: 4.5.0216.00
Quellpfad: 4.5.0216.01
Signaturtyp: %NT-AUTORITÄT602
Aktualisierungstyp: %NT-AUTORITÄT604
Benutzer: NT-AUTORITÄT\NETZWERKDIENST
Aktuelle Modulversion: %NT-AUTORITÄT605
Vorherige Modulversion: %NT-AUTORITÄT606
Fehlercode: %NT-AUTORITÄT607
Fehlerbeschreibung: %NT-AUTORITÄT608
Error: (06/08/2014 00:54:30 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von %NT-AUTORITÄT60 ein Fehler festgestellt.
Neue Signaturversion:
Vorherige Signaturversion: 0.0.0.0
Aktualisierungsquelle: %NT-AUTORITÄT59
Aktualisierungsphase: 4.5.0216.00
Quellpfad: 4.5.0216.01
Signaturtyp: %NT-AUTORITÄT602
Aktualisierungstyp: %NT-AUTORITÄT604
Benutzer: NT-AUTORITÄT\SYSTEM
Aktuelle Modulversion: %NT-AUTORITÄT605
Vorherige Modulversion: %NT-AUTORITÄT606
Fehlercode: %NT-AUTORITÄT607
Fehlerbeschreibung: %NT-AUTORITÄT608
Error: (06/08/2014 10:30:11 AM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von %NT-AUTORITÄT60 ein Fehler festgestellt.
Neue Signaturversion:
Vorherige Signaturversion: 0.0.0.0
Aktualisierungsquelle: %NT-AUTORITÄT51
Aktualisierungsphase: 4.5.0216.00
Quellpfad: 4.5.0216.01
Signaturtyp: %NT-AUTORITÄT602
Aktualisierungstyp: %NT-AUTORITÄT604
Benutzer: NT-AUTORITÄT\NETZWERKDIENST
Aktuelle Modulversion: %NT-AUTORITÄT605
Vorherige Modulversion: %NT-AUTORITÄT606
Fehlercode: %NT-AUTORITÄT607
Fehlerbeschreibung: %NT-AUTORITÄT608
Error: (06/08/2014 10:29:44 AM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von %NT-AUTORITÄT60 ein Fehler festgestellt.
Neue Signaturversion:
Vorherige Signaturversion: 0.0.0.0
Aktualisierungsquelle: %NT-AUTORITÄT51
Aktualisierungsphase: 4.5.0216.00
Quellpfad: 4.5.0216.01
Signaturtyp: %NT-AUTORITÄT602
Aktualisierungstyp: %NT-AUTORITÄT604
Benutzer: NT-AUTORITÄT\NETZWERKDIENST
Aktuelle Modulversion: %NT-AUTORITÄT605
Vorherige Modulversion: %NT-AUTORITÄT606
Fehlercode: %NT-AUTORITÄT607
Fehlerbeschreibung: %NT-AUTORITÄT608
Error: (06/08/2014 10:29:44 AM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von %NT-AUTORITÄT60 ein Fehler festgestellt.
Neue Signaturversion:
Vorherige Signaturversion: 0.0.0.0
Aktualisierungsquelle: %NT-AUTORITÄT51
Aktualisierungsphase: 4.5.0216.00
Quellpfad: 4.5.0216.01
Signaturtyp: %NT-AUTORITÄT602
Aktualisierungstyp: %NT-AUTORITÄT604
Benutzer: NT-AUTORITÄT\NETZWERKDIENST
Aktuelle Modulversion: %NT-AUTORITÄT605
Vorherige Modulversion: %NT-AUTORITÄT606
Fehlercode: %NT-AUTORITÄT607
Fehlerbeschreibung: %NT-AUTORITÄT608
Error: (06/08/2014 10:29:08 AM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von %NT-AUTORITÄT60 ein Fehler festgestellt.
Neue Signaturversion:
Vorherige Signaturversion: 0.0.0.0
Aktualisierungsquelle: %NT-AUTORITÄT59
Aktualisierungsphase: 4.5.0216.00
Quellpfad: 4.5.0216.01
Signaturtyp: %NT-AUTORITÄT602
Aktualisierungstyp: %NT-AUTORITÄT604
Benutzer: NT-AUTORITÄT\SYSTEM
Aktuelle Modulversion: %NT-AUTORITÄT605
Vorherige Modulversion: %NT-AUTORITÄT606
Fehlercode: %NT-AUTORITÄT607
Fehlerbeschreibung: %NT-AUTORITÄT608
Error: (06/08/2014 10:07:41 AM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von %NT-AUTORITÄT60 ein Fehler festgestellt.
Neue Signaturversion:
Vorherige Signaturversion: 0.0.0.0
Aktualisierungsquelle: %NT-AUTORITÄT51
Aktualisierungsphase: 4.5.0216.00
Quellpfad: 4.5.0216.01
Signaturtyp: %NT-AUTORITÄT602
Aktualisierungstyp: %NT-AUTORITÄT604
Benutzer: NT-AUTORITÄT\NETZWERKDIENST
Aktuelle Modulversion: %NT-AUTORITÄT605
Vorherige Modulversion: %NT-AUTORITÄT606
Fehlercode: %NT-AUTORITÄT607
Fehlerbeschreibung: %NT-AUTORITÄT608
Error: (06/08/2014 10:07:15 AM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von %NT-AUTORITÄT60 ein Fehler festgestellt.
Neue Signaturversion:
Vorherige Signaturversion: 0.0.0.0
Aktualisierungsquelle: %NT-AUTORITÄT51
Aktualisierungsphase: 4.5.0216.00
Quellpfad: 4.5.0216.01
Signaturtyp: %NT-AUTORITÄT602
Aktualisierungstyp: %NT-AUTORITÄT604
Benutzer: NT-AUTORITÄT\NETZWERKDIENST
Aktuelle Modulversion: %NT-AUTORITÄT605
Vorherige Modulversion: %NT-AUTORITÄT606
Fehlercode: %NT-AUTORITÄT607
Fehlerbeschreibung: %NT-AUTORITÄT608
Microsoft Office Sessions:
=========================
Error: (06/08/2014 01:51:19 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 681584
Error: (06/08/2014 01:51:19 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 681584
Error: (06/08/2014 01:51:19 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (06/08/2014 01:51:18 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 680586
Error: (06/08/2014 01:51:18 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 680586
Error: (06/08/2014 01:51:18 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (06/08/2014 01:51:17 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 679572
Error: (06/08/2014 01:51:17 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 679572
Error: (06/08/2014 01:51:17 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (06/08/2014 01:40:04 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 7036
==================== Memory info ===========================
Percentage of memory in use: 41%
Total physical RAM: 5609.41 MB
Available physical RAM: 3299.19 MB
Total Pagefile: 11216.99 MB
Available Pagefile: 8545.04 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:678.85 GB) (Free:538.94 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Recovery) (Fixed) (Total:15.62 GB) (Free:1.7 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (HP_TOOLS) (Fixed) (Total:3.96 GB) (Free:1.1 GB) FAT32
Drive g: () (Removable) (Total:0.24 GB) (Free:0 GB) FAT
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 699 GB) (Disk ID: 1412B001)
Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=679 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=16 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=4 GB) - (Type=0C)
========================================================
Disk: 1 (Size: 243 MB) (Disk ID: 00000000)
Partition: GPT Partition Type.
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-06-08 14:39:27
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\0000006a WDC_WD75 rev.01.0 698,64GB
Running: Gmer-19357.exe; Driver: C:\Users\Barbara\AppData\Local\Temp\ufliqkog.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff80002ffd000 63 bytes [43, 4D, 33, 31, 05, 00, 00, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 593 fffff80002ffd041 12 bytes [90, 75, 06, A0, F8, FF, FF, ...]
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[2460] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075701465 2 bytes [70, 75]
.text C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[2460] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000757014bb 2 bytes [70, 75]
.text ... * 2
.text C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE[4360] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075701465 2 bytes [70, 75]
.text C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE[4360] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000757014bb 2 bytes [70, 75]
.text ... * 2
.text C:\Program Files (x86)\Canon\Quick Menu\CNQMSWCS.exe[5176] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000075701465 2 bytes [70, 75]
.text C:\Program Files (x86)\Canon\Quick Menu\CNQMSWCS.exe[5176] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000757014bb 2 bytes [70, 75]
.text ... * 2
.text C:\Program Files (x86)\WinZip Malware Protector\WinZipMalwareProtector.exe[5612] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075701465 2 bytes [70, 75]
.text C:\Program Files (x86)\WinZip Malware Protector\WinZipMalwareProtector.exe[5612] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000757014bb 2 bytes [70, 75]
.text ... * 2
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{95C6E7A9-187E-40E5-9A27-C3F8BA03E71D}\Connection@Name LAN-Verbindung* 2
Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Bind \Device\{DCAB6D87-D84B-4AE0-985A-AB0C8C9BD309}?\Device\{95C6E7A9-187E-40E5-9A27-C3F8BA03E71D}?\Device\{8593D552-5045-4866-A983-69AB822F4415}?\Device\{CEAAA49F-84AA-4C65-B2DA-DE4F6D3F8701}?\Device\{0D3E105F-3BE4-49BC-A9AC-79361D4AA1A2}?
Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Route "{DCAB6D87-D84B-4AE0-985A-AB0C8C9BD309}"?"{95C6E7A9-187E-40E5-9A27-C3F8BA03E71D}"?"{8593D552-5045-4866-A983-69AB822F4415}"?"{CEAAA49F-84AA-4C65-B2DA-DE4F6D3F8701}"?"{0D3E105F-3BE4-49BC-A9AC-79361D4AA1A2}"?
Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Export \Device\TCPIP6TUNNEL_{DCAB6D87-D84B-4AE0-985A-AB0C8C9BD309}?\Device\TCPIP6TUNNEL_{95C6E7A9-187E-40E5-9A27-C3F8BA03E71D}?\Device\TCPIP6TUNNEL_{8593D552-5045-4866-A983-69AB822F4415}?\Device\TCPIP6TUNNEL_{CEAAA49F-84AA-4C65-B2DA-DE4F6D3F8701}?\Device\TCPIP6TUNNEL_{0D3E105F-3BE4-49BC-A9AC-79361D4AA1A2}?
Reg HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{95C6E7A9-187E-40E5-9A27-C3F8BA03E71D}@InterfaceName isatap.{9A9D1FBC-87CA-4829-BC09-82D62CCE9B59}
Reg HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{95C6E7A9-187E-40E5-9A27-C3F8BA03E71D}@ReusableType 0
Reg HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Epoch2@Epoch 32256
---- EOF - GMER 2.1 ----
Lieben Gruß Andreas |
| Themen zu WINDOWS 7: Phishing-Mail von Bank angeklickt |
| 4d36e972-e325-11ce-bfc1-08002be10318, adobe, adobe flash player, antivir, antivirus, association, avira savings advisor, bonjour, branding, canon, computer, converter, device driver, dvdvideosoft ltd., explorer, fehler, flash player, home, homepage, installation, internet, langsam, launch, monitor, mozilla, mp3, opera, realtek, security, software, super, system, tunnel, vonteera, windows, winlogon.exe |
Baum-Darstellung