| |
| |||||||
Log-Analyse und Auswertung: WIN7 PUP.Optional.... gefundenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
12.06.2014, 19:16
| #1 |
| |  WIN7 PUP.Optional.... gefunden Hallo, wollte heute ein Flash-Player Update(von Adobe Seite) installieren. Hat aber nicht funktioniert,, weil ein Problem mit einer dll-datei auftrat. das kam mir komisch vor und darauf habe ich mal Antimalwarebytes laufen lassen, was auch einige Einträge ausgespuckt hat. Mein Bruder hat mir danach auch noch gebeichtet, dass er gestern eine Email mit komischen Zeichen bekommen hat... Ist da noch was zu retten? Hier die Log-Files: Malwarebytes: Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Scan Date: 12.06.2014 Scan Time: 18:57:48 Logfile: mbam.txt Administrator: Yes Version: 2.00.2.1012 Malware Database: v2014.06.12.08 Rootkit Database: v2014.06.02.01 License: Trial Malware Protection: Enabled Malicious Website Protection: Enabled Self-protection: Disabled OS: Windows 7 Service Pack 1 CPU: x64 File System: NTFS User: masteruser Scan Type: Threat Scan Result: Completed Objects Scanned: 415846 Time Elapsed: 11 min, 19 sec Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Disabled Heuristics: Enabled PUP: Enabled PUM: Enabled Processes: 0 (No malicious items detected) Modules: 0 (No malicious items detected) Registry Keys: 3 PUP.Optional.InstallCore.A, HKU\S-1-5-21-1692514539-1397013794-4007604138-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE\1I1T1Q1S, , [63356710c9b2e353a1507945788ad62a], PUP.Optional.InstallCore.A, HKU\S-1-5-21-1692514539-1397013794-4007604138-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE, , [3f59ec8be794f34327d6ece8e221738d], PUP.Optional.Softonic.A, HKU\S-1-5-21-1692514539-1397013794-4007604138-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SOFTONIC\Universal Downloader, , [18805720bfbc9b9b27773f6eda289070], Registry Values: 1 PUP.Optional.InstallCore.A, HKU\S-1-5-21-1692514539-1397013794-4007604138-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE|tb, 0G2Y1R2X0G1M2S1M0G1S1H, , [3f59ec8be794f34327d6ece8e221738d] Registry Data: 0 (No malicious items detected) Folders: 0 (No malicious items detected) Files: 15 PUP.Optional.Inbox, C:\$Recycle.Bin\S-1-5-21-1692514539-1397013794-4007604138-1002\$R0O0RDW.exe, , [d8c05324fe7d5dd98f6611fac839c13f], PUP.Optional.Softonic.A, C:\$Recycle.Bin\S-1-5-21-1692514539-1397013794-4007604138-1002\$R0JOMDD.exe, , [55431760df9cda5cb04a859da25f2bd5], PUP.Optional.Inbox, C:\$Recycle.Bin\S-1-5-21-1692514539-1397013794-4007604138-1002\$R3IIBJT.exe, , [3a5e3e39d3a849ed0fe63bd043be9070], PUP.Optional.Inbox, C:\$Recycle.Bin\S-1-5-21-1692514539-1397013794-4007604138-1002\$RB5XV5P.exe, , [8216f1865d1eaf873abbb754679ab14f], PUP.Optional.Softonic.A, C:\$Recycle.Bin\S-1-5-21-1692514539-1397013794-4007604138-1002\$RBEX0E5.exe, , [71278ceb1b602f07d525140ec63b58a8], PUP.Optional.Softonic.A, C:\$Recycle.Bin\S-1-5-21-1692514539-1397013794-4007604138-1002\$RBT6PQA.exe, , [28700e69dc9fcc6a0befee341fe2d828], PUP.Optional.OptimumInstaller.A, C:\$Recycle.Bin\S-1-5-21-1692514539-1397013794-4007604138-1002\$RQBKBBR.exe, , [d4c440371368e254e1b9e07061a0a759], PUP.Optional.Bandoo, C:\$Recycle.Bin\S-1-5-21-1692514539-1397013794-4007604138-1003\$R4AXWDL.exe, , [c9cff0877ffce94da6f695773ec31ce4], PUP.Optional.OpenCandy, C:\Users\masteruser\AppData\Local\Temp\is-PVTJ5.tmp\OCSetupHlp.dll, , [e2b6304796e5e94d73541682d331ba46], Trojan.Agent, C:\Users\XXXXXXX\AppData\Local\Temp\7N3oPyHj.exe.part, , [d7c1f681a8d30432f8e0520b8c75d030], PUP.Optional.Bandoo, C:\Users\XXXXXX\Downloads\iLividSetup-r776-n-bf.exe, , [1d7b5f181e5d9d99e8b45daf6d947d83], PUP.Optional.Bandoo, C:\Users\XXXXXX\Downloads\iLividSetupV1.exe, , [4f497dfad2a90432a1fbfc10cd346f91], PUP.Optional.Softonic.A, C:\Users\XXXXXX\Downloads\SoftonicDownloader_fuer_turbo-floorplan-garten-und-landschaftsarchitekt(1).exe, , [3b5d2c4bfd7e64d245b5f82a04fdee12], Backdoor.Agent.Gen, C:\Users\XXXXXXX\AppData\Roaming\pack.exe, , [3761c8afa9d27fb71f495a3cc93ab44c], PUP.Optional.Searchqu.A, C:\Users\XXXXXXX\AppData\Roaming\Mozilla\Extensions\{1FD91A9C-410C-4090-BBCC-55D3450EF433}, , [9602c8aff58654e26a0082536d96f808], Physical Sectors: 0 (No malicious items detected) (end) Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-06-2014 02
Ran by XXXXXX (ATTENTION: The logged in user is not administrator) on NONAME on 12-06-2014 19:15:40
Running from D:\Eigene Dateien\Desktop
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(FileHippo.com) P:\FileHippo.com\UpdateChecker.exe
(Sandboxie Holdings, LLC) P:\Sandboxie\SbieCtrl.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
(AVAST Software) P:\AVAST Software\Avast\AvastUI.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Mozilla Corporation) P:\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [9642528 2010-02-24] (Realtek Semiconductor)
HKLM\...\Run: [CanonSolutionMenu] => C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe [689488 2008-03-10] (CANON INC.)
HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2114376 2008-03-17] (CANON INC.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-01-13] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [BCSSync] => P:\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AvastUI.exe] => P:\AVAST Software\Avast\AvastUI.exe [3873704 2014-04-23] (AVAST Software)
HKLM\...\Runonce: [MSPCLOCK] - rundll32.exe streamci,StreamingDeviceSetup {97ebaacc-95bd-11d0-a3ea-00a0c9223196},{53172480-4791-11D0-A5D6-28DB04C10000},{53172480-4791-11D0-A5D6-28DB04C10000}
HKLM\...\Runonce: [MSPQM] - rundll32.exe streamci,StreamingDeviceSetup {DDF4358E-BB2C-11D0-A42F-00A0C9223196},{97EBAACB-95BD-11D0-A3EA-00A0C9223196},{97EBAACB-95BD-11D0-A3EA-00A0C9223196}
HKLM\...\Runonce: [MSKSSRV] - rundll32.exe streamci,StreamingDeviceSetup {96E080C7-143C-11D1-B40F-00A0C9223196},{3C0D501A-140B-11D1-B40F-00A0C9223196},{3C0D501A-140B-11D1-B40F-00A0C9223196}
HKLM\...\Runonce: [MSTEE.CxTransform] - rundll32.exe streamci,StreamingDeviceSetup {cfd669f1-9bc2-11d0-8299-0000f822fe8a},{CF1DDA2C-9743-11D0-A3EE-00A0C9223196},{CF1DDA2C-9743-11D0-A3EE-00A0C9223196},C:\Windows\inf\ksfilter.inf,MSTEE.Interface.Install
HKLM\...\Runonce: [MSTEE.Splitter] - rundll32.exe streamci,StreamingDeviceSetup {cfd669f1-9bc2-11d0-8299-0000f822fe8a},{0A4252A0-7E70-11D0-A5D6-28DB04C10000},{0A4252A0-7E70-11D0-A5D6-28DB04C10000},C:\Windows\inf\ksfilter.inf,MSTEE.Interface.Install
HKLM\...\Runonce: [WDM_DRMKAUD] - rundll32.exe streamci,StreamingDeviceSetup {EEC12DB6-AD9C-4168-8658-B03DAEF417FE},{ABD61E00-9350-47e2-A632-4438B90C6641},{FFBB6E3F-CCFE-4D84-90D9-421418B03A8E},C:\Windows\inf\WDMAUDIO.inf,WDM_DRMKAUD.Interface.Install
HKLM-x32\...\Runonce: [aswAhAScr.dll] - "P:\AVAST Software\Avast\aswRegSvr.exe" "P:\AVAST Software\Avast\AhAScr.dll" [X]
HKLM-x32\...\Runonce: [aswasOutExt.dll] - "P:\AVAST Software\Avast\aswRegSvr.exe" "P:\AVAST Software\Avast\asOutExt.dll" [X]
HKLM-x32\...\Runonce: [aswasOutExt64.dll] - "P:\AVAST Software\Avast\aswRegSvr64.exe" "P:\AVAST Software\Avast\asOutExt64.dll" [X]
HKLM-x32\...\RunOnce: [20131224] - P:\AVAST Software\Avast\setup\emupdate\f06bc031-c9f4-41f6-8252-3193d03981b2.exe /check [181136 2014-04-29] (AVAST Software)
HKLM-x32\...\RunOnce: [20140526] - P:\AVAST Software\Avast\setup\emupdate\7ae5aa4f-81b5-437c-88c8-8d1d8f1b31a8.exe /check [182720 2014-05-27] (AVAST Software)
HKLM-x32\...\RunOnce: [20140529] - P:\AVAST Software\Avast\setup\emupdate\51d1a79d-f668-4a0f-aa07-81e6eec710a0.exe /check [183208 2014-05-30] (AVAST Software)
HKU\S-1-5-21-1692514539-1397013794-4007604138-1001\...\Run: [FileHippo.com] => P:\FileHippo.com\UpdateChecker.exe [307712 2012-11-23] (FileHippo.com)
HKU\S-1-5-21-1692514539-1397013794-4007604138-1001\...\Run: [SandboxieControl] => P:\Sandboxie\SbieCtrl.exe [784392 2014-05-29] (Sandboxie Holdings, LLC)
HKU\S-1-5-21-1692514539-1397013794-4007604138-1001\...\Run: [ConnectionCenter] => C:\Users\XXXXXX\AppData\Local\Citrix\ICA Client\concentr.exe [103768 2009-09-12] (Citrix Systems, Inc.)
HKU\S-1-5-21-1692514539-1397013794-4007604138-1001\...\MountPoints2: {39536f8b-10ad-11e2-812e-4487fc9fa8fa} - Q:\LaunchU3.exe -a
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m5910&r=17360912c106pe465v145w46m1u190
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m5910&r=17360912c106pe465v145w46m1u190
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m5910&r=17360912c106pe465v145w46m1u190
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m5910&r=17360912c106pe465v145w46m1u190
URLSearchHook: HKCU - (No Name) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - No File
SearchScopes: HKLM-x32 - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKCU - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deDE501
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deDE501
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - P:\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - P:\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - P:\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - P:\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Handler: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll ()
Handler: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll ()
Handler: mailto - {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll ()
Handler: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll ()
Handler: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll ()
Handler-x32: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll ()
Handler-x32: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll ()
Handler-x32: mailto - {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll ()
Handler-x32: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll ()
Handler-x32: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll ()
FireFox:
========
FF ProfilePath: C:\Users\XXXXXX\AppData\Roaming\Mozilla\Firefox\Profiles\r4z93rlm.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.6 - P:\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.0.7 - P:\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.0 - P:\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.1 - P:\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.2 - P:\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 - P:\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.4 - P:\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - P:\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - P:\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - P:\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: WOT - C:\Users\XXXXXX\AppData\Roaming\Mozilla\Firefox\Profiles\r4z93rlm.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2013-11-27]
FF Extension: DownloadHelper - C:\Users\XXXXXX\AppData\Roaming\Mozilla\Firefox\Profiles\r4z93rlm.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-03-27]
FF Extension: NoScript - C:\Users\XXXXXX\AppData\Roaming\Mozilla\Firefox\Profiles\r4z93rlm.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2012-09-14]
FF Extension: Adblock Plus - C:\Users\XXXXXX\AppData\Roaming\Mozilla\Firefox\Profiles\r4z93rlm.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-09-14]
FF Extension: avast! Online Security - P:\AVAST Software\Avast\WebRep\FF [2012-09-14]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - P:\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - P:\AVAST Software\Avast\WebRep\FF [2012-09-14]
FF StartMenuInternet: FIREFOX.EXE - P:\Mozilla Firefox\firefox.exe
==================== Services (Whitelisted) =================
R2 avast! Antivirus; P:\AVAST Software\Avast\AvastSvc.exe [50344 2014-04-23] (AVAST Software)
R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [103808 2008-01-22] ()
R2 lmhosts; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 MBAMScheduler; P:\Malwarebytes\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; P:\Malwarebytes\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
S3 Microsoft SharePoint Workspace Audit Service; P:\Microsoft Office\Office14\GROOVE.EXE [30814400 2013-12-19] (Microsoft Corporation)
S3 MWLService; C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [305520 2010-02-01] (Egis Technology Inc.)
R2 NlaSvc; C:\Windows\System32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 nsi; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 SbieSvc; P:\Sandboxie\SbieSvc.exe [174088 2014-05-29] (Sandboxie Holdings, LLC)
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1326176 2012-07-25] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [681056 2012-07-25] (Secunia)
R2 USBS3S4Detection; C:\OEM\USBDECTION\USBS3S4Detection.exe [76320 2009-12-09] ()
==================== Drivers (Whitelisted) ====================
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-04-23] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-04-23] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-04-23] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-04-23] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-05-15] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-05-15] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [85328 2014-05-15] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208416 2014-04-23] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-06-12] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)
R3 SbieDrv; P:\Sandboxie\SbieDrv.sys [185352 2014-05-29] (Sandboxie Holdings, LLC)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-06-12 19:15 - 2014-06-12 19:15 - 00000000 ____D () C:\FRST
2014-06-12 18:56 - 2014-06-12 18:57 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-12 18:56 - 2014-06-12 18:56 - 00000557 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-12 18:56 - 2014-06-12 18:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-06-12 18:56 - 2014-06-12 18:56 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-12 18:56 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-06-12 18:56 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-06-12 18:56 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-06-12 07:40 - 2014-04-25 04:34 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2014-06-12 07:40 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll
2014-06-12 07:40 - 2014-04-05 04:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-06-12 07:40 - 2014-04-05 04:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2014-06-12 07:40 - 2014-03-26 16:44 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-06-12 07:40 - 2014-03-26 16:44 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-06-12 07:40 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2014-06-12 07:40 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-06-12 07:40 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2014-06-12 07:40 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-06-12 07:40 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2014-06-12 07:40 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-06-11 22:26 - 2014-06-08 11:13 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-06-11 22:26 - 2014-06-08 11:08 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-06-11 22:26 - 2014-05-08 11:32 - 03178496 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-06-11 22:26 - 2014-05-08 11:32 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2014-06-02 19:30 - 2014-06-02 19:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sandboxie
2014-05-30 19:36 - 2014-05-30 19:38 - 00000000 ____D () C:\hjt
2014-05-30 18:48 - 2014-05-30 18:48 - 00002309 _____ () C:\Users\Public\Desktop\T-Online 6.0.lnk
2014-05-30 18:36 - 2014-05-30 18:36 - 00000000 ____D () C:\Users\XXXXXX\AppData\Local\Apps\2.0
2014-05-29 19:42 - 2014-05-29 20:18 - 235496584 _____ (T-Online) C:\Users\XXXXXX\Downloads\software_6_setup.exe
2014-05-24 10:39 - 2014-05-24 10:38 - 00000541 _____ () C:\Users\XXXXXX\Downloads\tosw60.htm
2014-05-19 20:58 - 2014-05-19 20:58 - 05601616 _____ (Microsoft Corporation) C:\Windows\system32\mfc100u.dll
2014-05-15 19:21 - 2014-03-25 04:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-05-15 19:21 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-05-15 17:08 - 2014-05-06 02:46 - 17847808 _____ () C:\Windows\system32\mshtml.dll
2014-05-15 17:08 - 2014-05-06 02:21 - 02382848 _____ () C:\Windows\system32\mshtml.tlb
2014-05-15 17:08 - 2014-05-06 01:32 - 12347392 _____ () C:\Windows\SysWOW64\mshtml.dll
2014-05-15 17:08 - 2014-05-06 01:14 - 02382848 _____ () C:\Windows\SysWOW64\mshtml.tlb
2014-05-15 17:08 - 2014-05-06 01:14 - 00073216 _____ () C:\Windows\SysWOW64\mshtmled.dll
2014-05-15 17:07 - 2014-05-06 02:21 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-15 17:06 - 2014-04-12 04:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-05-15 17:06 - 2014-04-12 04:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2014-05-15 17:06 - 2014-04-12 04:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-05-15 17:06 - 2014-04-12 04:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2014-05-15 17:06 - 2014-04-12 04:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2014-05-15 17:06 - 2014-04-12 04:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2014-05-15 17:06 - 2014-04-12 04:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2014-05-15 17:06 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-05-15 17:06 - 2014-04-12 04:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-05-15 17:06 - 2014-03-04 11:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-05-15 17:06 - 2014-03-04 11:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-05-15 17:06 - 2014-03-04 11:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll
2014-05-15 17:06 - 2014-03-04 11:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-05-15 17:06 - 2014-03-04 11:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-05-15 17:06 - 2014-03-04 11:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-05-15 17:06 - 2014-03-04 11:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-05-15 17:06 - 2014-03-04 11:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-05-15 17:06 - 2014-03-04 11:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll
2014-05-15 17:06 - 2014-03-04 11:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-05-15 17:06 - 2014-03-04 11:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll
2014-05-15 17:06 - 2014-03-04 11:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll
2014-05-15 17:06 - 2014-03-04 11:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll
2014-05-15 17:06 - 2014-03-04 11:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll
2014-05-15 17:06 - 2014-03-04 11:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2014-05-15 17:06 - 2014-03-04 11:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-05-15 17:06 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2014-05-15 17:06 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2014-05-15 17:06 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-05-15 17:06 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll
2014-05-15 17:06 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-05-15 17:06 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-05-15 17:06 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-05-15 17:06 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-05-15 17:06 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll
2014-05-15 17:06 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll
2014-05-15 17:06 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll
2014-05-15 17:06 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll
2014-05-15 17:06 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll
2014-05-15 17:06 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll
2014-05-15 17:06 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-05-15 17:06 - 2014-03-04 11:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
==================== One Month Modified Files and Folders =======
2014-06-12 19:16 - 2012-09-13 21:04 - 00000000 ____D () C:\Users\XXXXXX\AppData\Local\Temp
2014-06-12 19:15 - 2014-06-12 19:15 - 00000000 ____D () C:\FRST
2014-06-12 18:57 - 2014-06-12 18:56 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-12 18:56 - 2014-06-12 18:56 - 00000557 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-12 18:56 - 2014-06-12 18:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-06-12 18:56 - 2014-06-12 18:56 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-12 18:55 - 2012-09-15 10:11 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-06-12 18:50 - 2009-07-14 06:45 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-12 18:50 - 2009-07-14 06:45 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-12 18:49 - 2012-09-14 05:57 - 00699432 _____ () C:\Windows\system32\perfh007.dat
2014-06-12 18:49 - 2012-09-14 05:57 - 00149572 _____ () C:\Windows\system32\perfc007.dat
2014-06-12 18:49 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-12 18:47 - 2012-09-13 20:11 - 01600502 _____ () C:\Windows\WindowsUpdate.log
2014-06-12 18:43 - 2012-11-24 20:25 - 00001114 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-12 18:43 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-12 18:43 - 2009-07-14 06:51 - 00235339 _____ () C:\Windows\setupact.log
2014-06-12 16:33 - 2012-09-15 16:47 - 00000000 ____D () C:\Users\XXXXXXX\AppData\Local\Temp
2014-06-12 16:26 - 2012-11-24 20:25 - 00001118 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-11 22:37 - 2013-07-11 23:01 - 00000000 ____D () C:\Windows\system32\MRT
2014-06-11 22:35 - 2014-04-23 10:56 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-06-11 22:35 - 2012-09-17 19:50 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-06-11 22:35 - 2012-09-14 18:57 - 95414520 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-06-09 17:46 - 2012-09-17 11:03 - 00000000 ____D () C:\Users\XXXXXX\AppData\Local\Temp
2014-06-08 19:59 - 2013-03-20 20:21 - 00000000 ____D () C:\Users\XXXXXX\AppData\Roaming\vlc
2014-06-08 19:53 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-06-08 11:40 - 2012-10-08 19:29 - 00000000 ____D () C:\ProgramData\CanonIJPLM
2014-06-08 11:13 - 2014-06-11 22:26 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-06-08 11:08 - 2014-06-11 22:26 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-06-06 14:56 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-06-02 20:47 - 2012-09-13 20:06 - 00270176 _____ () C:\Windows\PFRO.log
2014-06-02 19:30 - 2014-06-02 19:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sandboxie
2014-06-02 19:29 - 2013-02-06 21:26 - 00000605 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
2014-06-02 19:27 - 2013-05-17 20:19 - 00001654 _____ () C:\Windows\Sandboxie.ini
2014-05-30 19:38 - 2014-05-30 19:36 - 00000000 ____D () C:\hjt
2014-05-30 18:49 - 2012-09-15 16:40 - 00009043 _____ () C:\Windows\SysWOW64\NULL
2014-05-30 18:48 - 2014-05-30 18:48 - 00002309 _____ () C:\Users\Public\Desktop\T-Online 6.0.lnk
2014-05-30 18:48 - 2012-09-15 16:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\T-Online
2014-05-30 18:48 - 2010-05-12 14:01 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-05-30 18:47 - 2012-09-15 16:30 - 00000000 ____D () C:\Program Files (x86)\T-Online
2014-05-30 18:36 - 2014-05-30 18:36 - 00000000 ____D () C:\Users\XXXXXX\AppData\Local\Apps\2.0
2014-05-29 20:18 - 2014-05-29 19:42 - 235496584 _____ (T-Online) C:\Users\XXXXXX\Downloads\software_6_setup.exe
2014-05-24 10:38 - 2014-05-24 10:39 - 00000541 _____ () C:\Users\XXXXXX\Downloads\tosw60.htm
2014-05-21 18:37 - 2013-04-12 21:31 - 00000614 _____ () C:\Users\Public\Desktop\VLC media player.lnk
2014-05-19 20:58 - 2014-05-19 20:58 - 05601616 _____ (Microsoft Corporation) C:\Windows\system32\mfc100u.dll
2014-05-16 18:55 - 2012-09-13 21:05 - 00000000 ___RD () C:\Users\XXXXXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-16 18:55 - 2012-09-13 21:05 - 00000000 ___RD () C:\Users\XXXXXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-16 13:50 - 2012-10-08 20:45 - 00000000 ____D () C:\ProgramData\CanonIJ
2014-05-15 21:09 - 2012-09-15 16:47 - 00000000 ___RD () C:\Users\XXXXXXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-15 21:09 - 2012-09-15 16:47 - 00000000 ___RD () C:\Users\XXXXXXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-15 19:50 - 2012-09-17 11:03 - 00000000 ___RD () C:\Users\XXXXXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-15 19:50 - 2012-09-17 11:03 - 00000000 ___RD () C:\Users\XXXXXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-15 13:37 - 2013-12-18 20:16 - 00085328 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2014-05-15 13:37 - 2012-09-14 20:09 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2014-05-15 13:37 - 2012-09-14 20:09 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
2014-05-13 19:57 - 2012-09-15 10:11 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-05-13 19:57 - 2012-09-14 21:29 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-13 18:59 - 2012-10-15 19:16 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
Some content of TEMP:
====================
C:\Users\XXXXXX\AppData\Local\Temp\MSETUP4.EXE
C:\Users\XXXXXX\AppData\Local\Temp\SandboxieInstall.exe
C:\Users\XXXXXX\AppData\Local\Temp\vlc-2.1.3-win64.exe
C:\Users\XXXXXX\AppData\Local\Temp\vlc-2.1.4-win64.exe
C:\Users\XXXXXXX\AppData\Local\Temp\Ab320640.dll
C:\Users\XXXXXXX\AppData\Local\Temp\Ab320800.dll
C:\Users\XXXXXXX\AppData\Local\Temp\Ab321024.dll
C:\Users\XXXXXXX\AppData\Local\Temp\Ab321280.dll
C:\Users\XXXXXXX\AppData\Local\Temp\Br320640.dll
C:\Users\XXXXXXX\AppData\Local\Temp\Br320800.dll
C:\Users\XXXXXXX\AppData\Local\Temp\Br321024.dll
C:\Users\XXXXXXX\AppData\Local\Temp\Br321280.dll
C:\Users\XXXXXXX\AppData\Local\Temp\Bs320640.dll
C:\Users\XXXXXXX\AppData\Local\Temp\Bs320800.dll
C:\Users\XXXXXXX\AppData\Local\Temp\Bs321024.dll
C:\Users\XXXXXXX\AppData\Local\Temp\Bs321280.dll
C:\Users\XXXXXXX\AppData\Local\Temp\NetCmnRs.dll
C:\Users\XXXXXXX\AppData\Local\Temp\NetSchk.exe
C:\Users\XXXXXXX\AppData\Local\Temp\Nschkk.dll
C:\Users\XXXXXXX\AppData\Local\Temp\Nschkm.dll
C:\Users\XXXXXXX\AppData\Local\Temp\Nschkw.dll
C:\Users\XXXXXXX\AppData\Local\Temp\setup.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 12-06-2014 02
Ran by XXXXXX at 2014-06-12 19:16:25
Running from D:\Eigene Dateien\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
==================== Installed Programs ======================
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Acer eRecovery Management (HKLM-x32\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 4.05.3007 - Acer Incorporated)
Acer Registration (HKLM-x32\...\Acer Registration) (Version: 1.02.3006 - Acer Incorporated)
Acer ScreenSaver (HKLM-x32\...\Acer Screensaver) (Version: 1.1.0318.2010 - Acer Incorporated)
Acer Updater (HKLM-x32\...\{EE171732-BEB4-4576-887D-CB62727F01CA}) (Version: 1.02.3001 - Acer Incorporated)
Active@ ISO Burner (HKCU\...\{7694E0B1-2332-448B-9235-929F84B41E3F}) (Version: 2.5.1 - LSoft Technologies)
Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.07) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)
AMD DnD V1.0.19 (x32 Version: 1.0.19 - AMD) Hidden
ATI AVIVO64 Codecs (Version: 10.12.0.00113 - ATI Technologies Inc.) Hidden
ATI Catalyst Install Manager (HKLM\...\{C42B7876-FA88-4F4A-9A5F-E175AD143F2A}) (Version: 3.0.762.0 - ATI Technologies, Inc.)
avast! Free Antivirus (HKLM-x32\...\avast) (Version: 9.0.2018 - Avast Software)
Canon MP Navigator EX 2.0 (HKLM-x32\...\MP Navigator EX 2.0) (Version: - )
Canon MP540 series Benutzerregistrierung (HKLM-x32\...\Canon MP540 series Benutzerregistrierung) (Version: - )
Canon MP540 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP540_series) (Version: - )
Canon Utilities Easy-PhotoPrint EX (HKLM-x32\...\Easy-PhotoPrint EX) (Version: - )
Canon Utilities My Printer (HKLM-x32\...\CanonMyPrinter) (Version: - )
Canon Utilities Solution Menu (HKLM-x32\...\CanonSolutionMenu) (Version: - )
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - ATI) Hidden
Catalyst Control Center Core Implementation (x32 Version: 2010.0113.2208.39662 - ATI) Hidden
Catalyst Control Center Graphics Full Existing (x32 Version: 2010.0113.2208.39662 - ATI) Hidden
Catalyst Control Center Graphics Full New (x32 Version: 2010.0113.2208.39662 - ATI) Hidden
Catalyst Control Center Graphics Light (x32 Version: 2010.0113.2208.39662 - ATI) Hidden
Catalyst Control Center Graphics Previews Vista (x32 Version: 2010.0113.2208.39662 - ATI) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2010.0113.2208.39662 - ATI Technologies, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2010.0113.2208.39662 - ATI) Hidden
CCC Help Chinese Standard (x32 Version: 2010.0113.2207.39662 - ATI) Hidden
CCC Help Chinese Traditional (x32 Version: 2010.0113.2207.39662 - ATI) Hidden
CCC Help Czech (x32 Version: 2010.0113.2207.39662 - ATI) Hidden
CCC Help Danish (x32 Version: 2010.0113.2207.39662 - ATI) Hidden
CCC Help Dutch (x32 Version: 2010.0113.2207.39662 - ATI) Hidden
CCC Help English (x32 Version: 2010.0113.2207.39662 - ATI) Hidden
CCC Help Finnish (x32 Version: 2010.0113.2207.39662 - ATI) Hidden
CCC Help French (x32 Version: 2010.0113.2207.39662 - ATI) Hidden
CCC Help German (x32 Version: 2010.0113.2207.39662 - ATI) Hidden
CCC Help Greek (x32 Version: 2010.0113.2207.39662 - ATI) Hidden
CCC Help Hungarian (x32 Version: 2010.0113.2207.39662 - ATI) Hidden
CCC Help Italian (x32 Version: 2010.0113.2207.39662 - ATI) Hidden
CCC Help Japanese (x32 Version: 2010.0113.2207.39662 - ATI) Hidden
CCC Help Korean (x32 Version: 2010.0113.2207.39662 - ATI) Hidden
CCC Help Norwegian (x32 Version: 2010.0113.2207.39662 - ATI) Hidden
CCC Help Polish (x32 Version: 2010.0113.2207.39662 - ATI) Hidden
CCC Help Portuguese (x32 Version: 2010.0113.2207.39662 - ATI) Hidden
CCC Help Russian (x32 Version: 2010.0113.2207.39662 - ATI) Hidden
CCC Help Spanish (x32 Version: 2010.0113.2207.39662 - ATI) Hidden
CCC Help Swedish (x32 Version: 2010.0113.2207.39662 - ATI) Hidden
CCC Help Thai (x32 Version: 2010.0113.2207.39662 - ATI) Hidden
CCC Help Turkish (x32 Version: 2010.0113.2207.39662 - ATI) Hidden
ccc-core-static (x32 Version: 2010.0113.2208.39662 - Ihr Firmenname) Hidden
ccc-utility64 (Version: 2010.0113.2208.39662 - ATI) Hidden
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.4.4852 - CDBurnerXP)
Citrix Online Plug-in - Web (HKCU\...\CitrixOnlinePluginPackWeb) (Version: 11.2.0.31560 - Citrix Systems, Inc.)
Citrix Online Plug-in (DV) (x32 Version: 11.2.0.31560 - Citrix Systems, Inc.) Hidden
Citrix Online Plug-in (HDX) (x32 Version: 11.2.0.31560 - Citrix Systems, Inc.) Hidden
Citrix Online Plug-in (Web) (x32 Version: 11.2.0.31560 - Citrix Systems, Inc.) Hidden
Das Fussball Studio 8.5.1 (HKLM-x32\...\{F804CEB4-747E-46D5-B8AB-C56E3BAF27D9}_is1) (Version: 8.5.1 - vmLOGIC - Volker Mallmann)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{CA75CBF9-B078-47CB-ABA3-74EFD4FC9A43}) (Version: - Microsoft)
DHTML Editing Component (HKLM-x32\...\{2EA870FA-585F-4187-903D-CB9FFD21E2E0}) (Version: 6.02.0001 - Microsoft Corporation)
Entity Framework Designer für Visual Studio 2012 - DEU (HKLM-x32\...\{4705DBFD-9D5E-4D23-817C-8CA7359B7BDE}) (Version: 11.1.20810.00 - Microsoft Corporation)
Erforderliche Komponenten für SSDT (HKLM-x32\...\{70D065C3-77E5-45E9-A75C-EEB2E84EA869}) (Version: 11.0.2100.60 - Microsoft Corporation)
femm 4.2 11Apr2012 (HKLM-x32\...\FEMM_is1) (Version: - )
FileHippo.com Update Checker (HKLM-x32\...\FileHippo.com) (Version: - )
Free Video to MP3 Converter version 5.0.21.1212 (HKLM-x32\...\Free Video to MP3 Converter_is1) (Version: 5.0.21.1212 - DVDVideoSoft Ltd.)
Google Earth Plug-in (HKLM-x32\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.24.7 - Google Inc.) Hidden
HxD Hex Editor Version 1.7.7.0 (HKLM-x32\...\HxD Hex Editor_is1) (Version: 1.7.7.0 - Maël Hörz)
Identity Card (HKLM-x32\...\Identity Card) (Version: 1.00.3003 - Acer Incorporated)
ImagXpress (x32 Version: 7.0.74.0 - Nero AG) Hidden
Inkjet Printer/Scanner Extended Survey Program (HKLM-x32\...\CANONIJPLM100) (Version: - )
JDownloader 0.9 (HKLM-x32\...\5513-1208-7298-9440) (Version: 0.9 - AppWork GmbH)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft .NET Framework 4 Multi-Targeting Pack (x32 Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5 Multi-Targeting Pack (HKLM-x32\...\{5CBFF3F3-2D40-34EE-BCA5-A95BC19E400D}) (Version: 4.5.50709 - Microsoft Corporation)
Microsoft .NET Framework 4.5 SDK - DEU Lang Pack (HKLM-x32\...\{98B45D1C-6EB1-460D-A87D-2B60678DC105}) (Version: 4.5.50709 - Microsoft Corporation)
Microsoft .NET Framework 4.5 SDK (HKLM-x32\...\{1948E039-EC79-4591-951D-9867A8C14C90}) (Version: 4.5.50709 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Age of Empires II (HKLM-x32\...\Age of Empires 2.0) (Version: - )
Microsoft Help Viewer 2.0 (HKLM-x32\...\Microsoft Help Viewer 2.0) (Version: 2.0.50727 - Microsoft Corporation)
Microsoft Help Viewer 2.0 (x32 Version: 2.0.50727 - Microsoft Corporation) Hidden
Microsoft Help Viewer 2.0 Language Pack - DEU (HKLM-x32\...\Microsoft Help Viewer 2.0 Language Pack - DEU) (Version: 2.0.50727 - Microsoft Corporation)
Microsoft Help Viewer 2.0 Language Pack - DEU (x32 Version: 2.0.50727 - Microsoft Corporation) Hidden
Microsoft NuGet - Visual Studio Express 2012 for Windows Desktop (x32 Version: 2.0.30717.9005 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft SQL Server 2012 Command Line Utilities (HKLM\...\{AD49BD4B-6CEE-4EA2-B53E-8EB0606F1B11}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2012 Data-Tier App Framework (HKLM\...\{36E619BC-A234-4EC3-849B-779A7C865A45}) (Version: 11.0.2316.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Data-Tier App Framework (HKLM-x32\...\{FBA6F90E-36EC-4FC9-9B25-3834E3BD46A8}) (Version: 11.0.2316.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Express LocalDB (HKLM\...\{EF18EF0F-96D3-4A6B-9600-2197F1720A15}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2012 Management Objects (HKLM-x32\...\{6B7B7E62-9F56-4C87-8664-0E20F2CAB03B}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2012 Management Objects (x64) (HKLM\...\{D4DA7C91-A59F-4C72-BAC4-DF7C76AB1CB8}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2012 Native Client (HKLM\...\{8E4BA1E5-54E8-41F0-919B-CD875B83CFCE}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2012 Transact-SQL Compiler Service (HKLM\...\{55FABD1D-8BE6-4A1A-958D-52B15F1DFEF0}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2012 Transact-SQL ScriptDom (HKLM\...\{13C9CD03-A5FE-4F50-AC8A-17B77C38CC52}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2012 T-SQL Language Service (HKLM-x32\...\{28C7A4BB-3966-4373-8376-C11F38290630}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server Compact 4.0 SP1 x64 DEU (HKLM\...\{98225B15-ECF5-4645-B5AC-F8C5E869A5D5}) (Version: 4.0.8876.1 - Microsoft Corporation)
Microsoft SQL Server Data Tools - DEU (11.1.20828.01) (HKLM-x32\...\{E511AE89-54BB-481D-BC4A-1B1F1E1B7693}) (Version: 11.1.20828.01 - Microsoft Corporation)
Microsoft SQL Server Data Tools Build Utilities - DEU (11.1.20828.01) (HKLM-x32\...\{00C84D22-DB8F-4159-BF70-682B8EA56A1E}) (Version: 11.1.20828.01 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 32bit Compilers - DEU Resources (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 Core Libraries (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Debug Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Debug Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86-x64 Compilers (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual Studio 2012 Express Prerequisites x64 - DEU (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual Studio 2012 Shell (Minimum) (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual Studio 2012 Shell (Minimum) Interop Assemblies (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual Studio 2012 Shell-(Mindest)-Ressourcen (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual Studio 2012 Tools für SQL Server Compact 4.0 SP1 DEU (x32 Version: 4.0.8876.1 - Microsoft Corporation) Hidden
Microsoft Visual Studio 2012-Vorbereitung (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual Studio Express 2012 for Windows Desktop (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual Studio Express 2012 für Windows Desktop - DEU (HKLM-x32\...\{69ec32be-d994-44de-9eae-6d86ced6f352}) (Version: 11.0.50727.42 - Microsoft Corporation)
Microsoft Visual Studio Express 2012 für Windows Desktop - DEU (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual Studio Team Foundation Server 2012 Object Model (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual Studio Team Foundation Server 2012 Object Model Language Pack - DEU (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual Studio Team Foundation Server 2012 Team Explorer (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual Studio Team Foundation Server 2012 Team Explorer Language Pack - DEU (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual Studio Ultimate 2012 XAML UI Designer Core (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual Studio Ultimate 2012 XAML UI Designer deu Resources (x32 Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft-System-CLR-Typen für SQL Server 2012 (HKLM-x32\...\{4C0B27C3-3E8F-4BD2-80FF-6E9E48EBD6D8}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft-System-CLR-Typen für SQL Server 2012 (x64) (HKLM\...\{64A5D39C-95CD-4B8B-B2FA-6C713133B57F}) (Version: 11.0.2100.60 - Microsoft Corporation)
Mozilla Firefox 26.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 26.0 (x86 de)) (Version: 26.0 - Mozilla)
Mozilla Firefox 30.0 (x86 de) (HKCU\...\Mozilla Firefox 30.0 (x86 de)) (Version: 30.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 26.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2721691) (HKLM-x32\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MyWinLocker (x32 Version: 3.1.206.0 - Egis Technology Inc.) Hidden
MyWinLocker Suite (HKLM-x32\...\InstallShield_{738BF5C3-AF7B-4BB0-B7EF-E505EFC756BE}) (Version: 3.1.206.0 - Egis Technology Inc.)
MyWinLocker Suite (x32 Version: 3.1.206.0 - Egis Technology Inc.) Hidden
neroxml (x32 Version: 1.0.0 - Nero AG) Hidden
Panda USB Vaccine 1.0.1.4 (HKLM-x32\...\{55A41219-9B22-4098-BAE7-AE289B3C569A}_is1) (Version: - Panda Security)
Python 3.3 cx_Freeze-4.3.1 (HKLM\...\{90D3751C-04D1-4AA7-A701-85A79EB4C1E4}) (Version: 4.3.1 - Anthony Tuininga)
Python 3.3 matplotlib-1.2.0 (HKCU\...\matplotlib-py3.3) (Version: - )
Python 3.3 numpy-1.7.0 (64-bit) (HKCU\...\numpy-py3.3) (Version: - )
Python 3.3 scipy-0.12.0 (64-bit) (HKCU\...\scipy-py3.3) (Version: - )
Python 3.3.0 (64-bit) (HKLM\...\{290329C4-A276-3AEC-B633-9F5A39D8DD96}) (Version: 3.3.150 - Python Software Foundation)
Realtek Ethernet Controller Driver For Windows 7 (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.17.304.2010 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5995 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver (HKLM-x32\...\{46710AEB-ACE9-4386-9DFB-8B65153BFA74}) (Version: 1.01.0094 - REALTEK Semiconductor Corp.)
Sandboxie 4.12 (64-bit) (HKLM\...\Sandboxie) (Version: 4.12 - Sandboxie Holdings, LLC)
Secunia PSI (3.0.0.3001) (HKLM-x32\...\Secunia PSI) (Version: 3.0.0.3001 - Secunia)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version: - Microsoft) Hidden
Shredder (Version: 2.0.5.0 - Egis Technology Inc.) Hidden
Shredder (x32 Version: 2.0.5.0 - Egis Technology Inc.) Hidden
Sweet Home 3D version 4.3 (HKLM\...\Sweet Home 3D_is1) (Version: - eTeks)
Tomb Raider III (HKLM-x32\...\Tomb Raider III) (Version: - )
T-Online 6.0 (HKLM-x32\...\{B1275E23-717A-4D52-997A-1AD1E24BC7F3}) (Version: - )
T-Online WLAN-Access Finder (HKLM-x32\...\{295C31E5-3F91-498E-9623-DA24D2FA2B6A}) (Version: - )
Update for (KB2504637) (HKLM-x32\...\{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}.KB2504637) (Version: 1 - Microsoft Corporation)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{B4A38370-2ADB-46B0-A1B0-0C4A2F7DCA31}) (Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{302A8FE3-EBF5-486C-A431-16A1CD914443}) (Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{302A8FE3-EBF5-486C-A431-16A1CD914443}) (Version: - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{4EEA3D3E-989C-4DF4-AB0A-3042C0C12AA3}) (Version: - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817396) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{39767ECA-1731-45DB-AB5B-6BF40E151D66}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DADF7E25-FFA4-4D02-BE84-1DAE62C18516}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{287A1E92-9E41-4BC1-8920-B3D0E9220800}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{9D69691D-823D-4C3E-9B12-563A3F520366}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{35698CB7-AAA2-4577-B505-DBFF504AEF23}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{5AA578BB-759C-40FD-9661-A737C0884541}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2825635) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{F1A20C69-9FE5-40FD-9CD5-84EABC2EF64A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2825640) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{BA610006-2C39-4419-9834-CF61AB24810A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{C70D2038-A2C4-4A99-87DE-5272BB44F0CE}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{82F87E28-B18E-46D6-A399-E2F19CF5949B}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2878225) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{EFF5EBA3-40AD-4859-85E7-3C1CF4F297EB}) (Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version: - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-001A-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{A0657506-69DC-44AE-8DC1-58E7C6F5B1C9}) (Version: - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{2AB483F1-C86E-427A-83B4-23889B03512D}) (Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{90140000-0018-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{40EC8FB1-5202-469D-9232-C28FB1C6FC64}) (Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{2BA40F82-F3A4-441C-BF1A-ED4C42FF4872}) (Version: - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version: - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version: - Microsoft)
Update for Microsoft Visio 2010 (KB2880526) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{7B29D8B8-6A87-496C-A65E-B935E740448A}) (Version: - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2837587) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{38CF30E4-3348-4BD1-A859-B630C355A56F}) (Version: - Microsoft)
Update for Microsoft Visual Studio 2012 (KB2781514) (HKLM-x32\...\{56ef8912-352f-4fab-9c73-6f1c92a7127f}) (Version: 11.0.51219 - Microsoft Corporation)
Update for Microsoft Word 2010 (KB2880529) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{B9B89E01-5B6B-4F73-BC34-B2C0D8ACB4CD}) (Version: - Microsoft)
VirtualCloneDrive (HKLM-x32\...\VirtualCloneDrive) (Version: - Elaborate Bytes)
VLC media player 2.1.4 (HKLM\...\VLC media player) (Version: 2.1.4 - VideoLAN)
Welcome Center (HKLM-x32\...\Acer Welcome Center) (Version: 1.00.3013 - Acer Incorporated)
Windows Live Sync (HKLM-x32\...\{76618402-179D-4699-A66B-D351C59436BC}) (Version: 14.0.8089.726 - Microsoft Corporation)
Windows Live-Uploadtool (HKLM-x32\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
Windows Software Development Kit (x32 Version: 8.59.25584 - Microsoft Corporation) Hidden
Windows Software Development Kit DirectX x64 Remote (Version: 8.59.25584 - Microsoft Corporation) Hidden
Windows Software Development Kit DirectX x86 Remote (x32 Version: 8.59.25584 - Microsoft Corporation) Hidden
Windows Software Development Kit for Windows Store Apps (x32 Version: 8.59.25584 - Microsoft Corporation) Hidden
Windows Software Development Kit for Windows Store Apps DirectX x64 Remote (Version: 8.59.25584 - Microsoft Corporation) Hidden
Windows Software Development Kit for Windows Store Apps DirectX x86 Remote (x32 Version: 8.59.25584 - Microsoft Corporation) Hidden
WinLems 1.24 (HKLM-x32\...\WinLems_is1) (Version: - Wildfire Software Design)
WinRAR 5.01 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)
==================== Restore Points =========================
Could not list Restore Points. Check "winmgmt" service or repair WMI.
==================== Hosts content: ==========================
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => ?
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => ?
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => ?
==================== Loaded Modules (whitelisted) =============
2013-09-05 01:17 - 2013-09-05 01:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2009-08-14 10:55 - 2009-08-14 10:55 - 00016384 ____R () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2012-09-13 20:10 - 2012-09-13 20:10 - 00270336 _____ () C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2013-10-16 19:20 - 2013-10-16 19:20 - 19336120 _____ () P:\AVAST Software\Avast\libcef.dll
2014-06-10 19:40 - 2014-06-10 19:40 - 03852912 _____ () P:\Mozilla Firefox\mozjs.dll
2013-09-05 01:14 - 2013-09-05 01:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\Users\XXXXXX\Downloads\Buchungsbestätigung.eml:OECustomProperty
==================== Safe Mode (whitelisted) ===================
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"
==================== EXE Association (whitelisted) =============
==================== MSCONFIG/TASK MANAGER disabled items =========
MSCONFIG\startupreg: EgisTecPMMUpdate => "C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe"
MSCONFIG\startupreg: EgisUpdate => "C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe" -d
MSCONFIG\startupreg: mwlDaemon => C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe
MSCONFIG\startupreg: SuiteTray => "C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe"
MSCONFIG\startupreg: VirtualCloneDrive => "P:\VirtualCloneDrive\VCDDaemon.exe" /s
==================== Faulty Device Manager Devices =============
Name: Microsoft PS/2-Maus
Description: Microsoft PS/2-Maus
Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
==================== Event log errors: =========================
Application errors:
==================
Error: (06/12/2014 07:06:51 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: winrar-x64-510.exe, Version: 0.0.0.0, Zeitstempel: 0x53973c3b
Name des fehlerhaften Moduls: winrar-x64-510.exe, Version: 0.0.0.0, Zeitstempel: 0x53973c3b
Ausnahmecode: 0xc000041d
Fehleroffset: 0x000000000001e67a
ID des fehlerhaften Prozesses: 0x119c
Startzeit der fehlerhaften Anwendung: 0xwinrar-x64-510.exe0
Pfad der fehlerhaften Anwendung: winrar-x64-510.exe1
Pfad des fehlerhaften Moduls: winrar-x64-510.exe2
Berichtskennung: winrar-x64-510.exe3
Error: (06/12/2014 07:05:43 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: winrar-x64-510.exe, Version: 0.0.0.0, Zeitstempel: 0x53973c3b
Name des fehlerhaften Moduls: winrar-x64-510.exe, Version: 0.0.0.0, Zeitstempel: 0x53973c3b
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000001e67a
ID des fehlerhaften Prozesses: 0x119c
Startzeit der fehlerhaften Anwendung: 0xwinrar-x64-510.exe0
Pfad der fehlerhaften Anwendung: winrar-x64-510.exe1
Pfad des fehlerhaften Moduls: winrar-x64-510.exe2
Berichtskennung: winrar-x64-510.exe3
Error: (06/12/2014 06:47:08 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: install_flashplayer14x32_mssd_aaa_aih.exe, Version: 3.5.4.25, Zeitstempel: 0x537d2fbd
Name des fehlerhaften Moduls: install_flashplayer14x32_mssd_aaa_aih.exe, Version: 3.5.4.25, Zeitstempel: 0x537d2fbd
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00045487
ID des fehlerhaften Prozesses: 0xfd0
Startzeit der fehlerhaften Anwendung: 0xinstall_flashplayer14x32_mssd_aaa_aih.exe0
Pfad der fehlerhaften Anwendung: install_flashplayer14x32_mssd_aaa_aih.exe1
Pfad des fehlerhaften Moduls: install_flashplayer14x32_mssd_aaa_aih.exe2
Berichtskennung: install_flashplayer14x32_mssd_aaa_aih.exe3
Error: (06/08/2014 07:49:33 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (06/08/2014 07:48:24 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (06/01/2014 03:27:19 PM) (Source: RasClient) (EventID: 20227) (User: )
Description: CoID={A65AEF02-EE19-45D5-B257-A57A5234DBF5}: Der Benutzer "NoName\XXXXXXX" hat eine Verbindung mit dem Namen "T-Online 6.0" gewählt, die Verbindung konnte jedoch nicht hergestellt werden. Der durch den Fehler zurückgegebene Ursachencode lautet: 0.
Error: (06/01/2014 01:53:43 PM) (Source: RasClient) (EventID: 20227) (User: )
Description: CoID={2B27820B-37B3-4873-97F5-97AA08FD9A2D}: Der Benutzer "NoName\XXXXXXX" hat eine Verbindung mit dem Namen "Direktanwahl" gewählt, die Verbindung konnte jedoch nicht hergestellt werden. Der durch den Fehler zurückgegebene Ursachencode lautet: 651.
Error: (06/01/2014 01:30:06 PM) (Source: RasClient) (EventID: 20227) (User: )
Description: CoID={24C713D8-3471-4AE3-B3E7-D33F8CD326DF}: Der Benutzer "NoName\XXXXXXX" hat eine Verbindung mit dem Namen "T-Online 6.0" gewählt, die Verbindung konnte jedoch nicht hergestellt werden. Der durch den Fehler zurückgegebene Ursachencode lautet: 0.
Error: (06/01/2014 01:27:00 PM) (Source: RasClient) (EventID: 20227) (User: )
Description: CoID={F480F472-47BD-401E-90A0-8CE5F97FC9C6}: Der Benutzer "NoName\XXXXXXX" hat eine Verbindung mit dem Namen "Direktanwahl" gewählt, die Verbindung konnte jedoch nicht hergestellt werden. Der durch den Fehler zurückgegebene Ursachencode lautet: 0.
Error: (06/01/2014 01:13:56 PM) (Source: RasClient) (EventID: 20227) (User: )
Description: CoID={726B07B7-AE9D-4603-BCE4-4706F72B0C71}: Der Benutzer "NoName\XXXXXXX" hat eine Verbindung mit dem Namen "T-Online 6.0" gewählt, die Verbindung konnte jedoch nicht hergestellt werden. Der durch den Fehler zurückgegebene Ursachencode lautet: 0.
System errors:
=============
Error: (06/11/2014 10:35:56 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070308 fehlgeschlagen: Sicherheitsupdate für Windows 7 für x64-basierte Systeme (KB2957509)
Error: (06/11/2014 10:35:55 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070308 fehlgeschlagen: Sicherheitsupdate für Windows 7 für x64-basierte Systeme (KB2957189)
Error: (06/11/2014 10:35:55 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070308 fehlgeschlagen: Sicherheitsupdate für Windows 7 für x64-basierte Systeme (KB2939576)
Error: (06/11/2014 10:35:54 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070308 fehlgeschlagen: Update für Windows 7 für x64-basierte Systeme (KB2800095)
Error: (06/11/2014 10:25:47 PM) (Source: volsnap) (EventID: 36) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
Error: (06/10/2014 02:37:07 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk6\DR6 gefunden.
Error: (06/09/2014 11:00:40 PM) (Source: volsnap) (EventID: 36) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
Error: (06/08/2014 11:37:43 AM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk6\DR6 gefunden.
Error: (06/08/2014 11:37:42 AM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk6\DR6 gefunden.
Error: (06/08/2014 11:37:42 AM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk6\DR6 gefunden.
Microsoft Office Sessions:
=========================
Error: (06/12/2014 07:06:51 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: winrar-x64-510.exe0.0.0.053973c3bwinrar-x64-510.exe0.0.0.053973c3bc000041d000000000001e67a119c01cf865ef51116f8D:\Eigene Dateien\Downloads\winrar-x64-510.exeD:\Eigene Dateien\Downloads\winrar-x64-510.exef1b93b0e-f253-11e3-bd92-4487fc9fa8fa
Error: (06/12/2014 07:05:43 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: winrar-x64-510.exe0.0.0.053973c3bwinrar-x64-510.exe0.0.0.053973c3bc0000005000000000001e67a119c01cf865ef51116f8D:\Eigene Dateien\Downloads\winrar-x64-510.exeD:\Eigene Dateien\Downloads\winrar-x64-510.exec9286b9f-f253-11e3-bd92-4487fc9fa8fa
Error: (06/12/2014 06:47:08 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: install_flashplayer14x32_mssd_aaa_aih.exe3.5.4.25537d2fbdinstall_flashplayer14x32_mssd_aaa_aih.exe3.5.4.25537d2fbdc000000500045487fd001cf865de6e64074D:\Eigene Dateien\Downloads\install_flashplayer14x32_mssd_aaa_aih.exeD:\Eigene Dateien\Downloads\install_flashplayer14x32_mssd_aaa_aih.exe3087ca7f-f251-11e3-bd92-4487fc9fa8fa
Error: (06/08/2014 07:49:33 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestc:\Users\XXXXXX\downloads\SoftonicDownloader_fuer_turbo-floorplan-garten-und-landschaftsarchitekt(1).exe
Error: (06/08/2014 07:48:24 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestc:\Users\XXXXXX\downloads\SoftonicDownloader_fuer_turbo-floorplan-garten-und-landschaftsarchitekt(1).exe
Error: (06/01/2014 03:27:19 PM) (Source: RasClient) (EventID: 20227) (User: )
Description: {A65AEF02-EE19-45D5-B257-A57A5234DBF5}NoName\XXXXXXXT-Online 6.00
Error: (06/01/2014 01:53:43 PM) (Source: RasClient) (EventID: 20227) (User: )
Description: {2B27820B-37B3-4873-97F5-97AA08FD9A2D}NoName\XXXXXXXDirektanwahl651
Error: (06/01/2014 01:30:06 PM) (Source: RasClient) (EventID: 20227) (User: )
Description: {24C713D8-3471-4AE3-B3E7-D33F8CD326DF}NoName\XXXXXXXT-Online 6.00
Error: (06/01/2014 01:27:00 PM) (Source: RasClient) (EventID: 20227) (User: )
Description: {F480F472-47BD-401E-90A0-8CE5F97FC9C6}NoName\XXXXXXXDirektanwahl0
Error: (06/01/2014 01:13:56 PM) (Source: RasClient) (EventID: 20227) (User: )
Description: {726B07B7-AE9D-4603-BCE4-4706F72B0C71}NoName\XXXXXXXT-Online 6.00
==================== Memory info ===========================
Percentage of memory in use: 47%
Total physical RAM: 4087.07 MB
Available physical RAM: 2159.07 MB
Total Pagefile: 8172.33 MB
Available Pagefile: 5940.61 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB
==================== Drives ================================
Drive c: (Acer) (Fixed) (Total:58.44 GB) (Free:9.77 GB) NTFS
Drive d: (XXXXXX) (Fixed) (Total:78.73 GB) (Free:51.89 GB) NTFS
Drive k: (XXXXX) (Fixed) (Total:29.3 GB) (Free:29.17 GB) NTFS
Drive l: (Allgemein) (Fixed) (Total:39.06 GB) (Free:28.47 GB) NTFS
Drive m: (XXXXXX) (Fixed) (Total:73.24 GB) (Free:61.86 GB) NTFS
Drive n: (XXXXXXX) (Fixed) (Total:73.24 GB) (Free:44.43 GB) NTFS
Drive p: (Programme) (Fixed) (Total:97.66 GB) (Free:90.86 GB) NTFS
==================== MBR & Partition Table ==================
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-06-12 19:40:15
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST350041 rev.CC44 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\MASTER~1\AppData\Local\Temp\axldqpow.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff80003007000 34 bytes [FF, 15, 12, E1, 07, 00, FB, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 563 fffff80003007023 23 bytes [5C, C3, 90, 90, 90, 90, 90, ...]
---- User code sections - GMER 2.1 ----
.text C:\Windows\system32\wininit.exe[696] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007685ef8d 1 byte [62]
.text C:\Windows\system32\services.exe[756] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007685ef8d 1 byte [62]
.text C:\Windows\system32\winlogon.exe[796] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007685ef8d 1 byte [62]
.text C:\Windows\system32\atiesrxx.exe[548] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007685ef8d 1 byte [62]
.text C:\Windows\System32\svchost.exe[304] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007685ef8d 1 byte [62]
.text C:\Windows\system32\svchost.exe[1040] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007685ef8d 1 byte [62]
.text C:\Windows\system32\svchost.exe[1064] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007685ef8d 1 byte [62]
.text C:\Windows\system32\svchost.exe[1400] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007685ef8d 1 byte [62]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1940] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007669a2fd 1 byte [62]
.text C:\Program Files (x86)\Acer\Registration\GregHSRW.exe[1984] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007669a2fd 1 byte [62]
.text C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[2024] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007669a2fd 1 byte [62]
.text C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[2024] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000750c1465 2 bytes [0C, 75]
.text C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[2024] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000750c14bb 2 bytes [0C, 75]
.text ... * 2
.text C:\Program Files (x86)\Secunia\PSI\PSIA.exe[1576] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007669a2fd 1 byte [62]
.text C:\Program Files (x86)\Secunia\PSI\PSIA.exe[1576] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000750c1465 2 bytes [0C, 75]
.text C:\Program Files (x86)\Secunia\PSI\PSIA.exe[1576] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000750c14bb 2 bytes [0C, 75]
.text ... * 2
.text C:\Program Files\Acer\Acer Updater\UpdaterService.exe[2132] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007669a2fd 1 byte [62]
.text C:\OEM\USBDECTION\USBS3S4Detection.exe[2180] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007669a2fd 1 byte [62]
.text C:\Windows\Explorer.EXE[2888] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007685ef8d 1 byte [62]
.text C:\Windows\System32\rundll32.exe[2728] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007685ef8d 1 byte [62]
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3484] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007685ef8d 1 byte [62]
.text C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[3880] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007669a2fd 1 byte [62]
.text C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[3880] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000750c1465 2 bytes [0C, 75]
.text C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[3880] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000750c14bb 2 bytes [0C, 75]
.text ... * 2
.text P:\AVAST Software\Avast\AvastUI.exe[3972] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 0000000076678791 8 bytes [31, C0, C2, 04, 00, 90, 90, ...]
.text P:\AVAST Software\Avast\AvastUI.exe[3972] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007669a2fd 1 byte [62]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[3452] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007685ef8d 1 byte [62]
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[5016] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007669a2fd 1 byte [62]
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[5016] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000750c1465 2 bytes [0C, 75]
.text C:\Program Files (x86)\Secunia\PSI\sua.exe[5016] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000750c14bb 2 bytes [0C, 75]
.text ... * 2
.text D:\Eigene Dateien\Desktop\Gmer-19357.exe[4712] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007669a2fd 1 byte [62]
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{F6E2D336-A56E-4EC7-A8BE-2D780735643F}\Connection@Name LAN-Verbindung* 3
Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Bind \Device\{F6E2D336-A56E-4EC7-A8BE-2D780735643F}?\Device\{5582F295-C0AA-45AF-A8CD-5B11D63B57D4}?
Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Route "{F6E2D336-A56E-4EC7-A8BE-2D780735643F}"?"{5582F295-C0AA-45AF-A8CD-5B11D63B57D4}"?
Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Export \Device\TCPIP6TUNNEL_{F6E2D336-A56E-4EC7-A8BE-2D780735643F}?\Device\TCPIP6TUNNEL_{5582F295-C0AA-45AF-A8CD-5B11D63B57D4}?
Reg HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{C78D1C42-E818-4224-8A14-3525844825B9}@InterfaceName Reusable ISATAP Interface {C78D1C42-E818-4224-8A14-3525844825B9}
Reg HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{C78D1C42-E818-4224-8A14-3525844825B9}@ReusableType 1
Reg HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{F6E2D336-A56E-4EC7-A8BE-2D780735643F}@InterfaceName isatap.{F037E7A1-FD3B-4EFF-A644-019C59AA830E}
Reg HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{F6E2D336-A56E-4EC7-A8BE-2D780735643F}@ReusableType 0
Reg HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Epoch@Epoch 15566
Reg HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Epoch2@Epoch 12146
---- EOF - GMER 2.1 ----
|
|
12.06.2014, 19:55
| #2 |
| /// the machine /// TB-Ausbilder    | WIN7 PUP.Optional.... gefunden hi,
__________________unsere Tools brauchen immer Adminrechte! MBAM updaten, scannen, Funde löschen. Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ |
|
13.06.2014, 18:14
| #3 |
| | WIN7 PUP.Optional.... gefunden Danke für die schnelle Antwort!
__________________Hier sind die Logs: AdwCleaner: Code:
ATTFilter # AdwCleaner v3.212 - Bericht erstellt am 13/06/2014 um 18:33:40
# Aktualisiert 05/06/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : masteruser - NONAME
# Gestartet von : D:\Eigene Dateien\Desktop\adwcleaner_3.212.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\Partner
Ordner Gelöscht : C:\ProgramData\Tarma Installer
Ordner Gelöscht : C:\Program Files (x86)\Common Files\DVDVideoSoft\TB
Ordner Gelöscht : C:\Users\masteruser\AppData\Local\PackageAware
Ordner Gelöscht : C:\Users\masteruser\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\XXXXXXX\AppData\Local\iLivid
Datei Gelöscht : C:\Users\XXXXXXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\iLivid.lnk
Datei Gelöscht : C:\Users\XXXXXXX\AppData\Roaming\Mozilla\Firefox\Profiles\3i5vupjz.default\searchplugins\Search_Results.xml
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetup_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetup_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\YontooDesktop_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\YontooDesktop_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Schlüssel Gelöscht : HKCU\Software\InstallCore
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Tarma Installer
***** [ Browser ] *****
-\\ Internet Explorer v0.0.0.0
*************************
AdwCleaner[R0].txt - [2095 octets] - [13/06/2014 18:32:42]
AdwCleaner[S0].txt - [1960 octets] - [13/06/2014 18:33:40]
########## EOF - \AdwCleaner\AdwCleaner[S0].txt - [2020 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Home Premium x64
Ran by masteruser on 13.06.2014 at 18:51:37,92
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
~~~ Files
~~~ Folders
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 13.06.2014 at 18:59:38,05
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-06-2014 02
Ran by masteruser (administrator) on NONAME on 13-06-2014 19:07:24
Running from D:\Eigene Dateien\Desktop
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\System32\atiesrxx.exe
(Sandboxie Holdings, LLC) P:\Sandboxie\SbieSvc.exe
(AVAST Software) P:\AVAST Software\Avast\AvastSvc.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
() C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe
(Malwarebytes Corporation) P:\Malwarebytes\mbamscheduler.exe
(Malwarebytes Corporation) P:\Malwarebytes\mbamservice.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
() C:\OEM\USBDECTION\USBS3S4Detection.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(FileHippo.com) P:\FileHippo.com\UpdateChecker.exe
(Sandboxie Holdings, LLC) P:\Sandboxie\SbieCtrl.exe
(Citrix Systems, Inc.) C:\Users\XXXXXX\AppData\Local\Citrix\ICA Client\concentr.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
(Citrix Systems, Inc.) C:\Users\XXXXXX\AppData\Local\Citrix\ICA Client\wfcrun32.exe
(Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
(AVAST Software) P:\AVAST Software\Avast\AvastUI.exe
(Adobe Systems Incorporated) P:\Adobe\Reader 11.0\Reader\reader_sl.exe
(Malwarebytes Corporation) P:\Malwarebytes\mbam.exe
(Panda Security) P:\Panda USB Vaccine\USBVaccine.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [9642528 2010-02-24] (Realtek Semiconductor)
HKLM\...\Run: [CanonSolutionMenu] => C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe [689488 2008-03-10] (CANON INC.)
HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2114376 2008-03-17] (CANON INC.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-01-13] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [BCSSync] => P:\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AvastUI.exe] => P:\AVAST Software\Avast\AvastUI.exe [3873704 2014-04-23] (AVAST Software)
HKLM\...\Runonce: [MSPCLOCK] - rundll32.exe streamci,StreamingDeviceSetup {97ebaacc-95bd-11d0-a3ea-00a0c9223196},{53172480-4791-11D0-A5D6-28DB04C10000},{53172480-4791-11D0-A5D6-28DB04C10000}
HKLM\...\Runonce: [MSPQM] - rundll32.exe streamci,StreamingDeviceSetup {DDF4358E-BB2C-11D0-A42F-00A0C9223196},{97EBAACB-95BD-11D0-A3EA-00A0C9223196},{97EBAACB-95BD-11D0-A3EA-00A0C9223196}
HKLM\...\Runonce: [MSKSSRV] - rundll32.exe streamci,StreamingDeviceSetup {96E080C7-143C-11D1-B40F-00A0C9223196},{3C0D501A-140B-11D1-B40F-00A0C9223196},{3C0D501A-140B-11D1-B40F-00A0C9223196}
HKLM\...\Runonce: [MSTEE.CxTransform] - rundll32.exe streamci,StreamingDeviceSetup {cfd669f1-9bc2-11d0-8299-0000f822fe8a},{CF1DDA2C-9743-11D0-A3EE-00A0C9223196},{CF1DDA2C-9743-11D0-A3EE-00A0C9223196},C:\Windows\inf\ksfilter.inf,MSTEE.Interface.Install
HKLM\...\Runonce: [MSTEE.Splitter] - rundll32.exe streamci,StreamingDeviceSetup {cfd669f1-9bc2-11d0-8299-0000f822fe8a},{0A4252A0-7E70-11D0-A5D6-28DB04C10000},{0A4252A0-7E70-11D0-A5D6-28DB04C10000},C:\Windows\inf\ksfilter.inf,MSTEE.Interface.Install
HKLM\...\Runonce: [WDM_DRMKAUD] - rundll32.exe streamci,StreamingDeviceSetup {EEC12DB6-AD9C-4168-8658-B03DAEF417FE},{ABD61E00-9350-47e2-A632-4438B90C6641},{FFBB6E3F-CCFE-4D84-90D9-421418B03A8E},C:\Windows\inf\WDMAUDIO.inf,WDM_DRMKAUD.Interface.Install
HKLM-x32\...\Runonce: [aswAhAScr.dll] - "P:\AVAST Software\Avast\aswRegSvr.exe" "P:\AVAST Software\Avast\AhAScr.dll" [X]
HKLM-x32\...\Runonce: [aswasOutExt.dll] - "P:\AVAST Software\Avast\aswRegSvr.exe" "P:\AVAST Software\Avast\asOutExt.dll" [X]
HKLM-x32\...\Runonce: [aswasOutExt64.dll] - "P:\AVAST Software\Avast\aswRegSvr64.exe" "P:\AVAST Software\Avast\asOutExt64.dll" [X]
HKLM-x32\...\RunOnce: [20131224] - P:\AVAST Software\Avast\setup\emupdate\f06bc031-c9f4-41f6-8252-3193d03981b2.exe /check [181136 2014-04-29] (AVAST Software)
HKLM-x32\...\RunOnce: [20140526] - P:\AVAST Software\Avast\setup\emupdate\7ae5aa4f-81b5-437c-88c8-8d1d8f1b31a8.exe /check [182720 2014-05-27] (AVAST Software)
HKLM-x32\...\RunOnce: [20140529] - P:\AVAST Software\Avast\setup\emupdate\51d1a79d-f668-4a0f-aa07-81e6eec710a0.exe /check [183208 2014-05-30] (AVAST Software)
HKU\S-1-5-21-1692514539-1397013794-4007604138-1000\...\Run: [FileHippo.com] => P:\FileHippo.com\UpdateChecker.exe [307712 2012-11-23] (FileHippo.com)
HKU\S-1-5-21-1692514539-1397013794-4007604138-1001\...\Run: [FileHippo.com] => P:\FileHippo.com\UpdateChecker.exe [307712 2012-11-23] (FileHippo.com)
HKU\S-1-5-21-1692514539-1397013794-4007604138-1001\...\Run: [SandboxieControl] => P:\Sandboxie\SbieCtrl.exe [784392 2014-05-29] (Sandboxie Holdings, LLC)
HKU\S-1-5-21-1692514539-1397013794-4007604138-1001\...\Run: [ConnectionCenter] => C:\Users\XXXXXX\AppData\Local\Citrix\ICA Client\concentr.exe [103768 2009-09-12] (Citrix Systems, Inc.)
HKU\S-1-5-21-1692514539-1397013794-4007604138-1001\...\MountPoints2: {39536f8b-10ad-11e2-812e-4487fc9fa8fa} - Q:\LaunchU3.exe -a
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)
BootExecute: autocheck autochk * sdnclean64.exe
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m5910&r=17360912c106pe465v145w46m1u190
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m5910&r=17360912c106pe465v145w46m1u190
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m5910&r=17360912c106pe465v145w46m1u190
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m5910&r=17360912c106pe465v145w46m1u190
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - P:\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - P:\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - P:\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - P:\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
Handler: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll ()
Handler: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll ()
Handler: mailto - {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll ()
Handler: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll ()
Handler: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll ()
Handler-x32: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll ()
Handler-x32: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll ()
Handler-x32: mailto - {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll ()
Handler-x32: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll ()
Handler-x32: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll ()
FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.6 - P:\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.0.7 - P:\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.0 - P:\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.1 - P:\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.2 - P:\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 - P:\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.4 - P:\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - P:\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - P:\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - P:\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - P:\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - P:\AVAST Software\Avast\WebRep\FF [2012-09-14]
FF StartMenuInternet: FIREFOX.EXE - P:\Mozilla Firefox\firefox.exe
==================== Services (Whitelisted) =================
R2 avast! Antivirus; P:\AVAST Software\Avast\AvastSvc.exe [50344 2014-04-23] (AVAST Software)
R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [103808 2008-01-22] ()
R2 MBAMScheduler; P:\Malwarebytes\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; P:\Malwarebytes\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
S3 Microsoft SharePoint Workspace Audit Service; P:\Microsoft Office\Office14\GROOVE.EXE [30814400 2013-12-19] (Microsoft Corporation)
S3 MWLService; C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [305520 2010-02-01] (Egis Technology Inc.)
R2 SbieSvc; P:\Sandboxie\SbieSvc.exe [174088 2014-05-29] (Sandboxie Holdings, LLC)
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1326176 2012-07-25] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [681056 2012-07-25] (Secunia)
R2 USBS3S4Detection; C:\OEM\USBDECTION\USBS3S4Detection.exe [76320 2009-12-09] ()
==================== Drivers (Whitelisted) ====================
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-04-23] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-04-23] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-04-23] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-04-23] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-05-15] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-05-15] (AVAST Software)
S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [85328 2014-05-15] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208416 2014-04-23] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)
R3 SbieDrv; P:\Sandboxie\SbieDrv.sys [185352 2014-05-29] (Sandboxie Holdings, LLC)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-06-13 18:59 - 2014-06-13 19:06 - 00000867 _____ () C:\Users\masteruser\Desktop\JRT.txt
2014-06-13 18:51 - 2014-06-13 18:51 - 00000000 ____D () C:\Windows\ERUNT
2014-06-13 18:49 - 2014-06-13 18:50 - 00002102 _____ () C:\Users\masteruser\Desktop\AdwCleaner[S0].txt
2014-06-13 18:48 - 2014-06-13 18:48 - 00002095 _____ () C:\Users\masteruser\Desktop\AdwCleaner[R0].txt
2014-06-12 19:15 - 2014-06-13 19:07 - 00000000 ____D () C:\FRST
2014-06-12 19:14 - 2014-06-12 19:14 - 00000000 _____ () C:\Users\masteruser\defogger_reenable
2014-06-12 18:56 - 2014-06-12 18:57 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-12 18:56 - 2014-06-12 18:56 - 00000557 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-12 18:56 - 2014-06-12 18:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-06-12 18:56 - 2014-06-12 18:56 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-12 18:56 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-06-12 18:56 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-06-12 18:56 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-06-12 07:40 - 2014-04-25 04:34 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2014-06-12 07:40 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll
2014-06-12 07:40 - 2014-04-05 04:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-06-12 07:40 - 2014-04-05 04:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2014-06-12 07:40 - 2014-03-26 16:44 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-06-12 07:40 - 2014-03-26 16:44 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-06-12 07:40 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2014-06-12 07:40 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-06-12 07:40 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2014-06-12 07:40 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-06-12 07:40 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2014-06-12 07:40 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-06-11 22:26 - 2014-06-08 11:13 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-06-11 22:26 - 2014-06-08 11:08 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-06-11 22:26 - 2014-05-08 11:32 - 03178496 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-06-11 22:26 - 2014-05-08 11:32 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2014-06-02 19:30 - 2014-06-02 19:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sandboxie
2014-05-30 19:36 - 2014-05-30 19:38 - 00000000 ____D () C:\hjt
2014-05-30 18:48 - 2014-05-30 18:48 - 00002309 _____ () C:\Users\Public\Desktop\T-Online 6.0.lnk
2014-05-30 18:36 - 2014-05-30 18:36 - 00000000 ____D () C:\Users\XXXXXX\AppData\Local\Apps\2.0
2014-05-29 19:42 - 2014-05-29 20:18 - 235496584 _____ (T-Online) C:\Users\XXXXXX\Downloads\software_6_setup.exe
2014-05-24 10:39 - 2014-05-24 10:38 - 00000541 _____ () C:\Users\XXXXXX\Downloads\tosw60.htm
2014-05-19 20:58 - 2014-05-19 20:58 - 05601616 _____ (Microsoft Corporation) C:\Windows\system32\mfc100u.dll
2014-05-15 19:21 - 2014-03-25 04:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-05-15 19:21 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-05-15 17:08 - 2014-05-06 02:46 - 17847808 _____ () C:\Windows\system32\mshtml.dll
2014-05-15 17:08 - 2014-05-06 02:21 - 02382848 _____ () C:\Windows\system32\mshtml.tlb
2014-05-15 17:08 - 2014-05-06 01:32 - 12347392 _____ () C:\Windows\SysWOW64\mshtml.dll
2014-05-15 17:08 - 2014-05-06 01:14 - 02382848 _____ () C:\Windows\SysWOW64\mshtml.tlb
2014-05-15 17:08 - 2014-05-06 01:14 - 00073216 _____ () C:\Windows\SysWOW64\mshtmled.dll
2014-05-15 17:07 - 2014-05-06 02:21 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-15 17:06 - 2014-04-12 04:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-05-15 17:06 - 2014-04-12 04:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2014-05-15 17:06 - 2014-04-12 04:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-05-15 17:06 - 2014-04-12 04:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2014-05-15 17:06 - 2014-04-12 04:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2014-05-15 17:06 - 2014-04-12 04:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2014-05-15 17:06 - 2014-04-12 04:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2014-05-15 17:06 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-05-15 17:06 - 2014-04-12 04:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-05-15 17:06 - 2014-03-04 11:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-05-15 17:06 - 2014-03-04 11:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-05-15 17:06 - 2014-03-04 11:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll
2014-05-15 17:06 - 2014-03-04 11:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-05-15 17:06 - 2014-03-04 11:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-05-15 17:06 - 2014-03-04 11:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-05-15 17:06 - 2014-03-04 11:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-05-15 17:06 - 2014-03-04 11:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-05-15 17:06 - 2014-03-04 11:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll
2014-05-15 17:06 - 2014-03-04 11:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-05-15 17:06 - 2014-03-04 11:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll
2014-05-15 17:06 - 2014-03-04 11:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll
2014-05-15 17:06 - 2014-03-04 11:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll
2014-05-15 17:06 - 2014-03-04 11:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll
2014-05-15 17:06 - 2014-03-04 11:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2014-05-15 17:06 - 2014-03-04 11:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-05-15 17:06 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2014-05-15 17:06 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2014-05-15 17:06 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-05-15 17:06 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll
2014-05-15 17:06 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-05-15 17:06 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-05-15 17:06 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-05-15 17:06 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-05-15 17:06 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll
2014-05-15 17:06 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll
2014-05-15 17:06 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll
2014-05-15 17:06 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll
2014-05-15 17:06 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll
2014-05-15 17:06 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll
2014-05-15 17:06 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-05-15 17:06 - 2014-03-04 11:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
==================== One Month Modified Files and Folders =======
2014-06-13 19:07 - 2014-06-12 19:15 - 00000000 ____D () C:\FRST
2014-06-13 19:07 - 2012-11-24 20:25 - 00001114 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-13 19:07 - 2012-09-13 21:04 - 00000000 ____D () C:\Users\XXXXXX\AppData\Local\Temp
2014-06-13 19:07 - 2012-09-13 20:25 - 00000000 ____D () C:\Users\masteruser\AppData\Local\Temp
2014-06-13 19:06 - 2014-06-13 18:59 - 00000867 _____ () C:\Users\masteruser\Desktop\JRT.txt
2014-06-13 18:55 - 2012-09-15 10:11 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-06-13 18:54 - 2012-09-13 20:28 - 00000000 ___RD () C:\Users\masteruser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-06-13 18:54 - 2012-09-13 20:28 - 00000000 ___RD () C:\Users\masteruser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-06-13 18:54 - 2009-07-14 06:57 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2014-06-13 18:51 - 2014-06-13 18:51 - 00000000 ____D () C:\Windows\ERUNT
2014-06-13 18:50 - 2014-06-13 18:49 - 00002102 _____ () C:\Users\masteruser\Desktop\AdwCleaner[S0].txt
2014-06-13 18:48 - 2014-06-13 18:48 - 00002095 _____ () C:\Users\masteruser\Desktop\AdwCleaner[R0].txt
2014-06-13 18:48 - 2012-09-14 05:57 - 00699432 _____ () C:\Windows\system32\perfh007.dat
2014-06-13 18:48 - 2012-09-14 05:57 - 00149572 _____ () C:\Windows\system32\perfc007.dat
2014-06-13 18:48 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-13 18:48 - 2009-07-14 06:45 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-13 18:48 - 2009-07-14 06:45 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-13 18:41 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-13 18:40 - 2012-09-13 20:11 - 01695015 _____ () C:\Windows\WindowsUpdate.log
2014-06-13 18:40 - 2012-09-13 20:06 - 00270490 _____ () C:\Windows\PFRO.log
2014-06-13 18:40 - 2009-07-14 06:51 - 00235675 _____ () C:\Windows\setupact.log
2014-06-13 18:29 - 2012-09-15 16:47 - 00000000 ____D () C:\Users\XXXXXXX\AppData\Local\Temp
2014-06-13 18:24 - 2012-11-24 20:25 - 00001118 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-13 18:14 - 2013-05-17 20:19 - 00001654 _____ () C:\Windows\Sandboxie.ini
2014-06-13 16:38 - 2012-09-14 20:09 - 00004154 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-06-12 19:14 - 2014-06-12 19:14 - 00000000 _____ () C:\Users\masteruser\defogger_reenable
2014-06-12 18:57 - 2014-06-12 18:56 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-12 18:56 - 2014-06-12 18:56 - 00000557 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-12 18:56 - 2014-06-12 18:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-06-12 18:56 - 2014-06-12 18:56 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-12 08:07 - 2012-09-17 20:39 - 00000000 ____D () C:\Users\XXXXX\AppData\Local\Temp
2014-06-11 22:37 - 2013-07-11 23:01 - 00000000 ____D () C:\Windows\system32\MRT
2014-06-11 22:35 - 2014-04-23 10:56 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-06-11 22:35 - 2012-09-17 19:50 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-06-11 22:35 - 2012-09-14 18:57 - 95414520 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-06-09 17:46 - 2012-09-17 11:03 - 00000000 ____D () C:\Users\XXXXXX\AppData\Local\Temp
2014-06-08 19:59 - 2013-03-20 20:21 - 00000000 ____D () C:\Users\XXXXXX\AppData\Roaming\vlc
2014-06-08 19:53 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-06-08 11:40 - 2012-10-08 19:29 - 00000000 ____D () C:\ProgramData\CanonIJPLM
2014-06-08 11:13 - 2014-06-11 22:26 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-06-08 11:08 - 2014-06-11 22:26 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-06-06 14:56 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-06-02 19:30 - 2014-06-02 19:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sandboxie
2014-06-02 19:29 - 2013-02-06 21:26 - 00000605 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
2014-05-30 19:38 - 2014-05-30 19:36 - 00000000 ____D () C:\hjt
2014-05-30 18:49 - 2012-09-15 16:40 - 00009043 _____ () C:\Windows\SysWOW64\NULL
2014-05-30 18:48 - 2014-05-30 18:48 - 00002309 _____ () C:\Users\Public\Desktop\T-Online 6.0.lnk
2014-05-30 18:48 - 2012-09-15 16:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\T-Online
2014-05-30 18:48 - 2010-05-12 14:01 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-05-30 18:47 - 2012-09-15 16:30 - 00000000 ____D () C:\Program Files (x86)\T-Online
2014-05-30 18:36 - 2014-05-30 18:36 - 00000000 ____D () C:\Users\XXXXXX\AppData\Local\Apps\2.0
2014-05-29 20:18 - 2014-05-29 19:42 - 235496584 _____ (T-Online) C:\Users\XXXXXX\Downloads\software_6_setup.exe
2014-05-25 14:28 - 2012-09-17 20:39 - 00000000 ___RD () C:\Users\XXXXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-25 14:28 - 2012-09-17 20:39 - 00000000 ___RD () C:\Users\XXXXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-24 10:38 - 2014-05-24 10:39 - 00000541 _____ () C:\Users\XXXXXX\Downloads\tosw60.htm
2014-05-21 18:37 - 2013-04-12 21:31 - 00000614 _____ () C:\Users\Public\Desktop\VLC media player.lnk
2014-05-19 20:58 - 2014-05-19 20:58 - 05601616 _____ (Microsoft Corporation) C:\Windows\system32\mfc100u.dll
2014-05-16 18:55 - 2012-09-13 21:05 - 00000000 ___RD () C:\Users\XXXXXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-16 18:55 - 2012-09-13 21:05 - 00000000 ___RD () C:\Users\XXXXXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-16 13:50 - 2012-10-08 20:45 - 00000000 ____D () C:\ProgramData\CanonIJ
2014-05-15 21:09 - 2012-09-15 16:47 - 00000000 ___RD () C:\Users\XXXXXXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-15 21:09 - 2012-09-15 16:47 - 00000000 ___RD () C:\Users\XXXXXXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-15 19:50 - 2012-09-17 11:03 - 00000000 ___RD () C:\Users\XXXXXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-15 19:50 - 2012-09-17 11:03 - 00000000 ___RD () C:\Users\XXXXXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-15 13:37 - 2013-12-18 20:16 - 00085328 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2014-05-15 13:37 - 2012-09-14 20:09 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2014-05-15 13:37 - 2012-09-14 20:09 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
Some content of TEMP:
====================
C:\Users\XXXXXX\AppData\Local\Temp\MSETUP4.EXE
C:\Users\XXXXXX\AppData\Local\Temp\SandboxieInstall.exe
C:\Users\XXXXXX\AppData\Local\Temp\vlc-2.1.3-win64.exe
C:\Users\XXXXXX\AppData\Local\Temp\vlc-2.1.4-win64.exe
C:\Users\masteruser\AppData\Local\Temp\EBU33FB.EXE
C:\Users\masteruser\AppData\Local\Temp\EBU4D54.DLL
C:\Users\masteruser\AppData\Local\Temp\MSETUP4.EXE
C:\Users\masteruser\AppData\Local\Temp\vcredist_x64.exe
C:\Users\XXXXXXX\AppData\Local\Temp\Ab320640.dll
C:\Users\XXXXXXX\AppData\Local\Temp\Ab320800.dll
C:\Users\XXXXXXX\AppData\Local\Temp\Ab321024.dll
C:\Users\XXXXXXX\AppData\Local\Temp\Ab321280.dll
C:\Users\XXXXXXX\AppData\Local\Temp\Br320640.dll
C:\Users\XXXXXXX\AppData\Local\Temp\Br320800.dll
C:\Users\XXXXXXX\AppData\Local\Temp\Br321024.dll
C:\Users\XXXXXXX\AppData\Local\Temp\Br321280.dll
C:\Users\XXXXXXX\AppData\Local\Temp\Bs320640.dll
C:\Users\XXXXXXX\AppData\Local\Temp\Bs320800.dll
C:\Users\XXXXXXX\AppData\Local\Temp\Bs321024.dll
C:\Users\XXXXXXX\AppData\Local\Temp\Bs321280.dll
C:\Users\XXXXXXX\AppData\Local\Temp\NetCmnRs.dll
C:\Users\XXXXXXX\AppData\Local\Temp\NetSchk.exe
C:\Users\XXXXXXX\AppData\Local\Temp\Nschkk.dll
C:\Users\XXXXXXX\AppData\Local\Temp\Nschkm.dll
C:\Users\XXXXXXX\AppData\Local\Temp\Nschkw.dll
C:\Users\XXXXXXX\AppData\Local\Temp\setup.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-06-08 19:45
==================== End Of Log ============================
|
|
14.06.2014, 15:19
| #4 |
| /// the machine /// TB-Ausbilder | WIN7 PUP.Optional.... gefundenESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
14.06.2014, 21:09
| #5 |
| | WIN7 PUP.Optional.... gefunden Hallo, hier sind die Logs: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
esets_scanner_update returned -1 esets_gle=12
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7587
# api_version=3.0.2
# EOSSerial=6b1efca163e5b24f8c245e8da49554d6
# engine=18720
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-06-14 07:56:47
# local_time=2014-06-14 09:56:47 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='avast! Antivirus'
# compatibility_mode=783 16777213 100 97 1308723 167196297 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 12207 154405657 0 0
# scanned=248644
# found=20
# cleaned=0
# scan_time=5000
sh=FA117B76C8412B990ED20AFFBD2BDEBFC4810201 ft=1 fh=2d4a755d9c7de388 vn="Variante von Win32/SoftonicDownloader.F evtl. unerwünschte Anwendung" ac=I fn="C:\$Recycle.Bin\S-1-5-21-1692514539-1397013794-4007604138-1002\$R0JOMDD.exe"
sh=CF7A24B679F463211B5D0D3432660E937F74C0E4 ft=1 fh=e36199717a46f263 vn="Win32/Toolbar.Inbox.A evtl. unerwünschte Anwendung" ac=I fn="C:\$Recycle.Bin\S-1-5-21-1692514539-1397013794-4007604138-1002\$R0O0RDW.exe"
sh=CF7A24B679F463211B5D0D3432660E937F74C0E4 ft=1 fh=e36199717a46f263 vn="Win32/Toolbar.Inbox.A evtl. unerwünschte Anwendung" ac=I fn="C:\$Recycle.Bin\S-1-5-21-1692514539-1397013794-4007604138-1002\$R3IIBJT.exe"
sh=CF7A24B679F463211B5D0D3432660E937F74C0E4 ft=1 fh=e36199717a46f263 vn="Win32/Toolbar.Inbox.A evtl. unerwünschte Anwendung" ac=I fn="C:\$Recycle.Bin\S-1-5-21-1692514539-1397013794-4007604138-1002\$RB5XV5P.exe"
sh=FA117B76C8412B990ED20AFFBD2BDEBFC4810201 ft=1 fh=2d4a755d9c7de388 vn="Variante von Win32/SoftonicDownloader.F evtl. unerwünschte Anwendung" ac=I fn="C:\$Recycle.Bin\S-1-5-21-1692514539-1397013794-4007604138-1002\$RBEX0E5.exe"
sh=FA117B76C8412B990ED20AFFBD2BDEBFC4810201 ft=1 fh=2d4a755d9c7de388 vn="Variante von Win32/SoftonicDownloader.F evtl. unerwünschte Anwendung" ac=I fn="C:\$Recycle.Bin\S-1-5-21-1692514539-1397013794-4007604138-1002\$RBT6PQA.exe"
sh=62DEF47F29C91A20EBCD16BC5A2F0775932CD766 ft=1 fh=ff31a77eed39c20c vn="Variante von Win32/AdWare.iBryte.V.gen Anwendung" ac=I fn="C:\$Recycle.Bin\S-1-5-21-1692514539-1397013794-4007604138-1002\$RQBKBBR.exe"
sh=69F40E88B14C016CADD0D225C8144E54D0FE88F2 ft=1 fh=b9f118db0f33fdef vn="Win32/Toolbar.SearchSuite evtl. unerwünschte Anwendung" ac=I fn="C:\$Recycle.Bin\S-1-5-21-1692514539-1397013794-4007604138-1003\$R4AXWDL.exe"
sh=E8CD33623287C08C7CC3662A042E45522654BB30 ft=1 fh=7cd3b160b0dbd4bd vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\$Recycle.Bin\S-1-5-21-1692514539-1397013794-4007604138-1003\$RMIGPWW.exe"
sh=552EE4F57C9683F7E82B13CF3F414188C653582D ft=1 fh=5565d5049be9d18b vn="Mehrere Bedrohungen" ac=I fn="C:\Users\masteruser\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CPBDT6OB\yontoosetup[1].exe"
sh=C566FAED1450CC2851B05D23534E3641031AA578 ft=1 fh=7cebe7e0ab16943c vn="Variante von Win32/InstallCore.BY evtl. unerwünschte Anwendung" ac=I fn="C:\Users\masteruser\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D8X82M22\JDownloaderSetup_CH5[1].exe"
sh=DA602313EC344E31F340105C29DF699267F73B84 ft=1 fh=34999f3f19837452 vn="Mehrere Bedrohungen" ac=I fn="C:\Users\masteruser\AppData\Local\Temp\is1070216317\yontoo-C4.exe"
sh=9E64A649A56CDDB5D37847E6CA482EAF367B3A86 ft=1 fh=5abe4e82306cd3f4 vn="Variante von Win32/Toolbar.SearchSuite.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\XXXXXXX\AppData\Local\Temp\nst956D.tmp\Helper.dll"
sh=4395DA8F1F03CA16C409103E00C05E063F436D54 ft=1 fh=942a05f113887d8e vn="Variante von Win32/WinloadSDA.D evtl. unerwünschte Anwendung" ac=I fn="C:\Users\XXXXXX\Downloads\Punch!-Super-Home-Suite-lnstall.exe"
sh=8193728637D16FEDD8E5809E6A5F177DEAE87145 ft=1 fh=8b9917ca3e69a6ac vn="Win32/OpenCandy potenziell unsichere Anwendung" ac=I fn="C:\Users\XXXXXX\Downloads\SweetHome3D-4.3-windows-oc.exe"
sh=8992F72873D09212597E582A16F8D9BC60E6A22A ft=1 fh=e21391a34e842ffc vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="D:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\DVDVideoSoft\TB\ConduitInstaller.exe.vir"
sh=410B32FD3FE4642644AD91AC60C69B86EC2762DD ft=1 fh=0e378a435beab91a vn="Variante von Win32/Adware.Yontoo.B Anwendung" ac=I fn="D:\AdwCleaner\Quarantine\C\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setupx.dll.vir"
sh=B67C54F6148561F9D3FDC3FDE22EF20C906BC5ED ft=1 fh=c0b9bdbd76ce7f12 vn="Win32/OpenCandy potenziell unsichere Anwendung" ac=I fn="D:\Eigene Dateien\Downloads\cdbxp_setup_4.5.3.4643.exe"
sh=45521D4488BCC344EB58C94214769288A321D12C ft=1 fh=070fca735bf0ab7d vn="Win32/OpenCandy potenziell unsichere Anwendung" ac=I fn="D:\Eigene Dateien\Downloads\cdbxp_setup_4.5.4.4852.exe"
sh=557B7E335F9D1BC597F63D8F72BFF3F6D699696B ft=1 fh=4e9bb887f8af7d7e vn="Win32/OpenCandy potenziell unsichere Anwendung" ac=I fn="D:\Eigene Dateien\Downloads\SweetHome3D-4.1-windows-oc.exe"
Code:
ATTFilter Results of screen317's Security Check version 0.99.83 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 11 ``````````````Antivirus/Firewall Check:`````````````` avast! Antivirus Antivirus up to date! (On Access scanning disabled!) `````````Anti-malware/Other Utilities Check:````````` Secunia PSI (3.0.0.3001) Adobe Flash Player 13.0.0.214 Adobe Reader XI Mozilla Firefox (26.0) ````````Process Check: objlist.exe by Laurent```````` Malwarebytes Anti-Malware mbamservice.exe mbamscheduler.exe Avast AvastSvc.exe Avast AvastUI.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` |
|
15.06.2014, 06:29
| #6 |
| /// the machine /// TB-Ausbilder | WIN7 PUP.Optional.... gefunden Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter C:\$Recycle.Bin
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Frisches FRST log fehlt und Antwort auf meine Frage
__________________ --> WIN7 PUP.Optional.... gefunden |
|
15.06.2014, 16:06
| #7 |
| | WIN7 PUP.Optional.... gefunden Hallo schrauber, da hab ich wohl was übersehen:-) Probleme habe ich insofern noch, dass ich den Flash Player immer noch nicht updaten kann. es erscheint folgende Fehlermeldung: C:\Windows\Sytem32\mshtml.dll ist entweder nicht für die Ausführung unter Windows vorgesehen oder enthält einen Fehler. Insatllieren sie das Programm mit den Originalinstallationsmedien erneut, oder wenden Sie sich an den Systemadministrator.... Das gleiche erscheint für die datei C:\Windows\SysWOW64\mshtml.dll Habe schon versucht die Datei mit sfc /SCANNOW zu reparieren, wird auch als fehlerhaft erkannt, aber im Logfile steht unter anderem: Code:
ATTFilter 2014-06-14 17:18:25, Info CSI 00000361 [SR] Could not reproject corrupted file [ml:48{24},l:46{23}]"\??\C:\Windows\SysWOW64"\[l:20{10}]"mshtml.dll"; source file in store is also corrupted
2014-06-14 17:18:25, Info CSI 00000362 Repair results created:
hier noch die Log-Files: Fixlog.txt: Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 12-06-2014 02
Ran by masteruser at 2014-06-15 16:28:39 Run:1
Running from D:\Eigene Dateien\Desktop
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
C:\$Recycle.Bin
*****************
C:\$Recycle.Bin => Moved successfully.
==== End of Fixlog ====
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-06-2014 02
Ran by masteruser (administrator) on NONAME on 15-06-2014 16:31:20
Running from D:\Eigene Dateien\Desktop
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\System32\atiesrxx.exe
(Sandboxie Holdings, LLC) P:\Sandboxie\SbieSvc.exe
(AVAST Software) P:\AVAST Software\Avast\AvastSvc.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
() C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe
(Malwarebytes Corporation) P:\Malwarebytes\mbamscheduler.exe
(Malwarebytes Corporation) P:\Malwarebytes\mbamservice.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe
(Malwarebytes Corporation) P:\Malwarebytes\mbam.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Acer Group) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
() C:\OEM\USBDECTION\USBS3S4Detection.exe
(Panda Security) P:\Panda USB Vaccine\USBVaccine.exe
(FileHippo.com) P:\FileHippo.com\UpdateChecker.exe
(Sandboxie Holdings, LLC) P:\Sandboxie\SbieCtrl.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
(AVAST Software) P:\AVAST Software\Avast\AvastUI.exe
(Mozilla Corporation) P:\Mozilla Firefox\firefox.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [9642528 2010-02-24] (Realtek Semiconductor)
HKLM\...\Run: [CanonSolutionMenu] => C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe [689488 2008-03-10] (CANON INC.)
HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2114376 2008-03-17] (CANON INC.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-01-13] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [BCSSync] => P:\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AvastUI.exe] => P:\AVAST Software\Avast\AvastUI.exe [3873704 2014-04-23] (AVAST Software)
HKLM\...\Runonce: [MSPCLOCK] - rundll32.exe streamci,StreamingDeviceSetup {97ebaacc-95bd-11d0-a3ea-00a0c9223196},{53172480-4791-11D0-A5D6-28DB04C10000},{53172480-4791-11D0-A5D6-28DB04C10000}
HKLM\...\Runonce: [MSPQM] - rundll32.exe streamci,StreamingDeviceSetup {DDF4358E-BB2C-11D0-A42F-00A0C9223196},{97EBAACB-95BD-11D0-A3EA-00A0C9223196},{97EBAACB-95BD-11D0-A3EA-00A0C9223196}
HKLM\...\Runonce: [MSKSSRV] - rundll32.exe streamci,StreamingDeviceSetup {96E080C7-143C-11D1-B40F-00A0C9223196},{3C0D501A-140B-11D1-B40F-00A0C9223196},{3C0D501A-140B-11D1-B40F-00A0C9223196}
HKLM\...\Runonce: [MSTEE.CxTransform] - rundll32.exe streamci,StreamingDeviceSetup {cfd669f1-9bc2-11d0-8299-0000f822fe8a},{CF1DDA2C-9743-11D0-A3EE-00A0C9223196},{CF1DDA2C-9743-11D0-A3EE-00A0C9223196},C:\Windows\inf\ksfilter.inf,MSTEE.Interface.Install
HKLM\...\Runonce: [MSTEE.Splitter] - rundll32.exe streamci,StreamingDeviceSetup {cfd669f1-9bc2-11d0-8299-0000f822fe8a},{0A4252A0-7E70-11D0-A5D6-28DB04C10000},{0A4252A0-7E70-11D0-A5D6-28DB04C10000},C:\Windows\inf\ksfilter.inf,MSTEE.Interface.Install
HKLM\...\Runonce: [WDM_DRMKAUD] - rundll32.exe streamci,StreamingDeviceSetup {EEC12DB6-AD9C-4168-8658-B03DAEF417FE},{ABD61E00-9350-47e2-A632-4438B90C6641},{FFBB6E3F-CCFE-4D84-90D9-421418B03A8E},C:\Windows\inf\WDMAUDIO.inf,WDM_DRMKAUD.Interface.Install
HKLM\...\RunOnce: [*Restore] - C:\Windows\System32\rstrui.exe /runonce [296960 2010-11-20] (Microsoft Corporation)
HKLM-x32\...\Runonce: [aswAhAScr.dll] - "P:\AVAST Software\Avast\aswRegSvr.exe" "P:\AVAST Software\Avast\AhAScr.dll" [X]
HKLM-x32\...\Runonce: [aswasOutExt.dll] - "P:\AVAST Software\Avast\aswRegSvr.exe" "P:\AVAST Software\Avast\asOutExt.dll" [X]
HKLM-x32\...\Runonce: [aswasOutExt64.dll] - "P:\AVAST Software\Avast\aswRegSvr64.exe" "P:\AVAST Software\Avast\asOutExt64.dll" [X]
HKLM-x32\...\RunOnce: [20131224] - P:\AVAST Software\Avast\setup\emupdate\f06bc031-c9f4-41f6-8252-3193d03981b2.exe /check [181136 2014-04-29] (AVAST Software)
HKLM-x32\...\RunOnce: [20140526] - P:\AVAST Software\Avast\setup\emupdate\7ae5aa4f-81b5-437c-88c8-8d1d8f1b31a8.exe /check [182720 2014-05-27] (AVAST Software)
HKLM-x32\...\RunOnce: [20140529] - P:\AVAST Software\Avast\setup\emupdate\51d1a79d-f668-4a0f-aa07-81e6eec710a0.exe /check [183208 2014-05-30] (AVAST Software)
HKU\S-1-5-21-1692514539-1397013794-4007604138-1000\...\Run: [FileHippo.com] => P:\FileHippo.com\UpdateChecker.exe [307712 2012-11-23] (FileHippo.com)
HKU\S-1-5-21-1692514539-1397013794-4007604138-1001\...\Run: [FileHippo.com] => P:\FileHippo.com\UpdateChecker.exe [307712 2012-11-23] (FileHippo.com)
HKU\S-1-5-21-1692514539-1397013794-4007604138-1001\...\Run: [SandboxieControl] => P:\Sandboxie\SbieCtrl.exe [784392 2014-05-29] (Sandboxie Holdings, LLC)
HKU\S-1-5-21-1692514539-1397013794-4007604138-1001\...\Run: [ConnectionCenter] => C:\Users\XXXXXX\AppData\Local\Citrix\ICA Client\concentr.exe [103768 2009-09-12] (Citrix Systems, Inc.)
HKU\S-1-5-21-1692514539-1397013794-4007604138-1001\...\MountPoints2: {39536f8b-10ad-11e2-812e-4487fc9fa8fa} - Q:\LaunchU3.exe -a
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m5910&r=17360912c106pe465v145w46m1u190
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m5910&r=17360912c106pe465v145w46m1u190
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m5910&r=17360912c106pe465v145w46m1u190
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_m5910&r=17360912c106pe465v145w46m1u190
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - P:\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - P:\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - P:\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - P:\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
Handler: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll ()
Handler: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll ()
Handler: mailto - {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll ()
Handler: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll ()
Handler: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll ()
Handler-x32: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll ()
Handler-x32: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll ()
Handler-x32: mailto - {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll ()
Handler-x32: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll ()
Handler-x32: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll ()
Tcpip\..\Interfaces\{C5316836-3A75-4F74-B7B2-880C81FFDD3F}: [NameServer]217.0.43.97 217.0.43.113
FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.6 - P:\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.0.7 - P:\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.0 - P:\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.1 - P:\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.2 - P:\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 - P:\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.4 - P:\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - P:\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - P:\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - P:\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - P:\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - P:\AVAST Software\Avast\WebRep\FF [2012-09-14]
FF StartMenuInternet: FIREFOX.EXE - P:\Mozilla Firefox\firefox.exe
==================== Services (Whitelisted) =================
R2 avast! Antivirus; P:\AVAST Software\Avast\AvastSvc.exe [50344 2014-04-23] (AVAST Software)
R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [103808 2008-01-22] ()
R2 MBAMScheduler; P:\Malwarebytes\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; P:\Malwarebytes\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
S3 Microsoft SharePoint Workspace Audit Service; P:\Microsoft Office\Office14\GROOVE.EXE [30814400 2013-12-19] (Microsoft Corporation)
S3 MWLService; C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [305520 2010-02-01] (Egis Technology Inc.)
R2 SbieSvc; P:\Sandboxie\SbieSvc.exe [174088 2014-05-29] (Sandboxie Holdings, LLC)
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1326176 2012-07-25] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [681056 2012-07-25] (Secunia)
R2 USBS3S4Detection; C:\OEM\USBDECTION\USBS3S4Detection.exe [76320 2009-12-09] ()
==================== Drivers (Whitelisted) ====================
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-04-23] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-04-23] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-04-23] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-04-23] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-05-15] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-05-15] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [85328 2014-05-15] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208416 2014-04-23] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)
R3 SbieDrv; P:\Sandboxie\SbieDrv.sys [185352 2014-05-29] (Sandboxie Holdings, LLC)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-06-14 17:57 - 2014-06-14 17:57 - 00000000 ____D () C:\Users\XXXXXX\AppData\Local\roomeon
2014-06-14 17:56 - 2014-06-14 17:56 - 00002669 _____ () C:\Users\Public\Desktop\roomeon 3D-Planer.lnk
2014-06-14 17:56 - 2014-06-14 17:56 - 00001586 _____ () C:\Users\Public\Desktop\roomeon Portal.lnk
2014-06-14 17:56 - 2014-06-14 17:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\roomeon GmbH
2014-06-14 17:56 - 2014-06-14 17:56 - 00000000 ____D () C:\Program Files (x86)\roomeon GmbH
2014-06-14 17:55 - 2014-06-14 17:55 - 00000000 ____D () C:\Users\XXXXXX\AppData\Local\Downloaded Installations
2014-06-14 15:00 - 2014-01-09 04:22 - 05694464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-06-14 15:00 - 2014-01-04 00:44 - 06574592 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-06-13 20:54 - 2013-10-02 04:22 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys
2014-06-13 20:54 - 2013-10-02 04:11 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2014-06-13 20:54 - 2013-10-02 04:08 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2014-06-13 20:54 - 2013-10-02 03:10 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll
2014-06-13 20:53 - 2013-10-02 03:48 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll
2014-06-13 20:53 - 2013-10-02 03:48 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll
2014-06-13 20:53 - 2013-10-02 03:29 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2014-06-13 20:53 - 2013-10-02 02:15 - 01057280 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2014-06-13 20:53 - 2013-10-02 02:14 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll
2014-06-13 20:53 - 2013-10-02 02:14 - 00017920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll
2014-06-13 20:53 - 2013-10-02 02:08 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2014-06-13 20:53 - 2013-10-02 02:01 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2014-06-13 20:53 - 2013-10-02 01:58 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2014-06-13 20:53 - 2013-10-02 01:31 - 01147392 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2014-06-13 20:53 - 2013-10-02 01:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll
2014-06-13 20:53 - 2013-10-02 00:34 - 01068544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2014-06-13 20:53 - 2013-09-25 04:23 - 01030144 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2014-06-13 20:53 - 2013-09-25 03:57 - 00792576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll
2014-06-13 20:27 - 2014-06-13 20:45 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-06-13 20:27 - 2014-06-13 20:27 - 00000134 _____ () C:\Users\masteruser\Desktop\Internet Explorer-Problembehebung.url
2014-06-13 20:26 - 2014-06-13 20:45 - 00000000 ____D () C:\Users\masteruser\Desktop\mbar
2014-06-13 20:15 - 2014-06-13 20:27 - 00008823 _____ () C:\Windows\IE11_main.log
2014-06-13 18:59 - 2014-06-13 19:06 - 00000867 _____ () C:\Users\masteruser\Desktop\JRT.txt
2014-06-13 18:51 - 2014-06-13 19:41 - 00000000 ____D () C:\Windows\ERUNT
2014-06-13 18:49 - 2014-06-13 18:50 - 00002102 _____ () C:\Users\masteruser\Desktop\AdwCleaner[S0].txt
2014-06-13 18:48 - 2014-06-13 18:48 - 00002095 _____ () C:\Users\masteruser\Desktop\AdwCleaner[R0].txt
2014-06-12 19:15 - 2014-06-15 16:31 - 00000000 ____D () C:\FRST
2014-06-12 19:14 - 2014-06-12 19:14 - 00000000 _____ () C:\Users\masteruser\defogger_reenable
2014-06-12 18:56 - 2014-06-13 20:27 - 00128728 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-12 18:56 - 2014-06-13 20:26 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-06-12 18:56 - 2014-06-13 19:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-06-12 18:56 - 2014-06-13 19:39 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-12 18:56 - 2014-06-12 18:56 - 00000557 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-12 18:56 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-06-12 18:56 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-06-12 07:40 - 2014-04-25 04:34 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2014-06-12 07:40 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll
2014-06-12 07:40 - 2014-04-05 04:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-06-12 07:40 - 2014-04-05 04:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2014-06-12 07:40 - 2014-03-26 16:44 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-06-12 07:40 - 2014-03-26 16:44 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-06-12 07:40 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2014-06-12 07:40 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-06-12 07:40 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2014-06-12 07:40 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-06-12 07:40 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2014-06-12 07:40 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-06-11 22:26 - 2014-06-08 11:13 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-06-11 22:26 - 2014-06-08 11:08 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-06-11 22:26 - 2014-05-08 11:32 - 03178496 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-06-11 22:26 - 2014-05-08 11:32 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2014-06-02 19:30 - 2014-06-02 19:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sandboxie
2014-05-30 19:36 - 2014-05-30 19:38 - 00000000 ____D () C:\hjt
2014-05-30 18:48 - 2014-05-30 18:48 - 00002309 _____ () C:\Users\Public\Desktop\T-Online 6.0.lnk
2014-05-30 18:36 - 2014-05-30 18:36 - 00000000 ____D () C:\Users\XXXXXX\AppData\Local\Apps\2.0
2014-05-29 19:42 - 2014-05-29 20:18 - 235496584 _____ (T-Online) C:\Users\XXXXXX\Downloads\software_6_setup.exe
2014-05-24 10:39 - 2014-05-24 10:38 - 00000541 _____ () C:\Users\XXXXXX\Downloads\tosw60.htm
2014-05-19 20:58 - 2014-05-19 20:58 - 05601616 _____ (Microsoft Corporation) C:\Windows\system32\mfc100u.dll
==================== One Month Modified Files and Folders =======
2014-06-15 16:31 - 2014-06-12 19:15 - 00000000 ____D () C:\FRST
2014-06-15 16:31 - 2012-09-13 20:25 - 00000000 ____D () C:\Users\masteruser\AppData\Local\Temp
2014-06-15 16:28 - 2012-09-13 20:11 - 01912319 _____ () C:\Windows\WindowsUpdate.log
2014-06-15 16:26 - 2012-09-13 21:04 - 00000000 ____D () C:\Users\XXXXXX\AppData\Local\Temp
2014-06-15 16:25 - 2012-11-24 20:25 - 00001114 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-15 16:25 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-15 16:25 - 2009-07-14 06:51 - 00236851 _____ () C:\Windows\setupact.log
2014-06-15 15:42 - 2012-09-15 16:47 - 00000000 ____D () C:\Users\XXXXXXX\AppData\Local\Temp
2014-06-15 15:42 - 2009-07-14 06:45 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-15 15:42 - 2009-07-14 06:45 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-15 15:41 - 2012-09-14 05:57 - 00699432 _____ () C:\Windows\system32\perfh007.dat
2014-06-15 15:41 - 2012-09-14 05:57 - 00149572 _____ () C:\Windows\system32\perfc007.dat
2014-06-15 15:41 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-15 14:55 - 2012-09-15 10:11 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-06-15 14:24 - 2012-11-24 20:25 - 00001118 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-15 12:45 - 2012-09-17 11:03 - 00000000 ____D () C:\Users\XXXXXX\AppData\Local\Temp
2014-06-15 01:02 - 2012-09-13 20:06 - 00271300 _____ () C:\Windows\PFRO.log
2014-06-14 17:57 - 2014-06-14 17:57 - 00000000 ____D () C:\Users\XXXXXX\AppData\Local\roomeon
2014-06-14 17:56 - 2014-06-14 17:56 - 00002669 _____ () C:\Users\Public\Desktop\roomeon 3D-Planer.lnk
2014-06-14 17:56 - 2014-06-14 17:56 - 00001586 _____ () C:\Users\Public\Desktop\roomeon Portal.lnk
2014-06-14 17:56 - 2014-06-14 17:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\roomeon GmbH
2014-06-14 17:56 - 2014-06-14 17:56 - 00000000 ____D () C:\Program Files (x86)\roomeon GmbH
2014-06-14 17:55 - 2014-06-14 17:55 - 00000000 ____D () C:\Users\XXXXXX\AppData\Local\Downloaded Installations
2014-06-13 20:45 - 2014-06-13 20:27 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-06-13 20:45 - 2014-06-13 20:26 - 00000000 ____D () C:\Users\masteruser\Desktop\mbar
2014-06-13 20:27 - 2014-06-13 20:27 - 00000134 _____ () C:\Users\masteruser\Desktop\Internet Explorer-Problembehebung.url
2014-06-13 20:27 - 2014-06-13 20:15 - 00008823 _____ () C:\Windows\IE11_main.log
2014-06-13 20:27 - 2014-06-12 18:56 - 00128728 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-13 20:26 - 2014-06-12 18:56 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-06-13 19:43 - 2012-09-13 21:04 - 00000000 ____D () C:\Users\XXXXXX
2014-06-13 19:42 - 2014-06-12 18:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-06-13 19:41 - 2014-06-13 18:51 - 00000000 ____D () C:\Windows\ERUNT
2014-06-13 19:41 - 2014-04-23 10:56 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-06-13 19:41 - 2014-03-12 21:23 - 00000000 ____D () C:\Users\masteruser\AppData\Roaming\Canneverbe Limited
2014-06-13 19:41 - 2014-01-21 14:18 - 00000000 ____D () C:\Users\masteruser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-06-13 19:41 - 2013-01-16 20:11 - 00000000 ____D () C:\Users\masteruser\AppData\Roaming\vlc
2014-06-13 19:41 - 2013-01-07 19:38 - 00000000 ____D () C:\Users\masteruser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2014-06-13 19:41 - 2012-10-04 19:20 - 00000000 ____D () C:\Users\masteruser\AppData\Roaming\DVDVideoSoft
2014-06-13 19:41 - 2012-09-17 20:39 - 00000000 ____D () C:\Users\XXXXX
2014-06-13 19:41 - 2012-09-17 19:50 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-06-13 19:41 - 2012-09-17 11:02 - 00000000 ____D () C:\Users\XXXXXX
2014-06-13 19:41 - 2012-09-15 16:47 - 00000000 ____D () C:\Users\XXXXXXX
2014-06-13 19:41 - 2012-09-13 20:28 - 00000000 ___RD () C:\Users\masteruser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-06-13 19:41 - 2012-09-13 20:28 - 00000000 ___RD () C:\Users\masteruser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-06-13 19:41 - 2012-09-13 20:25 - 00000000 ___RD () C:\Users\masteruser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-06-13 19:41 - 2012-09-13 20:25 - 00000000 ___RD () C:\Users\masteruser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-06-13 19:40 - 2012-09-15 16:45 - 00000000 ____D () C:\Users\masteruser\AppData\Roaming\T-Online
2014-06-13 19:40 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration
2014-06-13 19:39 - 2014-06-12 18:56 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-13 19:39 - 2012-12-03 20:38 - 00000000 __RHD () C:\MSOCache
2014-06-13 19:30 - 2009-07-14 09:44 - 00000000 ___RD () C:\Users\Public\Recorded TV
2014-06-13 19:06 - 2014-06-13 18:59 - 00000867 _____ () C:\Users\masteruser\Desktop\JRT.txt
2014-06-13 18:54 - 2009-07-14 06:57 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2014-06-13 18:50 - 2014-06-13 18:49 - 00002102 _____ () C:\Users\masteruser\Desktop\AdwCleaner[S0].txt
2014-06-13 18:48 - 2014-06-13 18:48 - 00002095 _____ () C:\Users\masteruser\Desktop\AdwCleaner[R0].txt
2014-06-13 18:14 - 2013-05-17 20:19 - 00001654 _____ () C:\Windows\Sandboxie.ini
2014-06-13 16:38 - 2012-09-14 20:09 - 00004154 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-06-12 19:14 - 2014-06-12 19:14 - 00000000 _____ () C:\Users\masteruser\defogger_reenable
2014-06-12 18:56 - 2014-06-12 18:56 - 00000557 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-12 08:07 - 2012-09-17 20:39 - 00000000 ____D () C:\Users\XXXXX\AppData\Local\Temp
2014-06-11 22:37 - 2013-07-11 23:01 - 00000000 ____D () C:\Windows\system32\MRT
2014-06-11 22:35 - 2012-09-14 18:57 - 95414520 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-06-08 19:59 - 2013-03-20 20:21 - 00000000 ____D () C:\Users\XXXXXX\AppData\Roaming\vlc
2014-06-08 19:53 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-06-08 11:40 - 2012-10-08 19:29 - 00000000 ____D () C:\ProgramData\CanonIJPLM
2014-06-08 11:13 - 2014-06-11 22:26 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-06-08 11:08 - 2014-06-11 22:26 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-06-06 14:56 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-06-02 19:30 - 2014-06-02 19:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sandboxie
2014-06-02 19:29 - 2013-02-06 21:26 - 00000605 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
2014-05-30 19:38 - 2014-05-30 19:36 - 00000000 ____D () C:\hjt
2014-05-30 18:49 - 2012-09-15 16:40 - 00009043 _____ () C:\Windows\SysWOW64\NULL
2014-05-30 18:48 - 2014-05-30 18:48 - 00002309 _____ () C:\Users\Public\Desktop\T-Online 6.0.lnk
2014-05-30 18:48 - 2012-09-15 16:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\T-Online
2014-05-30 18:48 - 2010-05-12 14:01 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-05-30 18:47 - 2012-09-15 16:30 - 00000000 ____D () C:\Program Files (x86)\T-Online
2014-05-30 18:36 - 2014-05-30 18:36 - 00000000 ____D () C:\Users\XXXXXX\AppData\Local\Apps\2.0
2014-05-29 20:18 - 2014-05-29 19:42 - 235496584 _____ (T-Online) C:\Users\XXXXXX\Downloads\software_6_setup.exe
2014-05-25 14:28 - 2012-09-17 20:39 - 00000000 ___RD () C:\Users\XXXXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-25 14:28 - 2012-09-17 20:39 - 00000000 ___RD () C:\Users\XXXXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-24 10:38 - 2014-05-24 10:39 - 00000541 _____ () C:\Users\XXXXXX\Downloads\tosw60.htm
2014-05-21 18:37 - 2013-04-12 21:31 - 00000614 _____ () C:\Users\Public\Desktop\VLC media player.lnk
2014-05-19 20:58 - 2014-05-19 20:58 - 05601616 _____ (Microsoft Corporation) C:\Windows\system32\mfc100u.dll
2014-05-16 18:55 - 2012-09-13 21:05 - 00000000 ___RD () C:\Users\XXXXXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-16 18:55 - 2012-09-13 21:05 - 00000000 ___RD () C:\Users\XXXXXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-16 13:50 - 2012-10-08 20:45 - 00000000 ____D () C:\ProgramData\CanonIJ
Some content of TEMP:
====================
C:\Users\XXXXXX\AppData\Local\Temp\MSETUP4.EXE
C:\Users\XXXXXX\AppData\Local\Temp\SandboxieInstall.exe
C:\Users\XXXXXX\AppData\Local\Temp\vlc-2.1.3-win64.exe
C:\Users\XXXXXX\AppData\Local\Temp\vlc-2.1.4-win64.exe
C:\Users\masteruser\AppData\Local\Temp\EBU33FB.EXE
C:\Users\masteruser\AppData\Local\Temp\EBU4D54.DLL
C:\Users\masteruser\AppData\Local\Temp\MSETUP4.EXE
C:\Users\masteruser\AppData\Local\Temp\vcredist_x64.exe
C:\Users\XXXXXXX\AppData\Local\Temp\Ab320640.dll
C:\Users\XXXXXXX\AppData\Local\Temp\Ab320800.dll
C:\Users\XXXXXXX\AppData\Local\Temp\Ab321024.dll
C:\Users\XXXXXXX\AppData\Local\Temp\Ab321280.dll
C:\Users\XXXXXXX\AppData\Local\Temp\Br320640.dll
C:\Users\XXXXXXX\AppData\Local\Temp\Br320800.dll
C:\Users\XXXXXXX\AppData\Local\Temp\Br321024.dll
C:\Users\XXXXXXX\AppData\Local\Temp\Br321280.dll
C:\Users\XXXXXXX\AppData\Local\Temp\Bs320640.dll
C:\Users\XXXXXXX\AppData\Local\Temp\Bs320800.dll
C:\Users\XXXXXXX\AppData\Local\Temp\Bs321024.dll
C:\Users\XXXXXXX\AppData\Local\Temp\Bs321280.dll
C:\Users\XXXXXXX\AppData\Local\Temp\NetCmnRs.dll
C:\Users\XXXXXXX\AppData\Local\Temp\NetSchk.exe
C:\Users\XXXXXXX\AppData\Local\Temp\Nschkk.dll
C:\Users\XXXXXXX\AppData\Local\Temp\Nschkm.dll
C:\Users\XXXXXXX\AppData\Local\Temp\Nschkw.dll
C:\Users\XXXXXXX\AppData\Local\Temp\setup.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-06-08 19:45
==================== End Of Log ============================
|
|
16.06.2014, 09:17
| #8 |
| /// the machine /// TB-Ausbilder | WIN7 PUP.Optional.... gefunden Inplace Upgrade ist ne gute Idee
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
Linear-Darstellung
