| |
| |||||||
Log-Analyse und Auswertung: Online-Banking Sicherheitsüberprüfung/Trojaner TR/Crypt.ZPACK80204/Fehler RegSvr32Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
18.06.2014, 16:04
| #1 |
| |  Online-Banking Sicherheitsüberprüfung/Trojaner TR/Crypt.ZPACK80204/Fehler RegSvr32 Hallo Forum, ich bin heute zum ersten Mal hier und benötige dringend Eure Hilfe. Mein Rechner in Kürze: Vista/Mozilla Firefox/McAfee und Avira. Vor einiger Zeit öffnete sich beim Online-Banking der Sparkasse eine sog. "Sicherheitsüberprüfung", die mich stutzig machte. Auf Nachfrage bei der Bank, erfuhr ich, dass ich mir wohl einen Trojaner eingefangen hatte, mein Account wurde gesperrt. McAfee hatte nichts angezeigt. Kurz zuvor hatte ich, da YouTube-Videos nicht mehr geladen wurden, ein Update von FlashPlayer und Java durchgeführt. Ich ließ daraufhin McAfee nochmals und danach Spybot über den Rechner laufen, keine Meldung. Auf anraten eines Freundes versuchte ich es mit Avira und hatte prompt zwei Meldungen, 2x wurde der Trojaner TR/Crypt.ZPACK80204 gefunden und in Quarantäne verschoben. Beim Starten des Rechners erhalte ich nun immer die Fehlermeldung "RegSvr32: Fehler beim Laden des Moduls - Bitte stellen Sie sicher, dass die Binärdatei am angegebenen Pfad ist, oder debuggen Sie die Datei, um Probleme mit der binären Datei oder abhängigen DLL-Dateien auszuschließen. Das angegebene Modul wurde nicht gefunden.". Handelt es sich bei dem von Avira gefundenen Trojaner um denjenigen, der für die Sicherheitsüberprüfung verantwortlich ist? Wie kann ich die oben genannten Probleme beheben und meinen Rechner wieder einwandfrei nutzen? Ich füge die Logfiles von defogger, FRST, Additions, Gmer sowie von Avira bei. Vielen Dank im Voraus! +katja+ Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 13:48 on 18/06/2014 (*****)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:16-06-2014
Ran by ***** (administrator) on *****-PC on 18-06-2014 13:57:02
Running from C:\Users\*****\Desktop
Platform: Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: German Standard
Internet Explorer Version 7
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Lexar Media, Inc.) C:\Windows\System32\LxrSII1s.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\VS7DEBUG\mdm.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(Nero AG) C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
(Prolific Technology Inc.) C:\Windows\System32\IoctlSvc.exe
() C:\Windows\System32\PSIService.exe
() C:\Program Files\Cyberlink\Shared files\RichVideo.exe
(Telefónica) C:\Program Files\o2\Mobile Connection Manager\ImpWiFiSvc.exe
(AVG Secure Search) C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\17.0.12\ToolbarUpdater.exe
() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
(McAfee, Inc.) C:\Program Files\McAfee\MSC\McAPExe.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
() C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\17.0.12\loggingserver.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(cyberlink) C:\Program Files\Cyberlink\Shared files\brs.exe
(Geek Software GmbH) C:\Program Files\PDF24\pdf24.exe
() C:\Program Files\AVG Nation toolbar\vprot.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\Platform\McUICnt.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(McAfee, Inc.) C:\Program Files\McAfee\SiteAdvisor\saUI.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(Microsoft Corporation) C:\Windows\ehome\ehsched.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [6294048 2008-09-18] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1328424 2008-07-03] (Synaptics, Inc.)
HKLM\...\Run: [PDVD8LanguageShortcut] => C:\Program Files\HomeCinema\PowerDVD8\Language\Language.exe [50472 2007-12-14] ()
HKLM\...\Run: [BDRegion] => C:\Program Files\Cyberlink\Shared Files\brs.exe [75048 2008-10-07] (cyberlink)
HKLM\...\Run: [UCam_Menu] => C:\Program Files\HomeCinema\YouCam\MUITransfer\MUIStartMenu.exe [210216 2008-06-13] (CyberLink Corp.)
HKLM\...\Run: [PDFPrint] => C:\Program Files\PDF24\pdf24.exe [162856 2013-03-20] (Geek Software GmbH)
HKLM\...\Run: [vProt] => C:\Program Files\AVG Nation toolbar\vprot.exe [2403144 2013-11-11] ()
HKLM\...\Run: [mcpltui_exe] => C:\Program Files\McAfee.com\Agent\mcagent.exe [517392 2014-04-25] (McAfee, Inc.)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM\...\Run: [Skytel] => C:\Windows\Skytel.exe [1833504 2008-09-18] (Realtek Semiconductor Corp.)
HKLM\...\Run: [NvCplDaemon] => C:\Windows\system32\NvCpl.dll [13560352 2008-09-29] (NVIDIA Corporation)
HKLM\...\Run: [NvMediaCenter] => C:\Windows\system32\NvMcTray.dll [92704 2008-09-29] (NVIDIA Corporation)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2014-05-08] (Adobe Systems Incorporated)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [737872 2014-05-09] (Avira Operations GmbH & Co. KG)
HKLM\...\Policies\Explorer: [NoFolderOptions] 0
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKU\.DEFAULT\...\Run: [Picasa Media Detector] => C:\Program Files\Picasa2\PicasaMediaDetector.exe [443968 2008-08-21] (Google Inc.)
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-1682483986-195542428-201166501-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-21] (Microsoft Corporation)
HKU\S-1-5-21-1682483986-195542428-201166501-1000\...\Run: [iLivid] => "C:\Users\*****\AppData\Local\iLivid\iLivid.exe" -autorun
HKU\S-1-5-21-1682483986-195542428-201166501-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [21444224 2014-05-08] (Skype Technologies S.A.)
HKU\S-1-5-21-1682483986-195542428-201166501-1000\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-21] (Microsoft Corporation)
HKU\S-1-5-21-1682483986-195542428-201166501-1000\...\Run: [vrobws] => regsvr32.exe "
HKU\S-1-5-21-1682483986-195542428-201166501-1000\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\system32\Macromed\Flash\FlashUtil32_13_0_0_214_Plugin.exe [847536 2014-05-18] (Adobe Systems Incorporated)
HKU\S-1-5-21-1682483986-195542428-201166501-1000\...\MountPoints2: {cc4a75e7-1d5b-11e0-aad3-00222004a98f} - G:\LaunchU3.exe -a
AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL => C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll [123392 2010-09-11] (Google)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
BootExecute: autocheck autochk * sdnclean.exe
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com/
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com/
SearchScopes: HKLM - {EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&query={searchTerms}&invocationType=tb50winampie7
SearchScopes: HKCU - DefaultScope {FF752B98-5BF8-4DF0-AF47-8A47E8A4D343} URL = hxxp://de.search.yahoo.com/search?fr=mcafee&type=A011DE0&p={SearchTerms}
SearchScopes: HKCU - {70D46D94-BF1E-45ED-B567-48701376298E} URL = hxxp://127.0.0.1:4664/search&s=PNcnb855uUolfoHf8QtJxlXgXkY?q={searchTerms}
SearchScopes: HKCU - {EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&query={searchTerms}&invocationType=tb50winampie7
SearchScopes: HKCU - {FF752B98-5BF8-4DF0-AF47-8A47E8A4D343} URL = hxxp://de.search.yahoo.com/search?fr=mcafee&type=A011DE0&p={SearchTerms}
BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: No Name - {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - C:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)
Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - C:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} hxxp://www.photodose.de/ips-opdata/operator/69189345/objects/jordan.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation)
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\17.0.12\ViProtocol.dll (AVG Secure Search)
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - C:\Program Files\McAfee\MSC\McSnIePl.dll (McAfee, Inc.)
Winsock: Catalog5 05 C:\Program Files\Bonjour\mdnsNSP.dll [152864] (Apple Inc.)
Winsock: Catalog9 01 %SYSTEMROOT%\system32\nvLsp.dll [270336] (NVIDIA)
Winsock: Catalog9 02 %SYSTEMROOT%\system32\nvLsp.dll [270336] (NVIDIA)
Winsock: Catalog9 03 %SYSTEMROOT%\system32\nvLsp.dll [270336] (NVIDIA)
Winsock: Catalog9 04 %SYSTEMROOT%\system32\nvLsp.dll [270336] (NVIDIA)
Winsock: Catalog9 05 %SYSTEMROOT%\system32\nvLsp.dll [270336] (NVIDIA)
Winsock: Catalog9 06 %SYSTEMROOT%\system32\nvLsp.dll [270336] (NVIDIA)
Winsock: Catalog9 17 %SYSTEMROOT%\system32\nvLsp.dll [270336] (NVIDIA)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\0zx6jvlc.default
FF SearchEngineOrder.1: Sichere Suche
FF Homepage: hxxp://www.google.com/
FF Keyword.URL: hxxp://de.search.yahoo.com/search?fr=mcafee&type=A111DE0&p=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin: @google.com/npPicasa2,version=2.0.0 - C:\Program Files\Picasa2\npPicasa2.dll (Google, Inc.)
FF Plugin: @google.com/npPicasa3,version=3.0.0 - C:\Program Files\Picasa2\npPicasa3.dll (Google, Inc.)
FF Plugin: @innoplus.de/ino3DViewer - C:\Program Files\innoplus\3D-Viewer-innoPlus\npIno3DViewer.dll (INNOVA-engineering GmbH Dresden)
FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @mcafee.com/MSC,version=10 - c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.2 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\0zx6jvlc.default\user.js
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npwachk.dll (Nullsoft)
FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\0zx6jvlc.default\searchplugins\aol-search.xml
FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\0zx6jvlc.default\searchplugins\nation-secure-search.xml
FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\0zx6jvlc.default\searchplugins\winamp-search.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\McSiteAdvisor.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: 20-20 3D Viewer - IKEA - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\0zx6jvlc.default\Extensions\2020Player_IKEA@2020Technologies.com [2012-01-12]
FF Extension: DDBAC - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\0zx6jvlc.default\Extensions\{271A3CF5-5A54-447B-A08F-BE805F0DA60A} [2011-10-11]
FF Extension: McAfee SiteAdvisor - C:\Program Files\McAfee\SiteAdvisor [2013-11-14]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []
FF HKLM\...\Firefox\Extensions: [{ACAA314B-EEBA-48e4-AD47-84E31C44796C}] - C:\Program Files\Common Files\DVDVideoSoft\plugins\ff\
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Program Files\Common Files\DVDVideoSoft\plugins\ff\ []
FF HKLM\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files\McAfee\SiteAdvisor
FF Extension: McAfee SiteAdvisor - C:\Program Files\McAfee\SiteAdvisor [2013-11-14]
FF HKLM\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF Extension: McAfee Anti-Spam Thunderbird Extension - C:\Program Files\McAfee\MSK [2013-11-14]
FF HKCU\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
Chrome:
=======
CHR HomePage: hxxp://www.google.com
CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files\McAfee\SiteAdvisor\McChPlg.crx [2013-11-14]
CHR HKLM\...\Chrome\Extension: [ndibdjnfmopecpmkdieinmbadjfpblof] - C:\ProgramData\\ChromeExt\\avg.crx [2013-11-14]
========================== Services (Whitelisted) =================
S2 0099511403087631mcinstcleanup; C:\Windows\TEMP\009951~1.EXE [827456 2012-01-09] (McAfee, Inc.)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-05-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-05-09] (Avira Operations GmbH & Co. KG)
R2 ForceWare Intelligent Application Manager (IAM); C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe [450560 2008-09-08] () [File not signed]
S3 GoogleDesktopManager-051210-111108; C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [30192 2010-09-11] (Google)
R2 HomeNetSvc; C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe [281560 2013-07-30] (McAfee, Inc.)
R2 LxrSII1s; C:\Windows\system32\LxrSII1s.exe [65536 2009-12-30] (Lexar Media, Inc.) [File not signed]
R2 McAfee SiteAdvisor Service; C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe [281560 2013-07-30] (McAfee, Inc.)
R2 McAPExe; C:\Program Files\McAfee\MSC\McAPExe.exe [145568 2014-04-25] (McAfee, Inc.)
S3 McAWFwk; C:\Program Files\Common Files\McAfee\ActWiz\McAWFwk.exe [287728 2013-04-09] (McAfee, Inc.)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [235696 2014-04-09] (McAfee, Inc.)
R2 McMPFSvc; C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe [281560 2013-07-30] (McAfee, Inc.)
R2 McNaiAnn; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [281560 2013-07-30] (McAfee, Inc.)
S3 McODS; C:\Program Files\McAfee\VirusScan\mcods.exe [471592 2013-08-02] (McAfee, Inc.)
S4 McOobeSv2; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [281560 2013-07-30] (McAfee, Inc.)
R2 mcpltsvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [281560 2013-07-30] (McAfee, Inc.)
R2 McProxy; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [281560 2013-07-30] (McAfee, Inc.)
R2 MDM; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [335872 2006-10-26] (Microsoft Corporation) [File not signed]
R2 mfecore; C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe [644088 2014-01-21] (McAfee, Inc.)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [169800 2014-03-17] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [175480 2014-03-17] (McAfee, Inc.)
R2 MSK80Service; C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe [281560 2013-07-30] (McAfee, Inc.)
R2 nSvcIp; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe [184320 2008-09-08] () [File not signed]
R2 PLFlash DeviceIoControl Service; C:\Windows\system32\IoctlSvc.exe [81920 2006-12-19] (Prolific Technology Inc.) [File not signed]
R2 ProtexisLicensing; C:\Windows\system32\PSIService.exe [177704 2007-06-05] ()
R2 RichVideo; C:\Program Files\Cyberlink\Shared files\RichVideo.exe [241734 2008-06-28] () [File not signed]
R2 TGCM_ImportWiFiSvc; C:\Program Files\o2\Mobile Connection Manager\ImpWiFiSvc.exe [201344 2012-01-10] (Telefónica)
S3 usnjsvc; C:\Program Files\Windows Live\Messenger\usnsvc.exe [98328 2007-10-18] (Microsoft Corporation)
R2 vToolbarUpdater17.0.12; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\17.0.12\ToolbarUpdater.exe [1733448 2013-11-11] (AVG Secure Search)
S3 WLSetupSvc; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [266240 2007-10-25] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [93528 2014-05-09] (Avira Operations GmbH & Co. KG)
R1 avgtp; C:\Windows\system32\drivers\avgtpx86.sys [37664 2013-11-11] (AVG Technologies)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-05-09] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2014-05-09] (Avira Operations GmbH & Co. KG)
R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [61400 2014-03-17] (McAfee, Inc.)
S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [147912 2013-09-23] (McAfee, Inc.)
R2 LxrSII1d; C:\Windows\System32\Drivers\LxrSII1d.sys [63448 2009-12-30] (Lexar Media, Inc.)
S3 massfilter; C:\Windows\System32\drivers\massfilter.sys [9216 2010-11-26] (MBB Incorporated)
S3 massfilter_hs; C:\Windows\System32\drivers\massfilter_hs.sys [9728 2010-10-15] (ZTE Incorporated)
R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [134600 2014-03-17] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [236480 2014-03-17] (McAfee, Inc.)
S3 mfebopk; C:\Windows\System32\drivers\mfebopk.sys [66408 2014-03-17] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [367776 2014-03-17] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [573968 2014-03-17] (McAfee, Inc.)
R3 mfencbdc; C:\Windows\System32\DRIVERS\mfencbdc.sys [330248 2014-01-21] (McAfee, Inc.)
S3 mfencrk; C:\Windows\System32\DRIVERS\mfencrk.sys [81264 2014-01-21] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [214856 2014-03-17] (McAfee, Inc.)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2014-05-09] (Avira GmbH)
S3 XUIF; C:\Windows\System32\Drivers\x10ufx2.sys [27416 2006-11-30] (X10 Wireless Technology, Inc.)
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796}; C:\Program Files\HomeCinema\PlayMovie\000.fcl [61424 2008-10-21] (Cyberlink Corp.)
R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}; C:\Program Files\HomeCinema\PowerDVD8\000.fcl [61424 2008-10-07] (Cyberlink Corp.)
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 USBAAPL; System32\Drivers\usbaapl.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-06-18 13:57 - 2014-06-18 13:57 - 00024152 _____ () C:\Users\*****\Desktop\FRST.txt
2014-06-18 13:56 - 2014-06-18 13:57 - 00000000 ____D () C:\FRST
2014-06-18 13:55 - 2014-06-18 13:55 - 01072640 _____ (Farbar) C:\Users\*****\Desktop\FRST.exe
2014-06-18 13:48 - 2014-06-18 13:48 - 00000476 _____ () C:\Users\*****\Desktop\defogger_disable.log
2014-06-18 13:48 - 2014-06-18 13:48 - 00000000 _____ () C:\Users\*****\defogger_reenable
2014-06-18 13:46 - 2014-06-18 13:47 - 00050477 _____ () C:\Users\*****\Desktop\Defogger.exe
2014-06-18 11:30 - 2014-06-18 11:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
2014-06-17 11:05 - 2014-06-17 11:21 - 00000000 ____D () C:\Users\*****\CKR Stammbaum
2014-06-11 13:46 - 2014-05-06 06:46 - 03630592 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-06-11 13:46 - 2014-05-06 06:46 - 01177600 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-06-11 13:46 - 2014-05-06 06:46 - 00834048 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-06-11 13:46 - 2014-05-06 06:46 - 00671744 _____ (Microsoft Corporation) C:\Windows\system32\mstime.dll
2014-06-11 13:46 - 2014-05-06 06:46 - 00498688 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-06-11 13:46 - 2014-05-06 06:46 - 00480256 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-06-11 13:46 - 2014-05-06 06:46 - 00106496 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-06-11 13:46 - 2014-05-06 06:45 - 06119424 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-06-11 13:46 - 2014-05-06 06:45 - 00380928 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-06-11 13:46 - 2014-05-06 06:45 - 00271872 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-06-11 13:46 - 2014-05-06 06:45 - 00193024 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2014-06-11 13:46 - 2014-05-06 06:45 - 00180736 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-06-11 13:46 - 2014-05-06 06:45 - 00027648 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-06-11 13:46 - 2014-05-06 06:45 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\corpol.dll
2014-06-11 13:46 - 2014-05-06 05:16 - 00389632 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2014-06-11 13:46 - 2014-05-06 05:07 - 01383424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-06-11 13:46 - 2014-04-26 18:01 - 00502784 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2014-06-11 13:46 - 2014-04-05 04:42 - 00905664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-06-11 13:46 - 2014-03-10 03:22 - 01401344 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-06-11 13:46 - 2014-03-10 03:22 - 01248768 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-06-11 13:33 - 2014-06-11 13:33 - 00001883 _____ () C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2014-06-11 13:33 - 2014-06-11 13:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
2014-06-11 13:33 - 2014-06-11 13:33 - 00000000 ____D () C:\Program Files\McAfee Security Scan
2014-05-25 23:35 - 2014-05-25 23:35 - 00000000 ____D () C:\Users\*****\AntiVir Text
2014-05-25 20:01 - 2014-05-25 20:01 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Avira
2014-05-25 19:58 - 2014-05-25 19:58 - 00001811 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-05-25 19:58 - 2014-05-25 19:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-05-25 19:57 - 2014-05-25 19:57 - 00000000 ____D () C:\ProgramData\Avira
2014-05-25 19:57 - 2014-05-25 19:57 - 00000000 ____D () C:\Program Files\Avira
2014-05-25 19:57 - 2014-05-09 11:16 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-05-25 19:57 - 2014-05-09 11:16 - 00093528 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-05-25 19:57 - 2014-05-09 11:16 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2014-05-25 19:57 - 2014-05-09 11:16 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
2014-05-25 19:47 - 2014-05-25 19:50 - 137314600 _____ () C:\Users\*****\Downloads\avira_free_antivirus_de_642.exe
2014-05-24 23:54 - 2014-05-25 19:35 - 00000741 _____ () C:\Windows\wininit.ini
2014-05-24 14:36 - 2014-05-25 19:37 - 00000000 ____D () C:\Program Files\Spybot - Search & Destroy 2
2014-05-24 14:36 - 2014-05-25 19:35 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
==================== One Month Modified Files and Folders =======
2014-06-18 13:57 - 2014-06-18 13:57 - 00024152 _____ () C:\Users\*****\Desktop\FRST.txt
2014-06-18 13:57 - 2014-06-18 13:56 - 00000000 ____D () C:\FRST
2014-06-18 13:57 - 2009-08-08 18:37 - 00000000 ____D () C:\Users\*****\AppData\Local\Temp
2014-06-18 13:55 - 2014-06-18 13:55 - 01072640 _____ (Farbar) C:\Users\*****\Desktop\FRST.exe
2014-06-18 13:55 - 2014-05-18 11:41 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-06-18 13:54 - 2006-11-02 14:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-18 13:54 - 2006-11-02 14:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-18 13:51 - 2009-02-05 16:40 - 00042749 _____ () C:\ProgramData\nvModes.001
2014-06-18 13:48 - 2014-06-18 13:48 - 00000476 _____ () C:\Users\*****\Desktop\defogger_disable.log
2014-06-18 13:48 - 2014-06-18 13:48 - 00000000 _____ () C:\Users\*****\defogger_reenable
2014-06-18 13:47 - 2014-06-18 13:46 - 00050477 _____ () C:\Users\*****\Desktop\Defogger.exe
2014-06-18 13:10 - 2009-08-08 19:17 - 00002591 _____ () C:\Users\*****\Desktop\Microsoft Office Word 2007.lnk
2014-06-18 12:50 - 2014-05-12 13:09 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-06-18 12:37 - 2009-08-08 18:31 - 01491849 _____ () C:\Windows\WindowsUpdate.log
2014-06-18 12:32 - 2013-11-14 16:25 - 00000000 ____D () C:\Program Files\McAfee
2014-06-18 12:31 - 2011-10-26 13:44 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Skype
2014-06-18 11:30 - 2014-06-18 11:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
2014-06-18 11:28 - 2011-05-03 12:38 - 00000422 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{EE06053A-1882-4935-9827-74EA8F2D0780}.job
2014-06-18 11:25 - 2009-08-08 18:37 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Home Cinema
2014-06-18 11:25 - 2009-02-05 16:40 - 00042749 _____ () C:\ProgramData\nvModes.dat
2014-06-18 11:23 - 2006-11-02 15:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-17 21:44 - 2006-11-02 15:01 - 00032514 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-06-17 13:07 - 2006-11-02 12:33 - 01565124 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-17 12:38 - 2011-08-12 11:45 - 00000000 ____D () C:\Users\*****\Streamripper
2014-06-17 12:36 - 2011-08-16 13:13 - 00000000 ____D () C:\Users\*****\Games
2014-06-17 12:35 - 2012-12-27 14:07 - 00000000 ____D () C:\Users\*****\Johanna
2014-06-17 12:35 - 2009-08-20 22:38 - 00000000 ____D () C:\Users\*****\Hörbücher
2014-06-17 12:33 - 2009-08-20 22:30 - 00000000 ____D () C:\Users\*****\Katja
2014-06-17 11:36 - 2009-12-20 17:38 - 00000000 ____D () C:\Users\*****\Desktop\Audiograbber MP3
2014-06-17 11:21 - 2014-06-17 11:05 - 00000000 ____D () C:\Users\*****\CKR Stammbaum
2014-06-17 11:18 - 2009-08-20 22:19 - 00000000 ____D () C:\Users\*****\Fotos
2014-06-17 11:16 - 2009-11-23 00:25 - 00000000 ____D () C:\Users\*****\AppData\Roaming\vlc
2014-06-17 11:07 - 2009-08-20 20:55 - 00020480 _____ () C:\Users\*****\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-06-17 10:56 - 2010-01-16 12:51 - 00000000 ____D () C:\Users\*****\Shared Folder
2014-06-16 13:29 - 2013-12-16 22:26 - 00000000 ____D () C:\Users\*****\Anna_Film
2014-06-16 12:56 - 2009-08-20 23:01 - 00000000 ____D () C:\Users\*****\Motive
2014-06-15 11:40 - 2009-02-06 12:45 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-06-15 11:36 - 2013-12-16 20:07 - 00000000 ____D () C:\Windows\system32\MRT
2014-06-15 11:33 - 2006-11-02 12:24 - 92708840 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-06-11 19:05 - 2006-11-02 14:37 - 00000000 ___RD () C:\Users\Public\Recorded TV
2014-06-11 13:33 - 2014-06-11 13:33 - 00001883 _____ () C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2014-06-11 13:33 - 2014-06-11 13:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
2014-06-11 13:33 - 2014-06-11 13:33 - 00000000 ____D () C:\Program Files\McAfee Security Scan
2014-06-11 13:33 - 2012-06-03 17:48 - 00000000 ____D () C:\ProgramData\McAfee Security Scan
2014-05-30 14:50 - 2008-01-21 04:47 - 00608998 _____ () C:\Windows\PFRO.log
2014-05-25 23:35 - 2014-05-25 23:35 - 00000000 ____D () C:\Users\*****\AntiVir Text
2014-05-25 20:01 - 2014-05-25 20:01 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Avira
2014-05-25 19:58 - 2014-05-25 19:58 - 00001811 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-05-25 19:58 - 2014-05-25 19:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-05-25 19:57 - 2014-05-25 19:57 - 00000000 ____D () C:\ProgramData\Avira
2014-05-25 19:57 - 2014-05-25 19:57 - 00000000 ____D () C:\Program Files\Avira
2014-05-25 19:50 - 2014-05-25 19:47 - 137314600 _____ () C:\Users\*****\Downloads\avira_free_antivirus_de_642.exe
2014-05-25 19:37 - 2014-05-24 14:36 - 00000000 ____D () C:\Program Files\Spybot - Search & Destroy 2
2014-05-25 19:35 - 2014-05-24 23:54 - 00000741 _____ () C:\Windows\wininit.ini
2014-05-25 19:35 - 2014-05-24 14:36 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-05-19 16:52 - 2013-02-08 19:08 - 00000000 ____D () C:\Users\*****\Recht
Some content of TEMP:
====================
C:\Users\*****\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-06-18 11:31
==================== End Of Log ============================
Additional scan result of Farbar Recovery Scan Tool (x86) Version:16-06-2014
Ran by ***** at 2014-06-18 13:58:13
Running from C:\Users\*****\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: McAfee Anti-Virus und Anti-Spyware (Enabled - Up to date) {ADA629C7-7F48-5689-624A-3B76997E0892}
AS: McAfee Anti-Virus und Anti-Spyware (Enabled - Up to date) {16C7C823-5972-5907-58FA-0004E2F9422F}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: McAfee Firewall (Enabled) {959DA8E2-3527-57D1-4915-924367AD4FE9}
==================== Installed Programs ======================
Update for Microsoft Office 2007 (KB2508958) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version: - Microsoft)
Update for Microsoft Office 2007 (KB2508958) (HKLM\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version: - Microsoft)
3D-Viewer-innoplus (HKLM\...\{B96DB037-DBEA-4186-9081-9CBD537F82E8}) (Version: 13.01.16 - INNOVA-engineering GmbH)
Activation Assistant for the 2007 Microsoft Office suites (HKLM\...\Activation Assistant for the 2007 Microsoft Office suites) (Version: - Microsoft Corporation)
Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0 - Microsoft Corporation) Hidden
Adobe Flash Player 13 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.07) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)
Adobe Shockwave Player 11 (HKLM\...\Adobe Shockwave Player) (Version: 11 - Adobe Systems, Inc.)
Apple Software Update (HKLM\...\{6956856F-B6B3-4BE0-BA0B-8F495BE32033}) (Version: 2.1.1.116 - Apple Inc.)
Atheros Client Installation Program (HKLM\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 7.0 - Atheros)
Audacity 1.2.6 (HKLM\...\Audacity_is1) (Version: - )
Audiograbber 1.83 SE (HKLM\...\Audiograbber) (Version: 1.83 SE - Audiograbber Deutschland)
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.4.672 - Avira)
Bonjour (HKLM\...\{2A981294-F14C-4F0F-9627-D793270922F8}) (Version: 2.0.4.0 - Apple Inc.)
Cisco EAP-FAST Module (HKLM\...\{415B2719-AD3A-4944-B404-C472DB6085B3}) (Version: 2.1.6 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM\...\{83770D14-21B9-44B3-8689-F7B523F94560}) (Version: 1.0.12 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM\...\{669C7BD8-DAA2-49B6-966C-F1E2AAE6B17E}) (Version: 1.0.13 - Cisco Systems, Inc.)
Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Corel MediaOne (HKLM\...\{A062A15F-9CAC-4B88-98DF-87628A0BD721}) (Version: 2.00.0000 - Corel Corporation)
CorelDRAW Essential Edition 3 (HKLM\...\_{ADDBE07D-95B8-4789-9C76-187FFF9624B4}) (Version: - Corel Corporation)
CorelDRAW Essential Edition 3 (Version: 3.0 - Corel Corporation) Hidden
CyberLink MediaShow (HKLM\...\InstallShield_{80E158EA-7181-40FE-A701-301CE6BE64AB}) (Version: 4.1.2019 - CyberLink Corp.)
CyberLink MediaShow (Version: 4.1.2019 - CyberLink Corp.) Hidden
CyberLink PhotoNow (HKLM\...\InstallShield_{D36DD326-7280-11D8-97C8-000129760CBE}) (Version: 1.1.5615 - CyberLink Corp.)
CyberLink PhotoNow (Version: 1.1.5615 - CyberLink Corp.) Hidden
CyberLink PowerDirector (HKLM\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 7.0.2209a - CyberLink Corp.)
CyberLink PowerDirector (Version: 7.0.2209a - CyberLink Corp.) Hidden
CyberLink PowerDVD 8 (HKLM\...\InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}) (Version: 8.0.2217 - CyberLink Corp.)
CyberLink PowerDVD 8 (Version: 8.0.2217 - CyberLink Corp.) Hidden
CyberLink PowerProducer (HKLM\...\InstallShield_{B7A0CE06-068E-11D6-97FD-0050BACBF861}) (Version: 5.1013 - CyberLink Corp.)
CyberLink PowerProducer (Version: 5.1013 - CyberLink Corp.) Hidden
CyberLink YouCam (HKLM\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 2.0.1916 - CyberLink Corp.)
CyberLink YouCam (Version: 2.0.1916 - CyberLink Corp.) Hidden
DDBAC (HKLM\...\{12E50555-348C-4416-91E2-2BB99499554E}) (Version: 4.3.62 - DataDesign)
DE (Version: 3.0 - Corel Corporation) Hidden
Dolby Control Center (HKLM\...\{70E8EBD5-78C9-4258-B20A-5098CCA000F0}) (Version: 1.1.0601 - Dolby)
ElsterFormular (HKLM\...\ElsterFormular 13.1.1.8531p) (Version: 14.1.11318 - Landesfinanzdirektion Thüringen)
Free DVD MP3 Ripper 1.12 (HKLM\...\Free DVD MP3 Ripper_is1) (Version: - Jodix Technologies Ltd.)
Free MP4 Video Converter version 5.0.32.1230 (HKLM\...\Free MP4 Video Converter_is1) (Version: 5.0.32.1230 - DVDVideoSoft Ltd.)
Free PDF to Word Doc Converter v1.1 (HKLM\...\Free PDF to Word Doc Converter_is1) (Version: 1.1 - www.hellopdf.com)
Free WebM Video Converter version 5.0.32.1230 (HKLM\...\Free WebM Video Converter_is1) (Version: 5.0.32.1230 - DVDVideoSoft Ltd.)
Free YouTube to MP3 Converter version 3.12.29.304 (HKLM\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.29.304 - DVDVideoSoft Ltd.)
Gabriel Knight 3 (HKLM\...\Gabriel Knight 3) (Version: - )
Google Desktop (HKLM\...\Google Desktop) (Version: 5.9.1005.12335 - Google)
Google Earth (HKLM\...\{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}) (Version: 4.3.7284.3916 - Google)
Java 7 Update 55 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.550 - Oracle)
Java Auto Updater (Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Java(TM) 6 Update 11 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83216011FF}) (Version: 6.0.110 - Sun Microsystems, Inc.)
McAfee Internet Security (HKLM\...\MSC) (Version: 12.8.957 - McAfee, Inc.)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version: - Microsoft Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (Version: - Microsoft) Hidden
Microsoft Office Access MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Enterprise 2007 (HKLM\...\ENTERPRISER) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Groove MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Home and Student 2007 (HKLM\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint Viewer 2007 (German) (HKLM\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (Version: - Microsoft) Hidden
Microsoft Office Publisher MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [DEU] (HKLM\...\{BAC80EF3-E106-4AEA-8C57-F217F9BC7358}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Works (HKLM\...\{39D0E034-1042-4905-BECB-5502909FCB7C}) (Version: 9.7.0621 - Microsoft Corporation)
Mobile Connection Manager (HKLM\...\o2DE) (Version: 8.8.7.892 - Mobile Connection Manager)
Mozilla Firefox 29.0.1 (x86 de) (HKLM\...\Mozilla Firefox 29.0.1 (x86 de)) (Version: 29.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSXML 4.0 SP2 (KB936181) (HKLM\...\{C04E32E0-0416-434D-AFB9-6969D703A9EF}) (Version: 4.20.9848.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB941833) (HKLM\...\{C523D256-313D-4866-B36A-F3DE528246EF}) (Version: 4.20.9849.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Nero 8 Essentials (HKLM\...\{47948554-90C6-4AAC-8CFA-D23CE11C1031}) (Version: 8.3.124 - Nero AG)
neroxml (Version: 1.0.0 - Nero AG) Hidden
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: - )
NVIDIA ForceWare Network Access Manager (HKLM\...\InstallShield_{7CFA46E3-CC2F-4355-82AE-6012DC3633FD}) (Version: 1.00.6793 - NVIDIA Corporation)
NVIDIA ForceWare Network Access Manager (Version: 1.00.6793 - NVIDIA Corporation) Hidden
PDF24 Creator 5.4.0 (HKLM\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org)
pdfsam (HKCU\...\pdfsam) (Version: 2.2.1 - )
Picasa 3 (HKLM\...\Picasa 3) (Version: 3.8 - Google, Inc.)
Play Movie (HKLM\...\{A450831D-25F6-4F42-9662-D000B25E0D82}) (Version: 1.5.4621.0 - CyberLink Corp.)
QuickTime (HKLM\...\{57752979-A1C9-4C02-856B-FBB27AC4E02C}) (Version: 7.69.80.9 - Apple Inc.)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5704 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM\...\{DC24971E-1946-445D-8A82-CE685433FA7D}) (Version: 3.0.1.3 - Realtek Semiconductor Corp.)
Revo Uninstaller 1.95 (HKLM\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Skype™ 6.16 (HKLM\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.16.105 - Skype Technologies S.A.)
SoulSeek 157 NS 13e (HKLM\...\Soulseek2) (Version: - )
Streamripper (Remove only) (HKLM\...\Streamripper) (Version: - )
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 11.1.21.0 - Synaptics)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (HKLM\...\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707) (Version: 1 - Microsoft Corporation)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version: - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISER_{EA54F104-79D2-48CC-9ABC-91A63C43D353}) (Version: - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition (HKLM\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{53DEC068-4690-4F6B-9946-7D21EF02236B}) (Version: - Microsoft)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2881065) 32-Bit Edition (HKLM\...\{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{B7EF38F7-1D58-4085-A9A4-0F6C69A5AA1E}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISER_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISER_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISER_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISER_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
Update Manager (Version: 4.60 - Corel Corporation) Hidden
Visual Studio 2012 x86 Redistributables (HKLM\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player 2.1.3 (HKLM\...\VLC media player) (Version: 2.1.3 - VideoLAN)
Winamp (HKLM\...\Winamp) (Version: 5.57 - Nullsoft, Inc)
Winamp Anwendungserkennung (HKCU\...\Winamp Detect) (Version: 1.0.0.1 - Nullsoft, Inc)
Windows Live Anmelde-Assistent (HKLM\...\{83E2CFA9-E0EB-4E08-9F85-43E577FF3D60}) (Version: 5.000.818.6 - Microsoft Corporation)
Windows Live Fotogalerie (HKLM\...\{A1D08B90-AE1A-4885-AC29-731496FD397E}) (Version: 12.0.1347.0718 - Microsoft Corporation)
Windows Live installer (HKLM\...\{7A7B0BF3-2F00-4F03-8A9B-6ABCC07B90C6}) (Version: 12.0.1471.1025 - Microsoft Corporation)
Windows Live Mail (HKLM\...\{82F2B38B-1426-443D-874C-AC25675E7BEB}) (Version: 12.0.1606.1023 - Microsoft Corporation)
Windows Live Messenger (HKLM\...\{2B091530-69AA-442E-AB09-39ED06B58220}) (Version: 8.5.1302.1018 - Microsoft Corporation)
Windows Live Writer (HKLM\...\{B8D42C3A-3CFF-4A8A-A7DA-4F44474D12C5}) (Version: 12.0.1370.0325 - Microsoft Corporation)
ZTE USB Driver (HKLM\...\ZTE USB Driver) (Version: 1.0.1.31_TME - ZTE Corporation)
==================== Restore Points =========================
07-05-2014 14:40:27 Windows Update
08-05-2014 09:52:45 Geplanter Prüfpunkt
14-05-2014 17:18:37 Geplanter Prüfpunkt
15-05-2014 10:11:09 Windows Update
18-05-2014 09:35:22 McAfee Vulnerability Scanner
24-05-2014 15:55:03 Geplanter Prüfpunkt
25-05-2014 12:33:25 Geplanter Prüfpunkt
25-05-2014 16:59:31 Revo Uninstaller's restore point - Spybot - Search & Destroy
03-06-2014 14:47:46 Geplanter Prüfpunkt
04-06-2014 16:15:17 Geplanter Prüfpunkt
15-06-2014 09:19:22 Windows Update
17-06-2014 09:52:56 Revo Uninstaller's restore point - iTunes
17-06-2014 10:09:08 Revo Uninstaller's restore point - Apple Application Support
17-06-2014 10:12:37 Revo Uninstaller's restore point - Apple Mobile Device Support
17-06-2014 10:15:28 Revo Uninstaller's restore point - Apple Software Update
18-06-2014 10:11:18 Geplanter Prüfpunkt
==================== Hosts content: ==========================
2006-11-02 12:23 - 2006-09-18 23:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
::1 localhost
==================== Scheduled Tasks (whitelisted) =============
Task: {0D98BB46-DE59-4CF5-9EAD-090B4AB1A44E} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe
Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {320124A7-D70F-41DE-A9D1-D5E8E19D5D91} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-21] (Microsoft Corporation)
Task: {699F0157-CC18-4CDA-8B8C-473921AFE35C} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-18] (Adobe Systems Incorporated)
Task: {752475B2-24B2-4A61-BAFD-DB32C0FD0D10} - System32\Tasks\{5A86DBB4-A0B3-45A5-87BA-4871FD1A64CF} => Firefox.exe hxxp://ui.skype.com/ui/0/5.5.0.124.259/de/eula?source=lightinstaller
Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-21] ()
Task: {F0D8B757-1F7B-488B-BA2D-84CD9210505F} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2006-11-02] (Microsoft Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\User_Feed_Synchronization-{EE06053A-1882-4935-9827-74EA8F2D0780}.job => C:\Windows\system32\msfeedssync.exe
==================== Loaded Modules (whitelisted) =============
2007-06-05 14:20 - 2007-06-05 14:20 - 00177704 _____ () C:\Windows\system32\PSIService.exe
2009-02-06 14:24 - 2008-06-28 02:00 - 00241734 _____ () C:\Program Files\Cyberlink\Shared files\RichVideo.exe
2008-09-08 12:10 - 2008-09-08 12:10 - 00450560 _____ () C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
2008-09-08 11:57 - 2008-09-08 11:57 - 00102400 _____ () C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nv_common.dll
2008-09-08 12:09 - 2008-09-08 12:09 - 00184320 _____ () C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
2013-11-11 11:33 - 2013-11-11 11:32 - 00158536 _____ () C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\17.0.12\loggingserver.exe
2013-11-11 11:33 - 2013-11-11 11:32 - 00518472 _____ () C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\17.0.12\log4cplusU.dll
2013-11-11 11:33 - 2013-11-11 11:32 - 02403144 _____ () C:\Program Files\AVG Nation toolbar\vprot.exe
2013-11-11 11:33 - 2013-11-11 11:32 - 00141128 _____ () C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\17.0.12\SiteSafety.dll
2014-05-12 13:09 - 2014-05-12 13:10 - 03839088 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefire => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfevtp => ""="Driver"
==================== EXE Association (whitelisted) =============
==================== MSCONFIG/TASK MANAGER disabled items =========
MSCONFIG\startupreg: Google Desktop Search => "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
MSCONFIG\startupreg: Google EULA Launcher => C:\Program Files\Google\Google EULA\GoogleEULALauncher.exe GE
MSCONFIG\startupreg: IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} => "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: NvMediaCenter => RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
MSCONFIG\startupreg: PlayMovie => "C:\Program Files\HomeCinema\PlayMovie\PMVService.exe"
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: swg => "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
MSCONFIG\startupreg: vrobws => regsvr32.exe "C:\ProgramData\vrobws.dat"
MSCONFIG\startupreg: vsxsgza => regsvr32.exe "C:\ProgramData\vsxsgza.dat"
MSCONFIG\startupreg: WinampAgent => "C:\Program Files\Winamp\winampa.exe"
==================== Faulty Device Manager Devices =============
Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft Tun-Miniportadapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunmp
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (06/18/2014 11:25:15 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (06/17/2014 00:17:17 PM) (Source: MsiInstaller) (EventID: 11721) (User: *****-PC)
Description: Produkt: Apple Software Update -- Fehler 1721. Es liegt ein dieses Windows Installer-Paket betreffendes Problem vor. Ein für den Abschluss der Installation erforderliches Programm konnte nicht ausgeführt werden. Wenden Sie sich an das Supportpersonal oder den Hersteller des Pakets. Aktion: SoftwareUpdate_UnregServer, Pfad: C:\Program Files\Apple Software Update\SoftwareUpdate.exe, Befehl: /UnregServer
Error: (06/17/2014 00:15:28 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.
Vorgang:
Generatordaten werden gesammelt
Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {06e1e5f4-2cc1-4804-863a-92effc8e85df}
Error: (06/17/2014 00:12:37 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.
Vorgang:
Generatordaten werden gesammelt
Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {06e1e5f4-2cc1-4804-863a-92effc8e85df}
Error: (06/17/2014 00:08:59 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.
Vorgang:
Generatordaten werden gesammelt
Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {06e1e5f4-2cc1-4804-863a-92effc8e85df}
Error: (06/17/2014 11:59:30 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (06/17/2014 11:52:45 AM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.
Vorgang:
Generatordaten werden gesammelt
Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {0cd31f1a-a1e3-4faa-8270-c4c8b87c0fc8}
Error: (06/17/2014 11:32:02 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\*****\DESKTOP\AUDIOGRABBER MP3\TEMP.MP3> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (06/17/2014 10:25:03 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (06/16/2014 11:39:27 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (06/18/2014 11:28:47 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {209500FC-6B45-4693-8871-6296C4843751}
Error: (06/18/2014 11:25:16 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Parallel port driver%%1058
Error: (06/17/2014 00:13:29 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Apple Mobile Device1600001Neustart des Diensts
Error: (06/17/2014 00:03:05 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {209500FC-6B45-4693-8871-6296C4843751}
Error: (06/17/2014 11:59:30 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Parallel port driver%%1058
Error: (06/17/2014 10:25:03 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Parallel port driver%%1058
Error: (06/16/2014 11:43:07 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {209500FC-6B45-4693-8871-6296C4843751}
Error: (06/16/2014 11:39:27 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Parallel port driver%%1058
Error: (06/15/2014 11:40:45 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Windows Search%%1053
Error: (06/15/2014 11:40:45 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: 30000Windows Search
Microsoft Office Sessions:
=========================
Error: (06/06/2012 07:18:42 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6661.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 18549 seconds with 1560 seconds of active time. This session ended with a crash.
CodeIntegrity Errors:
===================================
Date: 2014-04-25 11:59:29.834
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-04-25 11:59:29.661
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-04-25 11:59:29.491
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-04-25 11:59:29.320
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-04-25 11:59:29.133
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-02-07 17:35:00.216
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-02-07 17:34:59.998
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-02-07 17:34:59.811
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-02-07 17:34:59.608
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\tcpip.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-11-14 16:52:52.793
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\AVG\AVG2014\Drivers\avgidshx.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Percentage of memory in use: 63%
Total physical RAM: 2301.44 MB
Available physical RAM: 833.81 MB
Total Pagefile: 4827.83 MB
Available Pagefile: 2732.66 MB
Total Virtual: 2047.88 MB
Available Virtual: 1908.61 MB
==================== Drives ================================
Drive c: (BOOT) (Fixed) (Total:282.27 GB) (Free:114.25 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (RECOVER) (Fixed) (Total:15.81 GB) (Free:4.09 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 298 GB) (Disk ID: 8161DCF1)
Partition 1: (Active) - (Size=282 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=16 GB) - (Type=0C)
==================== End Of Log ============================
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit quick scan 2014-06-18 14:36:47
Windows 6.0.6002 Service Pack 2 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 WDC_WD3200BEVT-22ZCT0 rev.11.01A11 298,09GB
Running: Gmer-19357.exe; Driver: C:\Users\Tietjen\AppData\Local\Temp\kxdirfow.sys
---- Devices - GMER 2.1 ----
Device Ntfs.sys
Device fastfat.SYS
AttachedDevice fltmgr.sys
AttachedDevice \Driver\tdx \Device\Tcp mfewfpk.sys
AttachedDevice \Driver\tdx \Device\Udp mfewfpk.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys
---- EOF - GMER 2.1 ----
AVSCAN-20140525-210027-04C8C3FE
Avira Free Antivirus
Erstellungsdatum der Reportdatei: Sonntag, 25. Mai 2014 21:00
Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.
Lizenznehmer : Avira Antivirus Free
Seriennummer : 0000149996-AVHOE-0000001
Plattform : Windows Vista (TM) Home Premium
Windowsversion : (Service Pack 2) [6.0.6002]
Boot Modus : Normal gebootet
Benutzername : SYSTEM
Computername : *****-PC
Versionsinformationen:
BUILD.DAT : 14.0.4.642 57086 Bytes 09.05.2014 11:16:00
AVSCAN.EXE : 14.0.4.632 1030736 Bytes 09.05.2014 09:16:43
AVSCANRC.DLL : 14.0.4.620 62032 Bytes 09.05.2014 09:16:43
LUKE.DLL : 14.0.4.620 57936 Bytes 09.05.2014 09:16:56
AVSCPLR.DLL : 14.0.4.620 89680 Bytes 09.05.2014 09:16:43
AVREG.DLL : 14.0.4.632 261200 Bytes 09.05.2014 09:16:43
avlode.dll : 14.0.4.638 583760 Bytes 09.05.2014 09:16:43
avlode.rdf : 14.0.4.22 64276 Bytes 25.05.2014 18:13:22
VBASE000.VDF : 7.11.70.0 66736640 Bytes 04.04.2013 09:16:59
VBASE001.VDF : 7.11.74.226 2201600 Bytes 30.04.2013 09:16:59
VBASE002.VDF : 7.11.80.60 2751488 Bytes 28.05.2013 09:16:59
VBASE003.VDF : 7.11.85.214 2162688 Bytes 21.06.2013 09:16:59
VBASE004.VDF : 7.11.91.176 3903488 Bytes 23.07.2013 09:16:59
VBASE005.VDF : 7.11.98.186 6822912 Bytes 29.08.2013 09:16:59
VBASE006.VDF : 7.11.139.38 15708672 Bytes 27.03.2014 09:16:59
VBASE007.VDF : 7.11.145.136 2117120 Bytes 28.04.2014 09:16:59
VBASE008.VDF : 7.11.145.137 2048 Bytes 28.04.2014 09:16:59
VBASE009.VDF : 7.11.145.138 2048 Bytes 28.04.2014 09:16:59
VBASE010.VDF : 7.11.145.139 2048 Bytes 28.04.2014 09:16:59
VBASE011.VDF : 7.11.145.140 2048 Bytes 28.04.2014 09:16:59
VBASE012.VDF : 7.11.145.141 2048 Bytes 28.04.2014 09:16:59
VBASE013.VDF : 7.11.146.20 166912 Bytes 29.04.2014 09:16:59
VBASE014.VDF : 7.11.146.131 194048 Bytes 01.05.2014 09:16:59
VBASE015.VDF : 7.11.146.243 167936 Bytes 03.05.2014 09:16:59
VBASE016.VDF : 7.11.147.97 122368 Bytes 05.05.2014 09:16:59
VBASE017.VDF : 7.11.147.207 169472 Bytes 06.05.2014 09:16:59
VBASE018.VDF : 7.11.148.61 174080 Bytes 08.05.2014 09:16:59
VBASE019.VDF : 7.11.148.149 257024 Bytes 09.05.2014 18:13:22
VBASE020.VDF : 7.11.148.241 135168 Bytes 12.05.2014 18:13:22
VBASE021.VDF : 7.11.149.61 139264 Bytes 13.05.2014 18:13:22
VBASE022.VDF : 7.11.149.169 160256 Bytes 15.05.2014 18:13:22
VBASE023.VDF : 7.11.150.31 189440 Bytes 17.05.2014 18:13:23
VBASE024.VDF : 7.11.150.119 157696 Bytes 20.05.2014 18:13:23
VBASE025.VDF : 7.11.151.25 219648 Bytes 23.05.2014 18:13:23
VBASE026.VDF : 7.11.151.26 2048 Bytes 23.05.2014 18:13:23
VBASE027.VDF : 7.11.151.27 2048 Bytes 23.05.2014 18:13:23
VBASE028.VDF : 7.11.151.28 2048 Bytes 23.05.2014 18:13:23
VBASE029.VDF : 7.11.151.29 2048 Bytes 23.05.2014 18:13:23
VBASE030.VDF : 7.11.151.30 2048 Bytes 23.05.2014 18:13:23
VBASE031.VDF : 7.11.151.104 262144 Bytes 25.05.2014 18:13:23
Engineversion : 8.3.18.32
AEVDF.DLL : 8.3.0.4 118976 Bytes 09.05.2014 09:16:42
AESCRIPT.DLL : 8.1.4.204 528584 Bytes 25.05.2014 18:13:21
AESCN.DLL : 8.3.0.4 135360 Bytes 25.05.2014 18:13:21
AESBX.DLL : 8.2.20.24 1409224 Bytes 09.05.2014 09:16:42
AERDL.DLL : 8.2.0.138 704888 Bytes 09.05.2014 09:16:42
AEPACK.DLL : 8.4.0.24 778440 Bytes 25.05.2014 18:13:21
AEOFFICE.DLL : 8.3.0.4 205000 Bytes 09.05.2014 09:16:42
AEHEUR.DLL : 8.1.4.1084 6705352 Bytes 25.05.2014 18:13:20
AEHELP.DLL : 8.3.0.0 274808 Bytes 09.05.2014 09:16:42
Seite 1
AVSCAN-20140525-210027-04C8C3FE
AEGEN.DLL : 8.1.7.26 450752 Bytes 09.05.2014 09:16:42
AEEXP.DLL : 8.4.1.342 594120 Bytes 25.05.2014 18:13:21
AEEMU.DLL : 8.1.3.2 393587 Bytes 09.05.2014 09:16:42
AECORE.DLL : 8.3.0.6 241864 Bytes 09.05.2014 09:16:42
AEBB.DLL : 8.1.1.4 53619 Bytes 09.05.2014 09:16:42
AVWINLL.DLL : 14.0.4.620 24144 Bytes 09.05.2014 09:16:44
AVPREF.DLL : 14.0.4.632 50256 Bytes 09.05.2014 09:16:43
AVREP.DLL : 14.0.4.620 219216 Bytes 09.05.2014 09:16:43
AVARKT.DLL : 14.0.4.632 225872 Bytes 09.05.2014 09:16:43
AVEVTLOG.DLL : 14.0.4.620 182352 Bytes 09.05.2014 09:16:43
SQLITE3.DLL : 14.0.4.620 452176 Bytes 09.05.2014 09:16:58
AVSMTP.DLL : 14.0.4.620 76368 Bytes 09.05.2014 09:16:43
NETNT.DLL : 14.0.4.620 13392 Bytes 09.05.2014 09:16:57
RCIMAGE.DLL : 14.0.4.620 4979280 Bytes 09.05.2014 09:16:58
RCTEXT.DLL : 14.0.4.620 73808 Bytes 09.05.2014 09:16:58
Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Vollständige Systemprüfung
Konfigurationsdatei...................: C:\Program Files\Avira\AntiVir
Desktop\sysscan.avp
Protokollierung.......................: standard
Primäre Aktion........................: Interaktiv
Sekundäre Aktion......................: Ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:, D:,
Durchsuche aktive Programme...........: ein
Laufende Programme erweitert..........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: aus
Prüfe alle Dateien....................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert
Beginn des Suchlaufs: Sonntag, 25. Mai 2014 21:00
Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'HDD0(C:, D:)'
[INFO] Es wurde kein Virus gefunden!
Der Suchlauf nach versteckten Objekten wird begonnen.
Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'svchost.exe' -'30' Modul(e) wurden durchsucht
Durchsuche Prozess 'vssvc.exe' -'49' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' -'112' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' -'44' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' -'112' Modul(e) wurden durchsucht
Durchsuche Prozess 'mcuicnt.exe' -'130' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' -'60' Modul(e) wurden durchsucht
Durchsuche Prozess 'avshadow.exe' -'33' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' -'89' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' -'83' Modul(e) wurden durchsucht
Durchsuche Prozess 'SynTPHelper.exe' -'29' Modul(e) wurden durchsucht
Durchsuche Prozess 'ehmsas.exe' -'43' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' -'89' Modul(e) wurden durchsucht
Durchsuche Prozess 'rundll32.exe' -'56' Modul(e) wurden durchsucht
Durchsuche Prozess 'rundll32.exe' -'36' Modul(e) wurden durchsucht
Durchsuche Prozess 'unsecapp.exe' -'40' Modul(e) wurden durchsucht
Durchsuche Prozess 'SSScheduler.exe' -'35' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmpnscfg.exe' -'47' Modul(e) wurden durchsucht
Durchsuche Prozess 'Skype.exe' -'139' Modul(e) wurden durchsucht
Durchsuche Prozess 'ehtray.exe' -'44' Modul(e) wurden durchsucht
Durchsuche Prozess 'sidebar.exe' -'88' Modul(e) wurden durchsucht
Seite 2
AVSCAN-20140525-210027-04C8C3FE
Durchsuche Prozess 'rundll32.exe' -'52' Modul(e) wurden durchsucht
Durchsuche Prozess 'jusched.exe' -'42' Modul(e) wurden durchsucht
Durchsuche Prozess 'vprot.exe' -'65' Modul(e) wurden durchsucht
Durchsuche Prozess 'pdf24.exe' -'47' Modul(e) wurden durchsucht
Durchsuche Prozess 'brs.exe' -'40' Modul(e) wurden durchsucht
Durchsuche Prozess 'SynTPEnh.exe' -'49' Modul(e) wurden durchsucht
Durchsuche Prozess 'RtHDVCpl.exe' -'53' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' -'172' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' -'45' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' -'48' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' -'21' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' -'33' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmpnetwk.exe' -'64' Modul(e) wurden durchsucht
Durchsuche Prozess 'loggingserver.exe' -'21' Modul(e) wurden durchsucht
Durchsuche Prozess 'nSvcIp.exe' -'41' Modul(e) wurden durchsucht
Durchsuche Prozess 'mfefire.exe' -'38' Modul(e) wurden durchsucht
Durchsuche Prozess 'mcshield.exe' -'84' Modul(e) wurden durchsucht
Durchsuche Prozess 'McAPExe.exe' -'29' Modul(e) wurden durchsucht
Durchsuche Prozess 'nSvcAppFlt.exe' -'46' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchIndexer.exe' -'60' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' -'33' Modul(e) wurden durchsucht
Durchsuche Prozess 'ToolbarUpdater.exe' -'39' Modul(e) wurden durchsucht
Durchsuche Prozess 'ImpWiFiSvc.exe' -'25' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' -'44' Modul(e) wurden durchsucht
Durchsuche Prozess 'RichVideo.exe' -'19' Modul(e) wurden durchsucht
Durchsuche Prozess 'PSIService.exe' -'26' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' -'43' Modul(e) wurden durchsucht
Durchsuche Prozess 'IoctlSvc.exe' -'21' Modul(e) wurden durchsucht
Durchsuche Prozess 'NBService.exe' -'35' Modul(e) wurden durchsucht
Durchsuche Prozess 'mfevtps.exe' -'35' Modul(e) wurden durchsucht
Durchsuche Prozess 'mdm.exe' -'21' Modul(e) wurden durchsucht
Durchsuche Prozess 'McSvHost.exe' -'142' Modul(e) wurden durchsucht
Durchsuche Prozess 'LxrSII1s.exe' -'5' Modul(e) wurden durchsucht
Durchsuche Prozess 'mDNSResponder.exe' -'36' Modul(e) wurden durchsucht
Durchsuche Prozess 'AppleMobileDeviceService.exe' -'48' Modul(e) wurden
durchsucht
Durchsuche Prozess 'armsvc.exe' -'24' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' -'62' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' -'89' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLANExt.exe' -'45' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' -'94' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' -'87' Modul(e) wurden durchsucht
Durchsuche Prozess 'SLsvc.exe' -'23' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' -'157' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' -'115' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' -'74' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' -'36' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvvsvc.exe' -'24' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' -'40' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' -'30' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' -'14' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsm.exe' -'22' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' -'60' Modul(e) wurden durchsucht
Durchsuche Prozess 'services.exe' -'35' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' -'26' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' -'14' Modul(e) wurden durchsucht
Durchsuche Prozess 'smss.exe' -'2' Modul(e) wurden durchsucht
Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
C:\ProgramData\vrobws.dat
[FUND] Ist das Trojanische Pferd TR/Crypt.ZPACK.80204
Die Registry wurde durchsucht ( '4610' Dateien ).
Der Suchlauf über die ausgewählten Dateien wird begonnen:
Beginne mit der Suche in 'C:\' <BOOT>
Seite 3
AVSCAN-20140525-210027-04C8C3FE
C:\ProgramData\vrobws.dat
[FUND] Ist das Trojanische Pferd TR/Crypt.ZPACK.80204
Beginne mit der Suche in 'D:\' <RECOVER>
Beginne mit der Desinfektion:
Der Registrierungseintrag
<HKEY_USERS\S-1-5-21-1682483986-195542428-201166501-1000\SOFTWARE\Microsoft\Wind
ows\CurrentVersion\Run\vrobws> wurde erfolgreich repariert.
C:\ProgramData\vrobws.dat
[FUND] Ist das Trojanische Pferd TR/Crypt.ZPACK.80204
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen
'5797c0c4.qua' verschoben!
[HINWEIS] Der Registrierungseintrag
<HKEY_USERS\S-1-5-21-1682483986-195542428-201166501-1000\SOFTWARE\Microsoft\Wind
ows\CurrentVersion\Run\vrobws> wurde erfolgreich repariert.
Ende des Suchlaufs: Sonntag, 25. Mai 2014 23:31
Benötigte Zeit: 2:15:15 Stunde(n)
Der Suchlauf wurde vollständig durchgeführt.
30744 Verzeichnisse wurden überprüft
607503 Dateien wurden geprüft
2 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
0 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
1 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
0 Dateien konnten nicht durchsucht werden
607501 Dateien ohne Befall
8798 Archive wurden durchsucht
0 Warnungen
1 Hinweise
709153 Objekte wurden beim Rootkitscan durchsucht
0 Versteckte Objekte wurden gefunden
Seite 4
|
|
18.06.2014, 16:30
| #2 |
| /// the machine /// TB-Ausbilder    | Online-Banking Sicherheitsüberprüfung/Trojaner TR/Crypt.ZPACK80204/Fehler RegSvr32 hi,
__________________Scan mit Combofix
__________________ |
|
18.06.2014, 18:09
| #3 |
| | Online-Banking Sicherheitsüberprüfung/Trojaner TR/Crypt.ZPACK80204/Fehler RegSvr32 Hallo schrauber,
__________________Danke für die schnelle Antwort. Anbei das Ergebnis von Combofix: Code:
ATTFilter ComboFix 14-06-16.01 - ***** 18.06.2014 18:40:30.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.49.1031.18.2301.703 [GMT 2:00]
ausgeführt von:: c:\users\*****\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
AV: McAfee Anti-Virus und Anti-Spyware *Disabled/Updated* {ADA629C7-7F48-5689-624A-3B76997E0892}
FW: McAfee Firewall *Enabled* {959DA8E2-3527-57D1-4915-924367AD4FE9}
SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: McAfee Anti-Virus und Anti-Spyware *Disabled/Updated* {16C7C823-5972-5907-58FA-0004E2F9422F}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\IsUn0407.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-05-18 bis 2014-06-18 ))))))))))))))))))))))))))))))
.
.
2014-06-18 16:50 . 2014-06-18 16:50 -------- d-----w- c:\users\*****\AppData\Local\temp
2014-06-18 16:50 . 2014-06-18 16:50 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-06-18 11:56 . 2014-06-18 11:59 -------- d-----w- C:\FRST
2014-06-17 09:05 . 2014-06-17 09:21 -------- d-----w- c:\users\*****\CKR Stammbaum
2014-06-11 11:33 . 2014-06-11 11:33 -------- d-----w- c:\program files\McAfee Security Scan
2014-05-25 21:35 . 2014-05-25 21:35 -------- d-----w- c:\users\*****\AntiVir Text
2014-05-25 18:01 . 2014-05-25 18:01 -------- d-----w- c:\users\*****\AppData\Roaming\Avira
2014-05-25 17:57 . 2014-05-09 09:16 93528 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2014-05-25 17:57 . 2014-05-09 09:16 37352 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2014-05-25 17:57 . 2014-05-09 09:16 136216 ----a-w- c:\windows\system32\drivers\avipbb.sys
2014-05-25 17:57 . 2014-05-25 17:57 -------- d-----w- c:\program files\Avira
2014-05-24 12:36 . 2014-05-25 17:37 -------- d-----w- c:\program files\Spybot - Search & Destroy 2
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-05-18 09:41 . 2013-04-26 19:38 692400 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-05-18 09:41 . 2012-03-23 16:32 70832 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2014-05-06 04:45 . 2014-06-11 11:46 53760 ----a-w- c:\windows\apppatch\iebrshim.dll
2014-04-14 18:13 . 2014-04-25 12:38 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2014-04-03 16:07 . 2013-09-24 19:53 61400 ----a-w- c:\windows\system32\drivers\cfwids.sys
2014-04-03 15:59 . 2013-09-24 19:49 215624 ----a-w- c:\windows\system32\drivers\mfewfpk.sys
2014-04-03 15:59 . 2013-11-14 14:06 179600 ----a-w- c:\windows\system32\mfevtps.exe
2014-04-03 15:52 . 2013-04-03 17:48 574576 ----a-w- c:\windows\system32\drivers\mfehidk.sys
2014-04-03 15:50 . 2013-09-24 19:44 367776 ----a-w- c:\windows\system32\drivers\mfefirek.sys
2014-04-03 15:49 . 2013-09-24 19:44 66408 ----a-w- c:\windows\system32\drivers\mfebopk.sys
2014-04-03 15:48 . 2013-09-24 19:43 236672 ----a-w- c:\windows\system32\drivers\mfeavfk.sys
2014-04-03 15:47 . 2013-04-03 17:46 134600 ----a-w- c:\windows\system32\drivers\mfeapfk.sys
2014-03-31 20:46 . 2014-03-31 20:46 130712 ----a-w- c:\windows\system32\MSSTDFMT.DLL
2014-03-31 20:46 . 2014-03-31 20:46 1070232 ----a-w- c:\windows\system32\MSCOMCTL.OCX
2010-09-11 15:26 . 2014-06-18 10:50 119808 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}]
2013-06-28 14:56 279552 ----a-w- c:\program files\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2014-05-08 21444224]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2008-09-18 6294048]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-07-03 1328424]
"PDVD8LanguageShortcut"="c:\program files\HomeCinema\PowerDVD8\Language\Language.exe" [2007-12-14 50472]
"BDRegion"="c:\program files\Cyberlink\Shared Files\brs.exe" [2008-10-07 75048]
"UCam_Menu"="c:\program files\HomeCinema\YouCam\MUITransfer\MUIStartMenu.exe" [2008-06-13 210216]
"PDFPrint"="c:\program files\PDF24\pdf24.exe" [2013-03-20 162856]
"vProt"="c:\program files\AVG Nation toolbar\vprot.exe" [2013-11-11 2403144]
"mcpltui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2014-04-25 517392]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
"Skytel"="Skytel.exe" [2008-09-18 1833504]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-29 13560352]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-29 92704]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2014-05-08 959904]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2014-05-09 737872]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2008-08-21 443968]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.8.150\SSScheduler.exe [2014-4-9 279456]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean.exe
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
2010-09-11 15:26 30192 ----a-w- c:\program files\Google\Google Desktop Search\GoogleDesktop.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google EULA Launcher]
2008-10-14 09:57 20480 ----a-w- c:\program files\Google\Google EULA\GoogleEULALauncher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2008-02-28 17:07 1828136 ----a-w- c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2008-09-29 13:59 92704 ----a-w- c:\windows\System32\nvmctray.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PlayMovie]
2008-10-21 10:36 172032 ----a-w- c:\program files\HomeCinema\PlayMovie\PMVService.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
2009-12-16 23:02 39424 ----a-w- c:\program files\Winamp\winampa.exe
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - KXDIRFOW
*Deregistered* - kxdirfow
*Deregistered* - mfeavfk01
*Deregistered* - mfehidk01
*Deregistered* - mfencbdc01
*Deregistered* - mfencbdc02
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Inhalt des "geplante Tasks" Ordners
.
2014-06-18 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-04-26 09:41]
.
2014-06-18 c:\windows\Tasks\User_Feed_Synchronization-{EE06053A-1882-4935-9827-74EA8F2D0780}.job
- c:\windows\system32\msfeedssync.exe [2008-01-21 02:24]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = about:blank
mStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Free YouTube to MP3 Converter - c:\program files\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-25/4
IE: {{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - c:\program files\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll
LSP: %SYSTEMROOT%\system32\nvLsp.dll
TCP: DhcpNameServer = 192.168.2.1
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\17.0.12\ViProtocol.dll
DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} - hxxp://www.photodose.de/ips-opdata/operator/69189345/objects/jordan.cab
FF - ProfilePath - c:\users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\0zx6jvlc.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.winamp.com/search/search?query={searchTerms}&invocationType=winamp-ff&s_qt=sb&tb_uuid=20120519084639967&tb_oid=20-12-2009&tb_mrud=14-11-2012&query=
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://de.search.yahoo.com/search?fr=mcafee&type=A111DE0&p=
FF - user.js: network.http.max-connections - 256
FF - user.js: network.http.max-connections-per-server - 48
FF - user.js: network.http.max-persistent-connections-per-proxy - 32
FF - user.js: network.http.max-persistent-connections-per-server - 18
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKCU-Run-iLivid - c:\users\*****\AppData\Local\iLivid\iLivid.exe
HKCU-Run-vrobws - (no file)
SafeBoot-WudfPf
SafeBoot-WudfRd
MSConfigStartUp-iTunesHelper - c:\program files\iTunes\iTunesHelper.exe
MSConfigStartUp-QuickTime Task - c:\program files\QuickTime\QTTask.exe
MSConfigStartUp-swg - c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
MSConfigStartUp-vrobws - c:\programdata\vrobws.dat
MSConfigStartUp-vsxsgza - c:\programdata\vsxsgza.dat
AddRemove-Free DVD MP3 Ripper_is1 - c:\program files\Free DVD MP3 Ripper\unins000.exe
AddRemove-Gabriel Knight 3 - c:\windows\IsUn0407.exe
AddRemove-_{ADDBE07D-95B8-4789-9C76-187FFF9624B4} - c:\program files\Corel\CorelDRAW Essential Edition 3\Programs\MSILauncher {ADDBE07D-95B8-4789-9C76-187FFF9624B4}
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2014-06-18 18:50
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]
"ImagePath"="\??\c:\program files\HomeCinema\PlayMovie\000.fcl"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}]
"ImagePath"="\??\c:\program files\HomeCinema\PowerDVD8\000.fcl"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_13_0_0_214_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_13_0_0_214_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Zeit der Fertigstellung: 2014-06-18 18:54:32
ComboFix-quarantined-files.txt 2014-06-18 16:54
.
Vor Suchlauf: 10 Verzeichnis(se), 122.480.738.304 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 122.488.754.176 Bytes frei
.
- - End Of File - - 1CA0FF6A6BB229677010E1914A9F9A6E
5C616939100B85E558DA92B899A0FC36
|
|
19.06.2014, 13:34
| #4 |
| /// the machine /// TB-Ausbilder | Online-Banking Sicherheitsüberprüfung/Trojaner TR/Crypt.ZPACK80204/Fehler RegSvr32 Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
21.06.2014, 09:28
| #5 |
| | Online-Banking Sicherheitsüberprüfung/Trojaner TR/Crypt.ZPACK80204/Fehler RegSvr32 Hallo schrauber, Danke für die nächsten Schritte. Kann mich erst nach dem Wochenende wieder darum kümmern und melde mich dann mit den Logfiles. Schönes Wochenende bis dahin. +katja+ |
|
21.06.2014, 22:05
| #6 |
| /// the machine /// TB-Ausbilder | Online-Banking Sicherheitsüberprüfung/Trojaner TR/Crypt.ZPACK80204/Fehler RegSvr32 ok 
__________________ --> Online-Banking Sicherheitsüberprüfung/Trojaner TR/Crypt.ZPACK80204/Fehler RegSvr32 |
|
23.06.2014, 08:24
| #7 |
| | Online-Banking Sicherheitsüberprüfung/Trojaner TR/Crypt.ZPACK80204/Fehler RegSvr32 Hallo schrauber, melde mich zurück mit den gewünschten Logfiles (MBAM, AdwCleaner, JRT und FRST): [CODE] Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 22.06.2014 Suchlauf-Zeit: 20:30:34 Logdatei: mbam.txt Administrator: Ja Version: 2.00.2.1012 Malware Datenbank: v2014.06.22.02 Rootkit Datenbank: v2014.06.20.01 Lizenz: Testversion Malware Schutz: Aktiviert Bösartiger Webseiten Schutz: Aktiviert Self-protection: Deaktiviert Betriebssystem: Windows Vista Service Pack 2 CPU: x86 Dateisystem: NTFS Benutzer: ***** Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 268229 Verstrichene Zeit: 17 Min, 13 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristics: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 0 (No malicious items detected) Registrierungswerte: 0 (No malicious items detected) Registrierungsdaten: 0 (No malicious items detected) Ordner: 0 (No malicious items detected) Dateien: 0 (No malicious items detected) Physische Sektoren: 0 (No malicious items detected) (end)AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v3.212 - Bericht erstellt am 22/06/2014 um 21:33:49
# Aktualisiert 05/06/2014 von Xplode
# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Benutzername : ***** - *****-PC
# Gestartet von : C:\Users\*****\Desktop\adwcleaner_3.212.exe
# Option : Löschen
***** [ Dienste ] *****
Dienst Gelöscht : vToolbarUpdater17.0.12
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\AVG Nation toolbar
Ordner Gelöscht : C:\Program Files\AVG Nation toolbar
Ordner Gelöscht : C:\Program Files\Common Files\AVG Secure Search
Ordner Gelöscht : C:\Users\*****\AppData\Local\AVG Nation toolbar
Ordner Gelöscht : C:\Users\*****\AppData\Local\AVG Secure Search
Ordner Gelöscht : C:\Users\*****\AppData\Roaming\dvdvideosoftiehelpers
Datei Gelöscht : C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\0zx6jvlc.default\searchplugins\winamp-search.xml
Datei Gelöscht : C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\0zx6jvlc.default\user.js
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{ACAA314B-EEBA-48E4-AD47-84E31C44796C}]
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\bopakagnckmlgajfccecajhnimjiiedh
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof
Schlüssel Gelöscht : HKCU\Software\Classes\iLivid.torrent
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\WLXQuickTimeShellExt.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iLivid.torrent
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protocols\handler\viprotocol
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [vProt]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{408CFAD9-8F13-4747-8EC7-770A339C7237}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E1164984-B567-47BD-A7FF-240C2594404A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{07CAC314-E962-4F78-89AB-DD002F2490EE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{25CEE8EC-5730-41BC-8B58-22DDC8AB8C20}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{70D46D94-BF1E-45ED-B567-48701376298E}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE7E0A3-AE64-4DC8-84D1-F5D7BAF2DB0C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE7E0A3-AE64-4DC8-84D1-F5D7BAF2DB0C}
Schlüssel Gelöscht : HKCU\Software\AVG Nation toolbar
Schlüssel Gelöscht : HKCU\Software\ilivid
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKLM\Software\AVG Security Toolbar
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\ilivid
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08121C32A9C319F4CB0C11FF059552A4
***** [ Browser ] *****
-\\ Internet Explorer v7.0.6002.18005
-\\ Mozilla Firefox v30.0 (de)
[ Datei : C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\0zx6jvlc.default\prefs.js ]
Zeile gelöscht : user_pref("aol_toolbar.surf.date", "133");
Zeile gelöscht : user_pref("aol_toolbar.surf.lastDate", "14");
Zeile gelöscht : user_pref("aol_toolbar.surf.lastMonth", "10");
Zeile gelöscht : user_pref("aol_toolbar.surf.lastYear", "2012");
Zeile gelöscht : user_pref("aol_toolbar.surf.month", "1287");
Zeile gelöscht : user_pref("aol_toolbar.surf.prevMonth", "1151");
Zeile gelöscht : user_pref("aol_toolbar.surf.total", "17259");
Zeile gelöscht : user_pref("aol_toolbar.surf.week", "194");
Zeile gelöscht : user_pref("aol_toolbar.surf.year", "17129");
Zeile gelöscht : user_pref("browser.search.defaulturl", "hxxp://search.winamp.com/search/search?query={searchTerms}&invocationType=winamp-ff&s_qt=sb&tb_uuid=20120519084639967&tb_oid=20-12-2009&tb_mrud=14-11-2012&query[...]
-\\ Google Chrome v
[ Datei : C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\preferences ]
*************************
AdwCleaner[R0].txt - [5709 octets] - [22/06/2014 21:32:47]
AdwCleaner[S0].txt - [5630 octets] - [22/06/2014 21:33:49]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [5690 octets] ##########
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 6.1.4 (04.06.2014:1) OS: Windows Vista (TM) Home Premium x86 Ran by ***** on 22.06.2014 at 21:50:50,88 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys ~~~ Files ~~~ Folders ~~~ FireFox Emptied folder: C:\Users\*****\AppData\Roaming\mozilla\firefox\profiles\0zx6jvlc.default\minidumps [117 files] ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 22.06.2014 at 21:58:00,08 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:16-06-2014 Ran by ***** (administrator) on *****-PC on 23-06-2014 09:03:55 Running from C:\Users\*****\Desktop Platform: Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: German Standard Internet Explorer Version 7 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Microsoft Corporation) C:\Windows\System32\SLsvc.exe (Microsoft Corporation) C:\Windows\System32\wlanext.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Lexar Media, Inc.) C:\Windows\System32\LxrSII1s.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe (McAfee, Inc.) C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe (Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\VS7DEBUG\mdm.exe (McAfee, Inc.) C:\Windows\System32\mfevtps.exe (Nero AG) C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe (Prolific Technology Inc.) C:\Windows\System32\IoctlSvc.exe () C:\Windows\System32\PSIService.exe () C:\Program Files\Cyberlink\Shared files\RichVideo.exe (Telefónica) C:\Program Files\o2\Mobile Connection Manager\ImpWiFiSvc.exe () C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe (McAfee, Inc.) C:\Program Files\McAfee\MSC\McAPExe.exe (McAfee, Inc.) C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe (McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe () C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe (Realtek Semiconductor) C:\Windows\RtHDVCpl.exe (Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (cyberlink) C:\Program Files\Cyberlink\Shared files\brs.exe (Geek Software GmbH) C:\Program Files\PDF24\pdf24.exe (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation) C:\Windows\ehome\ehtray.exe (Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe (Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (Microsoft Corporation) C:\Windows\System32\mobsync.exe (Microsoft Corporation) C:\Windows\ehome\ehmsas.exe (McAfee, Inc.) C:\Program Files\Common Files\McAfee\Platform\McUICnt.exe (Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe (Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Skype Technologies) C:\Program Files\Skype\Updater\Updater.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [6294048 2008-09-18] (Realtek Semiconductor) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1328424 2008-07-03] (Synaptics, Inc.) HKLM\...\Run: [PDVD8LanguageShortcut] => C:\Program Files\HomeCinema\PowerDVD8\Language\Language.exe [50472 2007-12-14] () HKLM\...\Run: [BDRegion] => C:\Program Files\Cyberlink\Shared Files\brs.exe [75048 2008-10-07] (cyberlink) HKLM\...\Run: [UCam_Menu] => C:\Program Files\HomeCinema\YouCam\MUITransfer\MUIStartMenu.exe [210216 2008-06-13] (CyberLink Corp.) HKLM\...\Run: [PDFPrint] => C:\Program Files\PDF24\pdf24.exe [162856 2013-03-20] (Geek Software GmbH) HKLM\...\Run: [mcpltui_exe] => C:\Program Files\McAfee.com\Agent\mcagent.exe [517392 2014-04-25] (McAfee, Inc.) HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKLM\...\Run: [Skytel] => C:\Windows\Skytel.exe [1833504 2008-09-18] (Realtek Semiconductor Corp.) HKLM\...\Run: [NvCplDaemon] => C:\Windows\system32\NvCpl.dll [13560352 2008-09-29] (NVIDIA Corporation) HKLM\...\Run: [NvMediaCenter] => C:\Windows\system32\NvMcTray.dll [92704 2008-09-29] (NVIDIA Corporation) HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2014-05-08] (Adobe Systems Incorporated) HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [737872 2014-05-09] (Avira Operations GmbH & Co. KG) HKU\.DEFAULT\...\Run: [Picasa Media Detector] => C:\Program Files\Picasa2\PicasaMediaDetector.exe [443968 2008-08-21] (Google Inc.) HKU\S-1-5-21-1682483986-195542428-201166501-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-21] (Microsoft Corporation) HKU\S-1-5-21-1682483986-195542428-201166501-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [21444224 2014-05-08] (Skype Technologies S.A.) HKU\S-1-5-21-1682483986-195542428-201166501-1000\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-21] (Microsoft Corporation) AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll => C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll [123392 2010-09-11] (Google) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.) BootExecute: autocheck autochk * sdnclean.exe ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank SearchScopes: HKLM - DefaultScope value is missing. SearchScopes: HKCU - {FF752B98-5BF8-4DF0-AF47-8A47E8A4D343} URL = hxxp://de.search.yahoo.com/search?fr=mcafee&type=A011DE0&p={SearchTerms} BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.) BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: No Name - {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - C:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - C:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} hxxp://www.photodose.de/ips-opdata/operator/69189345/objects/jordan.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation) Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation) Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation) Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - C:\Program Files\McAfee\MSC\McSnIePl.dll (McAfee, Inc.) Winsock: Catalog5 05 C:\Program Files\Bonjour\mdnsNSP.dll [152864] (Apple Inc.) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\0zx6jvlc.default FF SearchEngineOrder.1: Sichere Suche FF Homepage: hxxp://www.google.com/ FF Keyword.URL: hxxp://de.search.yahoo.com/search?fr=mcafee&type=A111DE0&p= FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_13_0_0_214.dll () FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF Plugin: @google.com/npPicasa2,version=2.0.0 - C:\Program Files\Picasa2\npPicasa2.dll (Google, Inc.) FF Plugin: @google.com/npPicasa3,version=3.0.0 - C:\Program Files\Picasa2\npPicasa3.dll (Google, Inc.) FF Plugin: @innoplus.de/ino3DViewer - C:\Program Files\innoplus\3D-Viewer-innoPlus\npIno3DViewer.dll (INNOVA-engineering GmbH Dresden) FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @mcafee.com/MSC,version=10 - c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL () FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF Plugin: @videolan.org/vlc,version=2.1.2 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin: @videolan.org/vlc,version=2.1.3 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npwachk.dll (Nullsoft) FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\0zx6jvlc.default\searchplugins\aol-search.xml FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\0zx6jvlc.default\searchplugins\nation-secure-search.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\McSiteAdvisor.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: 20-20 3D Viewer - IKEA - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\0zx6jvlc.default\Extensions\2020Player_IKEA@2020Technologies.com [2012-01-12] FF Extension: DDBAC - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\0zx6jvlc.default\Extensions\{271A3CF5-5A54-447B-A08F-BE805F0DA60A} [2011-10-11] FF Extension: McAfee SiteAdvisor - C:\Program Files\McAfee\SiteAdvisor [2013-11-14] FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [] FF HKLM\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files\McAfee\SiteAdvisor FF Extension: McAfee SiteAdvisor - C:\Program Files\McAfee\SiteAdvisor [2013-11-14] FF HKLM\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK FF Extension: McAfee Anti-Spam Thunderbird Extension - C:\Program Files\McAfee\MSK [2013-11-14] FF HKCU\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04] Chrome: ======= CHR HomePage: hxxp://www.google.com CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files\McAfee\SiteAdvisor\McChPlg.crx [2013-11-14] ========================== Services (Whitelisted) ================= R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-05-09] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-05-09] (Avira Operations GmbH & Co. KG) R2 ForceWare Intelligent Application Manager (IAM); C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe [450560 2008-09-08] () [File not signed] S3 GoogleDesktopManager-051210-111108; C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [30192 2010-09-11] (Google) R2 HomeNetSvc; C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe [281560 2013-07-30] (McAfee, Inc.) R2 LxrSII1s; C:\Windows\system32\LxrSII1s.exe [65536 2009-12-30] (Lexar Media, Inc.) [File not signed] R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation) R2 McAfee SiteAdvisor Service; C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe [281560 2013-07-30] (McAfee, Inc.) R2 McAPExe; C:\Program Files\McAfee\MSC\McAPExe.exe [145568 2014-04-25] (McAfee, Inc.) S3 McAWFwk; C:\Program Files\Common Files\McAfee\ActWiz\McAWFwk.exe [287728 2013-04-09] (McAfee, Inc.) S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [235696 2014-04-09] (McAfee, Inc.) R2 McMPFSvc; C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe [281560 2013-07-30] (McAfee, Inc.) R2 McNaiAnn; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [281560 2013-07-30] (McAfee, Inc.) S3 McODS; C:\Program Files\McAfee\VirusScan\mcods.exe [471592 2013-08-02] (McAfee, Inc.) S4 McOobeSv2; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [281560 2013-07-30] (McAfee, Inc.) R2 mcpltsvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [281560 2013-07-30] (McAfee, Inc.) R2 McProxy; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [281560 2013-07-30] (McAfee, Inc.) R2 MDM; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [335872 2006-10-26] (Microsoft Corporation) [File not signed] R2 mfecore; C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe [655936 2014-03-18] (McAfee, Inc.) R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [169800 2014-04-03] (McAfee, Inc.) R2 mfevtp; C:\Windows\system32\mfevtps.exe [179600 2014-04-03] (McAfee, Inc.) R2 MSK80Service; C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe [281560 2013-07-30] (McAfee, Inc.) R2 nSvcIp; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe [184320 2008-09-08] () [File not signed] R2 PLFlash DeviceIoControl Service; C:\Windows\system32\IoctlSvc.exe [81920 2006-12-19] (Prolific Technology Inc.) [File not signed] R2 ProtexisLicensing; C:\Windows\system32\PSIService.exe [177704 2007-06-05] () R2 RichVideo; C:\Program Files\Cyberlink\Shared files\RichVideo.exe [241734 2008-06-28] () [File not signed] R2 TGCM_ImportWiFiSvc; C:\Program Files\o2\Mobile Connection Manager\ImpWiFiSvc.exe [201344 2012-01-10] (Telefónica) S3 usnjsvc; C:\Program Files\Windows Live\Messenger\usnsvc.exe [98328 2007-10-18] (Microsoft Corporation) S3 WLSetupSvc; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [266240 2007-10-25] (Microsoft Corporation) S2 0099511403087631mcinstcleanup; C:\Windows\TEMP\009951~1.EXE -cleanup -nolog [X] ==================== Drivers (Whitelisted) ==================== R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [93528 2014-05-09] (Avira Operations GmbH & Co. KG) R1 avgtp; C:\Windows\system32\drivers\avgtpx86.sys [37664 2013-11-11] (AVG Technologies) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-05-09] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2014-05-09] (Avira Operations GmbH & Co. KG) R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [61400 2014-04-03] (McAfee, Inc.) S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [147912 2013-09-23] (McAfee, Inc.) R2 LxrSII1d; C:\Windows\System32\Drivers\LxrSII1d.sys [63448 2009-12-30] (Lexar Media, Inc.) S3 massfilter; C:\Windows\System32\drivers\massfilter.sys [9216 2010-11-26] (MBB Incorporated) S3 massfilter_hs; C:\Windows\System32\drivers\massfilter_hs.sys [9728 2010-10-15] (ZTE Incorporated) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-06-23] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-05-12] (Malwarebytes Corporation) R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [134600 2014-04-03] (McAfee, Inc.) R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [236672 2014-04-03] (McAfee, Inc.) S3 mfebopk; C:\Windows\System32\drivers\mfebopk.sys [66408 2014-04-03] (McAfee, Inc.) R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [367776 2014-04-03] (McAfee, Inc.) R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [574576 2014-04-03] (McAfee, Inc.) R3 mfencbdc; C:\Windows\System32\DRIVERS\mfencbdc.sys [345584 2014-03-18] (McAfee, Inc.) S3 mfencrk; C:\Windows\System32\DRIVERS\mfencrk.sys [81264 2014-03-18] (McAfee, Inc.) R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [215624 2014-04-03] (McAfee, Inc.) R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2014-05-09] (Avira GmbH) S3 XUIF; C:\Windows\System32\Drivers\x10ufx2.sys [27416 2006-11-30] (X10 Wireless Technology, Inc.) R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796}; C:\Program Files\HomeCinema\PlayMovie\000.fcl [61424 2008-10-21] (Cyberlink Corp.) R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}; C:\Program Files\HomeCinema\PowerDVD8\000.fcl [61424 2008-10-07] (Cyberlink Corp.) U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation) S3 catchme; \??\C:\Users\*****\AppData\Local\Temp\catchme.sys [X] S3 IpInIp; system32\DRIVERS\ipinip.sys [X] S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X] S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X] S3 USBAAPL; System32\Drivers\usbaapl.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-06-23 09:03 - 2014-06-23 09:03 - 00021432 _____ () C:\Users\*****\Desktop\FRST.txt 2014-06-22 21:58 - 2014-06-22 22:48 - 00000767 _____ () C:\Users\*****\Desktop\JRT.txt 2014-06-22 21:50 - 2014-06-22 21:50 - 00000000 ____D () C:\Windows\ERUNT 2014-06-22 21:49 - 2014-06-22 21:49 - 01016261 _____ (Thisisu) C:\Users\*****\Desktop\JRT.exe 2014-06-22 21:47 - 2014-06-22 21:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee 2014-06-22 21:42 - 2014-06-22 21:42 - 00005750 _____ () C:\Users\*****\Desktop\AdwCleaner[S1].txt 2014-06-22 21:32 - 2014-06-22 21:34 - 00000000 ____D () C:\AdwCleaner 2014-06-22 20:56 - 2014-06-22 20:56 - 01333465 _____ () C:\Users\*****\Desktop\adwcleaner_3.212.exe 2014-06-22 20:53 - 2014-06-22 20:55 - 00001161 _____ () C:\Users\*****\Desktop\mbam.txt 2014-06-22 20:19 - 2014-06-23 09:02 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-06-22 20:19 - 2014-06-22 20:19 - 00000863 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-06-22 20:19 - 2014-06-22 20:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-06-22 20:18 - 2014-06-22 20:18 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-06-22 20:18 - 2014-06-22 20:18 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2014-06-22 20:18 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-06-22 20:18 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-06-22 20:18 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-06-22 20:12 - 2014-06-22 20:12 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\*****\Desktop\mbam-setup-2.0.2.1012.exe 2014-06-18 18:58 - 2014-06-18 18:59 - 00013481 _____ () C:\Users\*****\Desktop\Combofix.txt 2014-06-18 18:54 - 2014-06-23 09:05 - 00000000 ____D () C:\Users\*****\AppData\Local\temp 2014-06-18 18:54 - 2014-06-18 18:54 - 00013497 _____ () C:\ComboFix.txt 2014-06-18 18:54 - 2014-06-18 18:54 - 00000000 ____D () C:\Users\Public\AppData\Local\temp 2014-06-18 18:54 - 2014-06-18 18:54 - 00000000 ____D () C:\Users\Default\AppData\Local\temp 2014-06-18 18:54 - 2014-06-18 18:54 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp 2014-06-18 18:37 - 2014-06-18 18:54 - 00000000 ____D () C:\Qoobox 2014-06-18 18:37 - 2014-06-18 18:54 - 00000000 ____D () C:\ComboFix 2014-06-18 18:37 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe 2014-06-18 18:37 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe 2014-06-18 18:37 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2014-06-18 18:37 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2014-06-18 18:37 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2014-06-18 18:37 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe 2014-06-18 18:37 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe 2014-06-18 18:37 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe 2014-06-18 18:36 - 2014-06-18 18:52 - 00000000 ____D () C:\Windows\erdnt 2014-06-18 18:33 - 2014-06-18 18:33 - 05206841 ____R (Swearware) C:\Users\*****\Desktop\ComboFix.exe 2014-06-18 14:36 - 2014-06-18 14:36 - 00000847 _____ () C:\Users\*****\Desktop\Gmer.txt 2014-06-18 14:24 - 2014-06-18 14:24 - 00380416 _____ () C:\Users\*****\Desktop\Gmer-19357.exe 2014-06-18 14:22 - 2014-06-18 16:45 - 00000000 ____D () C:\Users\*****\Desktop\TB 2014-06-18 14:22 - 2014-06-18 14:22 - 00034353 _____ () C:\Users\*****\Desktop\Addition_.txt 2014-06-18 14:20 - 2014-06-18 14:20 - 00035158 _____ () C:\Users\*****\Desktop\FRST_.txt 2014-06-18 14:16 - 2014-06-18 14:18 - 00012872 _____ () C:\Users\*****\Desktop\AVSCAN-20140525-210027-04C8C3FE - Editor.txt 2014-06-18 13:56 - 2014-06-23 09:04 - 00000000 ____D () C:\FRST 2014-06-18 13:55 - 2014-06-18 13:55 - 01072640 _____ (Farbar) C:\Users\*****\Desktop\FRST.exe 2014-06-18 13:48 - 2014-06-18 14:25 - 00000474 _____ () C:\Users\*****\Desktop\defogger_disable.log 2014-06-18 13:48 - 2014-06-18 13:48 - 00000000 _____ () C:\Users\*****\defogger_reenable 2014-06-18 13:46 - 2014-06-18 13:47 - 00050477 _____ () C:\Users\*****\Desktop\Defogger.exe 2014-06-18 12:50 - 2014-06-18 12:50 - 00000000 ____D () C:\Program Files\Mozilla Firefox 2014-06-17 11:05 - 2014-06-17 11:21 - 00000000 ____D () C:\Users\*****\CKR Stammbaum 2014-06-11 13:46 - 2014-05-06 06:46 - 03630592 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-06-11 13:46 - 2014-05-06 06:46 - 01177600 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-06-11 13:46 - 2014-05-06 06:46 - 00834048 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-06-11 13:46 - 2014-05-06 06:46 - 00671744 _____ (Microsoft Corporation) C:\Windows\system32\mstime.dll 2014-06-11 13:46 - 2014-05-06 06:46 - 00498688 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-06-11 13:46 - 2014-05-06 06:46 - 00480256 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-06-11 13:46 - 2014-05-06 06:46 - 00106496 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2014-06-11 13:46 - 2014-05-06 06:45 - 06119424 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-06-11 13:46 - 2014-05-06 06:45 - 00380928 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-06-11 13:46 - 2014-05-06 06:45 - 00271872 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-06-11 13:46 - 2014-05-06 06:45 - 00193024 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll 2014-06-11 13:46 - 2014-05-06 06:45 - 00180736 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-06-11 13:46 - 2014-05-06 06:45 - 00027648 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-06-11 13:46 - 2014-05-06 06:45 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\corpol.dll 2014-06-11 13:46 - 2014-05-06 05:16 - 00389632 _____ (Microsoft Corporation) C:\Windows\system32\html.iec 2014-06-11 13:46 - 2014-05-06 05:07 - 01383424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-06-11 13:46 - 2014-04-26 18:01 - 00502784 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll 2014-06-11 13:46 - 2014-04-05 04:42 - 00905664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys 2014-06-11 13:46 - 2014-03-10 03:22 - 01401344 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll 2014-06-11 13:46 - 2014-03-10 03:22 - 01248768 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll 2014-06-11 13:33 - 2014-06-11 13:33 - 00001883 _____ () C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk 2014-06-11 13:33 - 2014-06-11 13:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus 2014-06-11 13:33 - 2014-06-11 13:33 - 00000000 ____D () C:\Program Files\McAfee Security Scan 2014-05-25 23:35 - 2014-05-25 23:35 - 00000000 ____D () C:\Users\*****\AntiVir Text 2014-05-25 20:01 - 2014-05-25 20:01 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Avira 2014-05-25 19:58 - 2014-05-25 19:58 - 00001811 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk 2014-05-25 19:58 - 2014-05-25 19:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira 2014-05-25 19:57 - 2014-05-25 19:57 - 00000000 ____D () C:\ProgramData\Avira 2014-05-25 19:57 - 2014-05-25 19:57 - 00000000 ____D () C:\Program Files\Avira 2014-05-25 19:57 - 2014-05-09 11:16 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys 2014-05-25 19:57 - 2014-05-09 11:16 - 00093528 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys 2014-05-25 19:57 - 2014-05-09 11:16 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys 2014-05-25 19:57 - 2014-05-09 11:16 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys 2014-05-25 19:47 - 2014-05-25 19:50 - 137314600 _____ () C:\Users\*****\Downloads\avira_free_antivirus_de_642.exe 2014-05-24 23:54 - 2014-05-25 19:35 - 00000741 _____ () C:\Windows\wininit.ini 2014-05-24 14:36 - 2014-05-25 19:37 - 00000000 ____D () C:\Program Files\Spybot - Search & Destroy 2 2014-05-24 14:36 - 2014-05-25 19:35 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy ==================== One Month Modified Files and Folders ======= 2014-06-23 09:05 - 2014-06-23 09:03 - 00021432 _____ () C:\Users\*****\Desktop\FRST.txt 2014-06-23 09:05 - 2014-06-18 18:54 - 00000000 ____D () C:\Users\*****\AppData\Local\temp 2014-06-23 09:04 - 2014-06-18 13:56 - 00000000 ____D () C:\FRST 2014-06-23 09:03 - 2009-02-05 16:40 - 00042749 _____ () C:\ProgramData\nvModes.dat 2014-06-23 09:03 - 2009-02-05 16:40 - 00042749 _____ () C:\ProgramData\nvModes.001 2014-06-23 09:02 - 2014-06-22 20:19 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-06-23 09:02 - 2009-08-08 18:37 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Home Cinema 2014-06-23 08:59 - 2006-11-02 15:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-06-23 08:59 - 2006-11-02 14:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 2014-06-23 08:59 - 2006-11-02 14:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 2014-06-22 22:49 - 2009-08-08 18:31 - 01588148 _____ () C:\Windows\WindowsUpdate.log 2014-06-22 22:49 - 2006-11-02 15:01 - 00032514 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-06-22 22:48 - 2014-06-22 21:58 - 00000767 _____ () C:\Users\*****\Desktop\JRT.txt 2014-06-22 21:55 - 2014-05-18 11:41 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-06-22 21:50 - 2014-06-22 21:50 - 00000000 ____D () C:\Windows\ERUNT 2014-06-22 21:49 - 2014-06-22 21:49 - 01016261 _____ (Thisisu) C:\Users\*****\Desktop\JRT.exe 2014-06-22 21:49 - 2011-10-26 13:44 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Skype 2014-06-22 21:47 - 2014-06-22 21:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee 2014-06-22 21:42 - 2014-06-22 21:42 - 00005750 _____ () C:\Users\*****\Desktop\AdwCleaner[S1].txt 2014-06-22 21:38 - 2008-01-21 04:47 - 00613176 _____ () C:\Windows\PFRO.log 2014-06-22 21:34 - 2014-06-22 21:32 - 00000000 ____D () C:\AdwCleaner 2014-06-22 20:58 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\SchCache 2014-06-22 20:56 - 2014-06-22 20:56 - 01333465 _____ () C:\Users\*****\Desktop\adwcleaner_3.212.exe 2014-06-22 20:55 - 2014-06-22 20:53 - 00001161 _____ () C:\Users\*****\Desktop\mbam.txt 2014-06-22 20:19 - 2014-06-22 20:19 - 00000863 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-06-22 20:19 - 2014-06-22 20:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-06-22 20:18 - 2014-06-22 20:18 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-06-22 20:18 - 2014-06-22 20:18 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2014-06-22 20:12 - 2014-06-22 20:12 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\*****\Desktop\mbam-setup-2.0.2.1012.exe 2014-06-22 19:55 - 2011-05-03 12:38 - 00000422 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{EE06053A-1882-4935-9827-74EA8F2D0780}.job 2014-06-18 19:01 - 2012-05-19 10:45 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service 2014-06-18 18:59 - 2014-06-18 18:58 - 00013481 _____ () C:\Users\*****\Desktop\Combofix.txt 2014-06-18 18:54 - 2014-06-18 18:54 - 00013497 _____ () C:\ComboFix.txt 2014-06-18 18:54 - 2014-06-18 18:54 - 00000000 ____D () C:\Users\Public\AppData\Local\temp 2014-06-18 18:54 - 2014-06-18 18:54 - 00000000 ____D () C:\Users\Default\AppData\Local\temp 2014-06-18 18:54 - 2014-06-18 18:54 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp 2014-06-18 18:54 - 2014-06-18 18:37 - 00000000 ____D () C:\Qoobox 2014-06-18 18:54 - 2014-06-18 18:37 - 00000000 ____D () C:\ComboFix 2014-06-18 18:54 - 2006-11-02 13:18 - 00000000 __RHD () C:\Users\Default 2014-06-18 18:54 - 2006-11-02 13:18 - 00000000 ___RD () C:\Users\Public 2014-06-18 18:52 - 2014-06-18 18:36 - 00000000 ____D () C:\Windows\erdnt 2014-06-18 18:50 - 2006-11-02 12:23 - 00000215 _____ () C:\Windows\system.ini 2014-06-18 18:33 - 2014-06-18 18:33 - 05206841 ____R (Swearware) C:\Users\*****\Desktop\ComboFix.exe 2014-06-18 18:21 - 2013-11-14 16:06 - 00000000 ____D () C:\Program Files\Common Files\McAfee 2014-06-18 16:45 - 2014-06-18 14:22 - 00000000 ____D () C:\Users\*****\Desktop\TB 2014-06-18 16:44 - 2009-08-08 19:17 - 00002591 _____ () C:\Users\*****\Desktop\Microsoft Office Word 2007.lnk 2014-06-18 14:36 - 2014-06-18 14:36 - 00000847 _____ () C:\Users\*****\Desktop\Gmer.txt 2014-06-18 14:25 - 2014-06-18 13:48 - 00000474 _____ () C:\Users\*****\Desktop\defogger_disable.log 2014-06-18 14:24 - 2014-06-18 14:24 - 00380416 _____ () C:\Users\*****\Desktop\Gmer-19357.exe 2014-06-18 14:22 - 2014-06-18 14:22 - 00034353 _____ () C:\Users\*****\Desktop\Addition_.txt 2014-06-18 14:20 - 2014-06-18 14:20 - 00035158 _____ () C:\Users\*****\Desktop\FRST_.txt 2014-06-18 14:18 - 2014-06-18 14:16 - 00012872 _____ () C:\Users\*****\Desktop\AVSCAN-20140525-210027-04C8C3FE - Editor.txt 2014-06-18 13:55 - 2014-06-18 13:55 - 01072640 _____ (Farbar) C:\Users\*****\Desktop\FRST.exe 2014-06-18 13:48 - 2014-06-18 13:48 - 00000000 _____ () C:\Users\*****\defogger_reenable 2014-06-18 13:47 - 2014-06-18 13:46 - 00050477 _____ () C:\Users\*****\Desktop\Defogger.exe 2014-06-18 12:50 - 2014-06-18 12:50 - 00000000 ____D () C:\Program Files\Mozilla Firefox 2014-06-18 12:32 - 2013-11-14 16:25 - 00000000 ____D () C:\Program Files\McAfee 2014-06-17 13:07 - 2006-11-02 12:33 - 01565124 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-06-17 12:38 - 2011-08-12 11:45 - 00000000 ____D () C:\Users\*****\Streamripper 2014-06-17 12:36 - 2011-08-16 13:13 - 00000000 ____D () C:\Users\*****\Games 2014-06-17 12:35 - 2012-12-27 14:07 - 00000000 ____D () C:\Users\*****\Johanna 2014-06-17 12:35 - 2009-08-20 22:38 - 00000000 ____D () C:\Users\*****\Hörbücher 2014-06-17 12:33 - 2009-08-20 22:30 - 00000000 ____D () C:\Users\*****\Katja 2014-06-17 11:36 - 2009-12-20 17:38 - 00000000 ____D () C:\Users\*****\Desktop\Audiograbber MP3 2014-06-17 11:21 - 2014-06-17 11:05 - 00000000 ____D () C:\Users\*****\CKR Stammbaum 2014-06-17 11:18 - 2009-08-20 22:19 - 00000000 ____D () C:\Users\*****\Fotos 2014-06-17 11:16 - 2009-11-23 00:25 - 00000000 ____D () C:\Users\*****\AppData\Roaming\vlc 2014-06-17 11:07 - 2009-08-20 20:55 - 00020480 _____ () C:\Users\*****\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2014-06-17 10:56 - 2010-01-16 12:51 - 00000000 ____D () C:\Users\*****\Shared Folder 2014-06-16 13:29 - 2013-12-16 22:26 - 00000000 ____D () C:\Users\*****\Anna_Film 2014-06-16 12:56 - 2009-08-20 23:01 - 00000000 ____D () C:\Users\*****\Motive 2014-06-15 11:40 - 2009-02-06 12:45 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-06-15 11:36 - 2013-12-16 20:07 - 00000000 ____D () C:\Windows\system32\MRT 2014-06-15 11:33 - 2006-11-02 12:24 - 92708840 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe 2014-06-11 19:05 - 2006-11-02 14:37 - 00000000 ___RD () C:\Users\Public\Recorded TV 2014-06-11 13:33 - 2014-06-11 13:33 - 00001883 _____ () C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk 2014-06-11 13:33 - 2014-06-11 13:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus 2014-06-11 13:33 - 2014-06-11 13:33 - 00000000 ____D () C:\Program Files\McAfee Security Scan 2014-06-11 13:33 - 2012-06-03 17:48 - 00000000 ____D () C:\ProgramData\McAfee Security Scan 2014-05-25 23:35 - 2014-05-25 23:35 - 00000000 ____D () C:\Users\*****\AntiVir Text 2014-05-25 20:01 - 2014-05-25 20:01 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Avira 2014-05-25 19:58 - 2014-05-25 19:58 - 00001811 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk 2014-05-25 19:58 - 2014-05-25 19:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira 2014-05-25 19:57 - 2014-05-25 19:57 - 00000000 ____D () C:\ProgramData\Avira 2014-05-25 19:57 - 2014-05-25 19:57 - 00000000 ____D () C:\Program Files\Avira 2014-05-25 19:50 - 2014-05-25 19:47 - 137314600 _____ () C:\Users\*****\Downloads\avira_free_antivirus_de_642.exe 2014-05-25 19:37 - 2014-05-24 14:36 - 00000000 ____D () C:\Program Files\Spybot - Search & Destroy 2 2014-05-25 19:35 - 2014-05-24 23:54 - 00000741 _____ () C:\Windows\wininit.ini 2014-05-25 19:35 - 2014-05-24 14:36 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy Some content of TEMP: ==================== C:\Users\*****\AppData\Local\temp\avgnt.exe C:\Users\*****\AppData\Local\temp\Quarantine.exe ==================== Bamital & volsnap Check ================= C:\Windows\explorer.exe => File is digitally signed C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-06-22 21:45 ==================== End Of Log ============================ Als ich das JRT gestartet habe, kam gleich die Meldung: "A bad module has been detected! A reboot is requiered to remove moduls- Press 'y' to reboot now. Press 'n' to reboot later". Ich habe daraufhin erst einmal 'n' gewählt. War das richtig? Oder muss ich das JRT wiederholen? Gruß +katja+ |
|
23.06.2014, 18:49
| #8 |
| /// the machine /// TB-Ausbilder | Online-Banking Sicherheitsüberprüfung/Trojaner TR/Crypt.ZPACK80204/Fehler RegSvr32ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
24.06.2014, 11:48
| #9 |
| | Online-Banking Sicherheitsüberprüfung/Trojaner TR/Crypt.ZPACK80204/Fehler RegSvr32 Hallo schrauber, habe den ESET Online Scan durchgeführ inkl. externer Festpaltte. Leider wurden 4 Bedrohngen gefunden (sowohl auf Laufwerk C: als auch der externen Festplatte): Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7587
# api_version=3.0.2
# EOSSerial=36b2a357c0d1fa4093b5c9bffe7e7afb
# engine=18855
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-06-24 10:24:29
# local_time=2014-06-24 12:24:29 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 100 9720 3978467 0 0
# compatibility_mode_1='McAfee Anti-Virus and Anti-Spyware'
# compatibility_mode=5124 16777214 100 100 496914 166415647 0 0
# compatibility_mode_1=''
# compatibility_mode=5892 16776574 100 100 5178692 241138197 0 0
# scanned=210445
# found=4
# cleaned=0
# scan_time=7702
sh=50587D79D46C35B75DDF7F8D1866F8597319B567 ft=1 fh=03f0f0c2e1599890 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\*****\Downloads\Free PDF to Word Doc Converter - CHIP-Downloader.exe"
sh=50587D79D46C35B75DDF7F8D1866F8597319B567 ft=1 fh=03f0f0c2e1599890 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="F:\*****\Downloads\Free PDF to Word Doc Converter - CHIP-Downloader.exe"
sh=67112FF10778696366E20309A551BAC45D40F26A ft=1 fh=d5d993d7cb04e4ef vn="Win32/iLivid.A evtl. unerwünschte Anwendung" ac=I fn="F:\*****\Downloads\iLividSetup-r0-n-bf.exe"
sh=D08BD350E0531B2DDDC4E81A69B001B2D0550003 ft=1 fh=f6585e7df79a84bc vn="Win32/Toolbar.SearchSuite evtl. unerwünschte Anwendung" ac=I fn="F:\*****\Downloads\iLividSetup-r706-n-bf.exe"
Ich hatte ja keinen Haken bei "Entdeckte bedrohungen entfernen" gesetzt. Die Bedrohungen sind also noch da. Habe ESET noch nicht deinstalliert. Was passiert eigentlich mit den beiden im Betreff genannten von Avira entdeckten Trojaneren, die sich bei Avira in Quarantäne befinden? Danke für Deine Hilfe, +katja+ |
|
24.06.2014, 17:49
| #10 |
| /// the machine /// TB-Ausbilder | Online-Banking Sicherheitsüberprüfung/Trojaner TR/Crypt.ZPACK80204/Fehler RegSvr32 die kannste in Quarantäne lassen oder löschen. Funde von ESET sind nur Downloads, kannste löschen. Dann den Rest von oben bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
24.06.2014, 18:54
| #11 |
| | Online-Banking Sicherheitsüberprüfung/Trojaner TR/Crypt.ZPACK80204/Fehler RegSvr32 Hallo schrauber, anbei das Ergebnis vom SecurityCheck und das neue FRST: Code:
ATTFilter Results of screen317's Security Check version 0.99.83 Windows Vista Service Pack 2 x86 (UAC is enabled) ``````````````Antivirus/Firewall Check:`````````````` Avira Desktop McAfee Anti-Virus und Anti-Spyware Antivirus up to date! (On Access scanning disabled!) `````````Anti-malware/Other Utilities Check:````````` Java(TM) 6 Update 11 Java 7 Update 55 Adobe Flash Player 13.0.0.214 Adobe Reader XI Mozilla Firefox (30.0) ````````Process Check: objlist.exe by Laurent```````` Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbam.exe Avira Antivir avgnt.exe Avira Antivir avguard.exe Malwarebytes Anti-Malware mbamscheduler.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: % ````````````````````End of Log`````````````````````` FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:16-06-2014 Ran by ***** (administrator) on *****-PC on 24-06-2014 19:33:07 Running from C:\Users\*****\Desktop Platform: Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: German Standard Internet Explorer Version 7 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Microsoft Corporation) C:\Windows\System32\SLsvc.exe (Microsoft Corporation) C:\Windows\System32\wlanext.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Lexar Media, Inc.) C:\Windows\System32\LxrSII1s.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe (McAfee, Inc.) C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe (Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\VS7DEBUG\mdm.exe (McAfee, Inc.) C:\Windows\System32\mfevtps.exe (Nero AG) C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe (Prolific Technology Inc.) C:\Windows\System32\IoctlSvc.exe () C:\Windows\System32\PSIService.exe () C:\Program Files\Cyberlink\Shared files\RichVideo.exe (Telefónica) C:\Program Files\o2\Mobile Connection Manager\ImpWiFiSvc.exe () C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe (McAfee, Inc.) C:\Program Files\McAfee\MSC\McAPExe.exe (McAfee, Inc.) C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe (McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe () C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe (Realtek Semiconductor) C:\Windows\RtHDVCpl.exe (Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (cyberlink) C:\Program Files\Cyberlink\Shared files\brs.exe (Geek Software GmbH) C:\Program Files\PDF24\pdf24.exe (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation) C:\Windows\ehome\ehtray.exe (Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe (Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe (McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (Microsoft Corporation) C:\Windows\ehome\ehmsas.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe (Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe (McAfee, Inc.) C:\Program Files\McAfee\SiteAdvisor\saUI.exe (Microsoft Corporation) C:\Windows\System32\conime.exe (McAfee, Inc.) C:\Program Files\McAfee\MSC\mcupdmgr.exe (McAfee, Inc.) C:\Program Files\Common Files\McAfee\Platform\McUICnt.exe (Macrovision Corporation) C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [6294048 2008-09-18] (Realtek Semiconductor) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1328424 2008-07-03] (Synaptics, Inc.) HKLM\...\Run: [PDVD8LanguageShortcut] => C:\Program Files\HomeCinema\PowerDVD8\Language\Language.exe [50472 2007-12-14] () HKLM\...\Run: [BDRegion] => C:\Program Files\Cyberlink\Shared Files\brs.exe [75048 2008-10-07] (cyberlink) HKLM\...\Run: [UCam_Menu] => C:\Program Files\HomeCinema\YouCam\MUITransfer\MUIStartMenu.exe [210216 2008-06-13] (CyberLink Corp.) HKLM\...\Run: [PDFPrint] => C:\Program Files\PDF24\pdf24.exe [162856 2013-03-20] (Geek Software GmbH) HKLM\...\Run: [mcpltui_exe] => C:\Program Files\McAfee.com\Agent\mcagent.exe [517392 2014-04-25] (McAfee, Inc.) HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKLM\...\Run: [Skytel] => C:\Windows\Skytel.exe [1833504 2008-09-18] (Realtek Semiconductor Corp.) HKLM\...\Run: [NvCplDaemon] => C:\Windows\system32\NvCpl.dll [13560352 2008-09-29] (NVIDIA Corporation) HKLM\...\Run: [NvMediaCenter] => C:\Windows\system32\NvMcTray.dll [92704 2008-09-29] (NVIDIA Corporation) HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2014-05-08] (Adobe Systems Incorporated) HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [737872 2014-05-09] (Avira Operations GmbH & Co. KG) HKU\.DEFAULT\...\Run: [Picasa Media Detector] => C:\Program Files\Picasa2\PicasaMediaDetector.exe [443968 2008-08-21] (Google Inc.) HKU\S-1-5-21-1682483986-195542428-201166501-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-21] (Microsoft Corporation) HKU\S-1-5-21-1682483986-195542428-201166501-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [21444224 2014-05-08] (Skype Technologies S.A.) HKU\S-1-5-21-1682483986-195542428-201166501-1000\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-21] (Microsoft Corporation) HKU\S-1-5-21-1682483986-195542428-201166501-1000\...\Run: [ISUSPM] => C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe [218032 2006-09-11] (Macrovision Corporation) AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll => C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll [123392 2010-09-11] (Google) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.) BootExecute: autocheck autochk * sdnclean.exe ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank SearchScopes: HKLM - DefaultScope value is missing. SearchScopes: HKCU - {FF752B98-5BF8-4DF0-AF47-8A47E8A4D343} URL = hxxp://de.search.yahoo.com/search?fr=mcafee&type=A011DE0&p={SearchTerms} BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.) BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: No Name - {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - C:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - C:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} hxxp://www.photodose.de/ips-opdata/operator/69189345/objects/jordan.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation) Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation) Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation) Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - C:\Program Files\McAfee\MSC\McSnIePl.dll (McAfee, Inc.) Winsock: Catalog5 05 C:\Program Files\Bonjour\mdnsNSP.dll [152864] (Apple Inc.) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\0zx6jvlc.default FF SearchEngineOrder.1: Sichere Suche FF Homepage: hxxp://www.google.com/ FF Keyword.URL: hxxp://de.search.yahoo.com/search?fr=mcafee&type=A111DE0&p= FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_13_0_0_214.dll () FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF Plugin: @google.com/npPicasa2,version=2.0.0 - C:\Program Files\Picasa2\npPicasa2.dll (Google, Inc.) FF Plugin: @google.com/npPicasa3,version=3.0.0 - C:\Program Files\Picasa2\npPicasa3.dll (Google, Inc.) FF Plugin: @innoplus.de/ino3DViewer - C:\Program Files\innoplus\3D-Viewer-innoPlus\npIno3DViewer.dll (INNOVA-engineering GmbH Dresden) FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @mcafee.com/MSC,version=10 - c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL () FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF Plugin: @videolan.org/vlc,version=2.1.2 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin: @videolan.org/vlc,version=2.1.3 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npwachk.dll (Nullsoft) FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\0zx6jvlc.default\searchplugins\aol-search.xml FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\0zx6jvlc.default\searchplugins\nation-secure-search.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\McSiteAdvisor.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: 20-20 3D Viewer - IKEA - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\0zx6jvlc.default\Extensions\2020Player_IKEA@2020Technologies.com [2012-01-12] FF Extension: DDBAC - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\0zx6jvlc.default\Extensions\{271A3CF5-5A54-447B-A08F-BE805F0DA60A} [2011-10-11] FF Extension: McAfee SiteAdvisor - C:\Program Files\McAfee\SiteAdvisor [2013-11-14] FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [] FF HKLM\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files\McAfee\SiteAdvisor FF Extension: McAfee SiteAdvisor - C:\Program Files\McAfee\SiteAdvisor [2013-11-14] FF HKLM\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK FF Extension: McAfee Anti-Spam Thunderbird Extension - C:\Program Files\McAfee\MSK [2013-11-14] FF HKCU\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04] Chrome: ======= CHR HomePage: hxxp://www.google.com CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files\McAfee\SiteAdvisor\McChPlg.crx [2013-11-14] ========================== Services (Whitelisted) ================= R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-05-09] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-05-09] (Avira Operations GmbH & Co. KG) R2 ForceWare Intelligent Application Manager (IAM); C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe [450560 2008-09-08] () [File not signed] S3 GoogleDesktopManager-051210-111108; C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [30192 2010-09-11] (Google) R2 HomeNetSvc; C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe [281560 2013-07-30] (McAfee, Inc.) R2 LxrSII1s; C:\Windows\system32\LxrSII1s.exe [65536 2009-12-30] (Lexar Media, Inc.) [File not signed] R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation) R2 McAfee SiteAdvisor Service; C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe [281560 2013-07-30] (McAfee, Inc.) R2 McAPExe; C:\Program Files\McAfee\MSC\McAPExe.exe [145568 2014-04-25] (McAfee, Inc.) S3 McAWFwk; C:\Program Files\Common Files\McAfee\ActWiz\McAWFwk.exe [287728 2013-04-09] (McAfee, Inc.) S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [235696 2014-04-09] (McAfee, Inc.) R2 McMPFSvc; C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe [281560 2013-07-30] (McAfee, Inc.) R2 McNaiAnn; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [281560 2013-07-30] (McAfee, Inc.) S3 McODS; C:\Program Files\McAfee\VirusScan\mcods.exe [471592 2013-08-02] (McAfee, Inc.) S4 McOobeSv2; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [281560 2013-07-30] (McAfee, Inc.) R2 mcpltsvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [281560 2013-07-30] (McAfee, Inc.) R2 McProxy; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [281560 2013-07-30] (McAfee, Inc.) R2 MDM; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [335872 2006-10-26] (Microsoft Corporation) [File not signed] R2 mfecore; C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe [655936 2014-03-18] (McAfee, Inc.) R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [169800 2014-04-03] (McAfee, Inc.) R2 mfevtp; C:\Windows\system32\mfevtps.exe [179600 2014-04-03] (McAfee, Inc.) S2 MSK80Service; C:\Program Files\Common Files\Mcafee\Platform\McSvcHost\McSvHost.exe [281560 2013-07-30] (McAfee, Inc.) R2 nSvcIp; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe [184320 2008-09-08] () [File not signed] R2 PLFlash DeviceIoControl Service; C:\Windows\system32\IoctlSvc.exe [81920 2006-12-19] (Prolific Technology Inc.) [File not signed] R2 ProtexisLicensing; C:\Windows\system32\PSIService.exe [177704 2007-06-05] () R2 RichVideo; C:\Program Files\Cyberlink\Shared files\RichVideo.exe [241734 2008-06-28] () [File not signed] R2 TGCM_ImportWiFiSvc; C:\Program Files\o2\Mobile Connection Manager\ImpWiFiSvc.exe [201344 2012-01-10] (Telefónica) S3 usnjsvc; C:\Program Files\Windows Live\Messenger\usnsvc.exe [98328 2007-10-18] (Microsoft Corporation) S3 WLSetupSvc; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [266240 2007-10-25] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [93528 2014-05-09] (Avira Operations GmbH & Co. KG) R1 avgtp; C:\Windows\system32\drivers\avgtpx86.sys [37664 2013-11-11] (AVG Technologies) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-05-09] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2014-05-09] (Avira Operations GmbH & Co. KG) R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [61400 2014-04-03] (McAfee, Inc.) S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [147912 2013-09-23] (McAfee, Inc.) R2 LxrSII1d; C:\Windows\System32\Drivers\LxrSII1d.sys [63448 2009-12-30] (Lexar Media, Inc.) S3 massfilter; C:\Windows\System32\drivers\massfilter.sys [9216 2010-11-26] (MBB Incorporated) S3 massfilter_hs; C:\Windows\System32\drivers\massfilter_hs.sys [9728 2010-10-15] (ZTE Incorporated) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-06-24] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-05-12] (Malwarebytes Corporation) R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [134600 2014-04-03] (McAfee, Inc.) R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [236672 2014-04-03] (McAfee, Inc.) S3 mfebopk; C:\Windows\System32\drivers\mfebopk.sys [66408 2014-04-03] (McAfee, Inc.) R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [367776 2014-04-03] (McAfee, Inc.) R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [574576 2014-04-03] (McAfee, Inc.) R3 mfencbdc; C:\Windows\System32\DRIVERS\mfencbdc.sys [345584 2014-03-18] (McAfee, Inc.) S3 mfencrk; C:\Windows\System32\DRIVERS\mfencrk.sys [81264 2014-03-18] (McAfee, Inc.) R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [215624 2014-04-03] (McAfee, Inc.) R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2014-05-09] (Avira GmbH) S3 XUIF; C:\Windows\System32\Drivers\x10ufx2.sys [27416 2006-11-30] (X10 Wireless Technology, Inc.) R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796}; C:\Program Files\HomeCinema\PlayMovie\000.fcl [61424 2008-10-21] (Cyberlink Corp.) R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}; C:\Program Files\HomeCinema\PowerDVD8\000.fcl [61424 2008-10-07] (Cyberlink Corp.) U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation) S3 catchme; \??\C:\Users\*****\AppData\Local\Temp\catchme.sys [X] S3 IpInIp; system32\DRIVERS\ipinip.sys [X] S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X] S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X] S3 USBAAPL; System32\Drivers\usbaapl.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-06-24 19:33 - 2014-06-24 19:33 - 00021750 _____ () C:\Users\*****\Desktop\FRST.txt 2014-06-24 19:32 - 2014-06-24 19:32 - 00000959 _____ () C:\Users\*****\Desktop\SecurityCheck.txt 2014-06-24 19:22 - 2014-06-24 19:22 - 00000000 ____D () C:\Users\*****\AppData\Roaming\InstallShield 2014-06-24 12:35 - 2014-06-24 12:35 - 00854367 _____ () C:\Users\*****\Desktop\SecurityCheck.exe 2014-06-24 12:28 - 2014-06-24 12:28 - 00001717 _____ () C:\Users\*****\Desktop\ESET.txt 2014-06-24 11:21 - 2014-06-24 11:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee 2014-06-24 10:03 - 2014-06-24 10:04 - 02347384 _____ (ESET) C:\Users\*****\Desktop\esetsmartinstaller_deu.exe 2014-06-23 09:09 - 2014-06-23 09:09 - 00039385 _____ () C:\Users\*****\Desktop\FRST_230614.txt 2014-06-22 21:58 - 2014-06-22 22:48 - 00000767 _____ () C:\Users\*****\Desktop\JRT.txt 2014-06-22 21:50 - 2014-06-22 21:50 - 00000000 ____D () C:\Windows\ERUNT 2014-06-22 21:49 - 2014-06-22 21:49 - 01016261 _____ (Thisisu) C:\Users\*****\Desktop\JRT.exe 2014-06-22 21:42 - 2014-06-22 21:42 - 00005750 _____ () C:\Users\*****\Desktop\AdwCleaner[S1].txt 2014-06-22 21:32 - 2014-06-22 21:34 - 00000000 ____D () C:\AdwCleaner 2014-06-22 20:56 - 2014-06-22 20:56 - 01333465 _____ () C:\Users\*****\Desktop\adwcleaner_3.212.exe 2014-06-22 20:53 - 2014-06-22 20:55 - 00001161 _____ () C:\Users\*****\Desktop\mbam.txt 2014-06-22 20:19 - 2014-06-24 12:39 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-06-22 20:19 - 2014-06-22 20:19 - 00000863 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-06-22 20:19 - 2014-06-22 20:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-06-22 20:18 - 2014-06-22 20:18 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-06-22 20:18 - 2014-06-22 20:18 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2014-06-22 20:18 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-06-22 20:18 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-06-22 20:18 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-06-22 20:12 - 2014-06-22 20:12 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\*****\Desktop\mbam-setup-2.0.2.1012.exe 2014-06-18 18:58 - 2014-06-18 18:59 - 00013481 _____ () C:\Users\*****\Desktop\Combofix.txt 2014-06-18 18:54 - 2014-06-24 19:33 - 00000000 ____D () C:\Users\*****\AppData\Local\temp 2014-06-18 18:54 - 2014-06-18 18:54 - 00013497 _____ () C:\ComboFix.txt 2014-06-18 18:54 - 2014-06-18 18:54 - 00000000 ____D () C:\Users\Public\AppData\Local\temp 2014-06-18 18:54 - 2014-06-18 18:54 - 00000000 ____D () C:\Users\Default\AppData\Local\temp 2014-06-18 18:54 - 2014-06-18 18:54 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp 2014-06-18 18:37 - 2014-06-18 18:54 - 00000000 ____D () C:\Qoobox 2014-06-18 18:37 - 2014-06-18 18:54 - 00000000 ____D () C:\ComboFix 2014-06-18 18:37 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe 2014-06-18 18:37 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe 2014-06-18 18:37 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2014-06-18 18:37 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2014-06-18 18:37 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2014-06-18 18:37 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe 2014-06-18 18:37 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe 2014-06-18 18:37 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe 2014-06-18 18:36 - 2014-06-18 18:52 - 00000000 ____D () C:\Windows\erdnt 2014-06-18 18:33 - 2014-06-18 18:33 - 05206841 ____R (Swearware) C:\Users\*****\Desktop\ComboFix.exe 2014-06-18 14:36 - 2014-06-18 14:36 - 00000847 _____ () C:\Users\*****\Desktop\Gmer.txt 2014-06-18 14:24 - 2014-06-18 14:24 - 00380416 _____ () C:\Users\*****\Desktop\Gmer-19357.exe 2014-06-18 14:22 - 2014-06-23 09:08 - 00000000 ____D () C:\Users\*****\Desktop\TB 2014-06-18 14:22 - 2014-06-18 14:22 - 00034353 _____ () C:\Users\*****\Desktop\Addition_.txt 2014-06-18 14:20 - 2014-06-18 14:20 - 00035158 _____ () C:\Users\*****\Desktop\FRST_.txt 2014-06-18 14:16 - 2014-06-18 14:18 - 00012872 _____ () C:\Users\*****\Desktop\AVSCAN-20140525-210027-04C8C3FE - Editor.txt 2014-06-18 13:56 - 2014-06-24 19:33 - 00000000 ____D () C:\FRST 2014-06-18 13:55 - 2014-06-18 13:55 - 01072640 _____ (Farbar) C:\Users\*****\Desktop\FRST.exe 2014-06-18 13:48 - 2014-06-18 14:25 - 00000474 _____ () C:\Users\*****\Desktop\defogger_disable.log 2014-06-18 13:48 - 2014-06-18 13:48 - 00000000 _____ () C:\Users\*****\defogger_reenable 2014-06-18 13:46 - 2014-06-18 13:47 - 00050477 _____ () C:\Users\*****\Desktop\Defogger.exe 2014-06-18 12:50 - 2014-06-18 12:50 - 00000000 ____D () C:\Program Files\Mozilla Firefox 2014-06-17 11:05 - 2014-06-17 11:21 - 00000000 ____D () C:\Users\*****\CKR Stammbaum 2014-06-11 13:46 - 2014-05-06 06:46 - 03630592 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-06-11 13:46 - 2014-05-06 06:46 - 01177600 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-06-11 13:46 - 2014-05-06 06:46 - 00834048 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-06-11 13:46 - 2014-05-06 06:46 - 00671744 _____ (Microsoft Corporation) C:\Windows\system32\mstime.dll 2014-06-11 13:46 - 2014-05-06 06:46 - 00498688 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-06-11 13:46 - 2014-05-06 06:46 - 00480256 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-06-11 13:46 - 2014-05-06 06:46 - 00106496 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2014-06-11 13:46 - 2014-05-06 06:45 - 06119424 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-06-11 13:46 - 2014-05-06 06:45 - 00380928 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-06-11 13:46 - 2014-05-06 06:45 - 00271872 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-06-11 13:46 - 2014-05-06 06:45 - 00193024 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll 2014-06-11 13:46 - 2014-05-06 06:45 - 00180736 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-06-11 13:46 - 2014-05-06 06:45 - 00027648 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-06-11 13:46 - 2014-05-06 06:45 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\corpol.dll 2014-06-11 13:46 - 2014-05-06 05:16 - 00389632 _____ (Microsoft Corporation) C:\Windows\system32\html.iec 2014-06-11 13:46 - 2014-05-06 05:07 - 01383424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-06-11 13:46 - 2014-04-26 18:01 - 00502784 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll 2014-06-11 13:46 - 2014-04-05 04:42 - 00905664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys 2014-06-11 13:46 - 2014-03-10 03:22 - 01401344 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll 2014-06-11 13:46 - 2014-03-10 03:22 - 01248768 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll 2014-06-11 13:33 - 2014-06-11 13:33 - 00001883 _____ () C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk 2014-06-11 13:33 - 2014-06-11 13:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus 2014-06-11 13:33 - 2014-06-11 13:33 - 00000000 ____D () C:\Program Files\McAfee Security Scan 2014-05-25 23:35 - 2014-05-25 23:35 - 00000000 ____D () C:\Users\*****\AntiVir Text 2014-05-25 20:01 - 2014-05-25 20:01 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Avira 2014-05-25 19:58 - 2014-05-25 19:58 - 00001811 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk 2014-05-25 19:58 - 2014-05-25 19:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira 2014-05-25 19:57 - 2014-05-25 19:57 - 00000000 ____D () C:\ProgramData\Avira 2014-05-25 19:57 - 2014-05-25 19:57 - 00000000 ____D () C:\Program Files\Avira 2014-05-25 19:57 - 2014-05-09 11:16 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys 2014-05-25 19:57 - 2014-05-09 11:16 - 00093528 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys 2014-05-25 19:57 - 2014-05-09 11:16 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys 2014-05-25 19:57 - 2014-05-09 11:16 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys 2014-05-25 19:47 - 2014-05-25 19:50 - 137314600 _____ () C:\Users\*****\Downloads\avira_free_antivirus_de_642.exe ==================== One Month Modified Files and Folders ======= 2014-06-24 19:33 - 2014-06-24 19:33 - 00021750 _____ () C:\Users\*****\Desktop\FRST.txt 2014-06-24 19:33 - 2014-06-18 18:54 - 00000000 ____D () C:\Users\*****\AppData\Local\temp 2014-06-24 19:33 - 2014-06-18 13:56 - 00000000 ____D () C:\FRST 2014-06-24 19:32 - 2014-06-24 19:32 - 00000959 _____ () C:\Users\*****\Desktop\SecurityCheck.txt 2014-06-24 19:31 - 2006-11-02 14:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 2014-06-24 19:31 - 2006-11-02 14:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 2014-06-24 19:25 - 2009-08-08 18:31 - 01623165 _____ () C:\Windows\WindowsUpdate.log 2014-06-24 19:22 - 2014-06-24 19:22 - 00000000 ____D () C:\Users\*****\AppData\Roaming\InstallShield 2014-06-24 18:55 - 2014-05-18 11:41 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-06-24 12:39 - 2014-06-22 20:19 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-06-24 12:35 - 2014-06-24 12:35 - 00854367 _____ () C:\Users\*****\Desktop\SecurityCheck.exe 2014-06-24 12:28 - 2014-06-24 12:28 - 00001717 _____ () C:\Users\*****\Desktop\ESET.txt 2014-06-24 11:21 - 2014-06-24 11:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee 2014-06-24 10:09 - 2009-02-05 16:40 - 00042749 _____ () C:\ProgramData\nvModes.dat 2014-06-24 10:09 - 2009-02-05 16:40 - 00042749 _____ () C:\ProgramData\nvModes.001 2014-06-24 10:04 - 2014-06-24 10:03 - 02347384 _____ (ESET) C:\Users\*****\Desktop\esetsmartinstaller_deu.exe 2014-06-24 09:35 - 2011-05-03 12:38 - 00000422 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{EE06053A-1882-4935-9827-74EA8F2D0780}.job 2014-06-24 09:34 - 2013-11-14 16:25 - 00000000 ____D () C:\Program Files\McAfee 2014-06-24 09:32 - 2009-08-08 18:37 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Home Cinema 2014-06-24 09:31 - 2006-11-02 15:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-06-24 09:30 - 2008-01-21 04:47 - 00613532 _____ () C:\Windows\PFRO.log 2014-06-23 19:37 - 2006-11-02 15:01 - 00032514 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-06-23 09:09 - 2014-06-23 09:09 - 00039385 _____ () C:\Users\*****\Desktop\FRST_230614.txt 2014-06-23 09:08 - 2014-06-18 14:22 - 00000000 ____D () C:\Users\*****\Desktop\TB 2014-06-22 22:48 - 2014-06-22 21:58 - 00000767 _____ () C:\Users\*****\Desktop\JRT.txt 2014-06-22 21:50 - 2014-06-22 21:50 - 00000000 ____D () C:\Windows\ERUNT 2014-06-22 21:49 - 2014-06-22 21:49 - 01016261 _____ (Thisisu) C:\Users\*****\Desktop\JRT.exe 2014-06-22 21:49 - 2011-10-26 13:44 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Skype 2014-06-22 21:42 - 2014-06-22 21:42 - 00005750 _____ () C:\Users\*****\Desktop\AdwCleaner[S1].txt 2014-06-22 21:34 - 2014-06-22 21:32 - 00000000 ____D () C:\AdwCleaner 2014-06-22 21:28 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\SchCache 2014-06-22 20:56 - 2014-06-22 20:56 - 01333465 _____ () C:\Users\*****\Desktop\adwcleaner_3.212.exe 2014-06-22 20:55 - 2014-06-22 20:53 - 00001161 _____ () C:\Users\*****\Desktop\mbam.txt 2014-06-22 20:19 - 2014-06-22 20:19 - 00000863 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-06-22 20:19 - 2014-06-22 20:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-06-22 20:18 - 2014-06-22 20:18 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-06-22 20:18 - 2014-06-22 20:18 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2014-06-22 20:12 - 2014-06-22 20:12 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\*****\Desktop\mbam-setup-2.0.2.1012.exe 2014-06-18 19:01 - 2012-05-19 10:45 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service 2014-06-18 18:59 - 2014-06-18 18:58 - 00013481 _____ () C:\Users\*****\Desktop\Combofix.txt 2014-06-18 18:54 - 2014-06-18 18:54 - 00013497 _____ () C:\ComboFix.txt 2014-06-18 18:54 - 2014-06-18 18:54 - 00000000 ____D () C:\Users\Public\AppData\Local\temp 2014-06-18 18:54 - 2014-06-18 18:54 - 00000000 ____D () C:\Users\Default\AppData\Local\temp 2014-06-18 18:54 - 2014-06-18 18:54 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp 2014-06-18 18:54 - 2014-06-18 18:37 - 00000000 ____D () C:\Qoobox 2014-06-18 18:54 - 2014-06-18 18:37 - 00000000 ____D () C:\ComboFix 2014-06-18 18:54 - 2006-11-02 13:18 - 00000000 __RHD () C:\Users\Default 2014-06-18 18:54 - 2006-11-02 13:18 - 00000000 ___RD () C:\Users\Public 2014-06-18 18:52 - 2014-06-18 18:36 - 00000000 ____D () C:\Windows\erdnt 2014-06-18 18:50 - 2006-11-02 12:23 - 00000215 _____ () C:\Windows\system.ini 2014-06-18 18:33 - 2014-06-18 18:33 - 05206841 ____R (Swearware) C:\Users\*****\Desktop\ComboFix.exe 2014-06-18 18:21 - 2013-11-14 16:06 - 00000000 ____D () C:\Program Files\Common Files\McAfee 2014-06-18 16:44 - 2009-08-08 19:17 - 00002591 _____ () C:\Users\*****\Desktop\Microsoft Office Word 2007.lnk 2014-06-18 14:36 - 2014-06-18 14:36 - 00000847 _____ () C:\Users\*****\Desktop\Gmer.txt 2014-06-18 14:25 - 2014-06-18 13:48 - 00000474 _____ () C:\Users\*****\Desktop\defogger_disable.log 2014-06-18 14:24 - 2014-06-18 14:24 - 00380416 _____ () C:\Users\*****\Desktop\Gmer-19357.exe 2014-06-18 14:22 - 2014-06-18 14:22 - 00034353 _____ () C:\Users\*****\Desktop\Addition_.txt 2014-06-18 14:20 - 2014-06-18 14:20 - 00035158 _____ () C:\Users\*****\Desktop\FRST_.txt 2014-06-18 14:18 - 2014-06-18 14:16 - 00012872 _____ () C:\Users\*****\Desktop\AVSCAN-20140525-210027-04C8C3FE - Editor.txt 2014-06-18 13:55 - 2014-06-18 13:55 - 01072640 _____ (Farbar) C:\Users\*****\Desktop\FRST.exe 2014-06-18 13:48 - 2014-06-18 13:48 - 00000000 _____ () C:\Users\*****\defogger_reenable 2014-06-18 13:47 - 2014-06-18 13:46 - 00050477 _____ () C:\Users\*****\Desktop\Defogger.exe 2014-06-18 12:50 - 2014-06-18 12:50 - 00000000 ____D () C:\Program Files\Mozilla Firefox 2014-06-17 13:07 - 2006-11-02 12:33 - 01565124 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-06-17 12:38 - 2011-08-12 11:45 - 00000000 ____D () C:\Users\*****\Streamripper 2014-06-17 12:36 - 2011-08-16 13:13 - 00000000 ____D () C:\Users\*****\Games 2014-06-17 12:35 - 2012-12-27 14:07 - 00000000 ____D () C:\Users\*****\Johanna 2014-06-17 12:35 - 2009-08-20 22:38 - 00000000 ____D () C:\Users\*****\Hörbücher 2014-06-17 12:33 - 2009-08-20 22:30 - 00000000 ____D () C:\Users\*****\Katja 2014-06-17 11:36 - 2009-12-20 17:38 - 00000000 ____D () C:\Users\*****\Desktop\Audiograbber MP3 2014-06-17 11:21 - 2014-06-17 11:05 - 00000000 ____D () C:\Users\*****\CKR Stammbaum 2014-06-17 11:18 - 2009-08-20 22:19 - 00000000 ____D () C:\Users\*****\Fotos 2014-06-17 11:16 - 2009-11-23 00:25 - 00000000 ____D () C:\Users\*****\AppData\Roaming\vlc 2014-06-17 11:07 - 2009-08-20 20:55 - 00020480 _____ () C:\Users\*****\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2014-06-17 10:56 - 2010-01-16 12:51 - 00000000 ____D () C:\Users\*****\Shared Folder 2014-06-16 13:29 - 2013-12-16 22:26 - 00000000 ____D () C:\Users\*****\Anna_Film 2014-06-16 12:56 - 2009-08-20 23:01 - 00000000 ____D () C:\Users\*****\Motive 2014-06-15 11:40 - 2009-02-06 12:45 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-06-15 11:36 - 2013-12-16 20:07 - 00000000 ____D () C:\Windows\system32\MRT 2014-06-15 11:33 - 2006-11-02 12:24 - 92708840 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe 2014-06-11 19:05 - 2006-11-02 14:37 - 00000000 ___RD () C:\Users\Public\Recorded TV 2014-06-11 13:33 - 2014-06-11 13:33 - 00001883 _____ () C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk 2014-06-11 13:33 - 2014-06-11 13:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus 2014-06-11 13:33 - 2014-06-11 13:33 - 00000000 ____D () C:\Program Files\McAfee Security Scan 2014-06-11 13:33 - 2012-06-03 17:48 - 00000000 ____D () C:\ProgramData\McAfee Security Scan 2014-05-25 23:35 - 2014-05-25 23:35 - 00000000 ____D () C:\Users\*****\AntiVir Text 2014-05-25 20:01 - 2014-05-25 20:01 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Avira 2014-05-25 19:58 - 2014-05-25 19:58 - 00001811 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk 2014-05-25 19:58 - 2014-05-25 19:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira 2014-05-25 19:57 - 2014-05-25 19:57 - 00000000 ____D () C:\ProgramData\Avira 2014-05-25 19:57 - 2014-05-25 19:57 - 00000000 ____D () C:\Program Files\Avira 2014-05-25 19:50 - 2014-05-25 19:47 - 137314600 _____ () C:\Users\*****\Downloads\avira_free_antivirus_de_642.exe 2014-05-25 19:37 - 2014-05-24 14:36 - 00000000 ____D () C:\Program Files\Spybot - Search & Destroy 2 2014-05-25 19:35 - 2014-05-24 23:54 - 00000741 _____ () C:\Windows\wininit.ini 2014-05-25 19:35 - 2014-05-24 14:36 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy Some content of TEMP: ==================== C:\Users\*****\AppData\Local\temp\avgnt.exe C:\Users\*****\AppData\Local\temp\Quarantine.exe ==================== Bamital & volsnap Check ================= C:\Windows\explorer.exe => File is digitally signed C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-06-24 09:44 ==================== End Of Log ============================ --- --- --- --- --- --- Ist damit mein Rechner inkl. externer Festplatte wieder sauber? Gruß +katja+ |
|
25.06.2014, 17:59
| #12 |
| /// the machine /// TB-Ausbilder | Online-Banking Sicherheitsüberprüfung/Trojaner TR/Crypt.ZPACK80204/Fehler RegSvr32 Fertig Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
26.06.2014, 16:24
| #13 |
| | Online-Banking Sicherheitsüberprüfung/Trojaner TR/Crypt.ZPACK80204/Fehler RegSvr32 Hallo schrauber, vielen Dank für Deine tolle Hilfe!  Ich hoffe, jetzt ist alles wieder ok. Ich sehe erst einmal keine Fragen mehr. Ich werde mir Deine Verbesserungstipps zu Herzen nehmen. Beste Grüße +katja+ |
|
27.06.2014, 11:23
| #14 |
| /// the machine /// TB-Ausbilder | Online-Banking Sicherheitsüberprüfung/Trojaner TR/Crypt.ZPACK80204/Fehler RegSvr32 Gern Geschehen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Online-Banking Sicherheitsüberprüfung/Trojaner TR/Crypt.ZPACK80204/Fehler RegSvr32 |
| 4d36e972-e325-11ce-bfc1-08002be10318, antivirus, association, audiograbber, bonjour, converter, device driver, dringend, dvdvideosoft ltd., flash player, hdd0(c:, installation, jrt wiederholen?, mcafee firewall, secure search, security, siteadvisor, software, svchost.exe, system, teredo, tr/crypt.zpack, tr/crypt.zpack.80204, tr/crypt.zpack80204, trojaner, vtoolbarupdater, win32/downloadsponsor.a, win32/ilivid.a, win32/toolbar.searchsuite, windows |
WARNUNG an die MITLESER: 
Linear-Darstellung
