| |
| |||||||
Log-Analyse und Auswertung: searchGolTB.A, plusHD.A u.a. .. gründlich zu entfernen von Windows7-RechnerWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
18.06.2014, 21:12
| #1 |
 |  searchGolTB.A, plusHD.A u.a. .. gründlich zu entfernen von Windows7-Rechner Guten Tag, vor einigen Tagen ärgerten uns massiv Einblendungen im Browser (keine Popups), dabei war der Begriff "raving reyven" zu lesen. Der Rechner wurde sehr langsam und war kaum noch zu gebrauchen. Nach Löschen von 2-3 Programmen, die sich unterschwellig in der Zeit installiert hatten und nach Scan durch avira, mbam, adwcleaner, sc-cleaner, JRT und avast-browser-cleanup scheint ein Großteil der Ärgernisse entfernt. Im mbam scan tauchen nur noch wenige Funde auf, die jedoch sind hartnäckig ... Hier kommen die gewünschten log.dateien: Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:16-06-2014 Ran by Angelique (ATTENTION: The logged in user is not administrator) on ANGELIQUE-PC on 18-06-2014 20:02:12 Running from C:\Users\Angelique\Desktop Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: German Standard Internet Explorer Version 11 Boot Mode: Normal The only official download link for FRST: Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (SAMSUNG Electronics) C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe (Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (CyberLink) C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe (Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe (1und1 Mail und Media GmbH) C:\Program Files\GMX MailCheck\IE\GMX_MailCheck_Broker.exe (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe (Dropbox, Inc.) C:\Users\Angelique\AppData\Roaming\Dropbox\bin\Dropbox.exe (Opera Software) C:\Program Files\Opera\opera.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [8120864 2009-12-15] (Realtek Semiconductor) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1713448 2010-02-26] (Synaptics Incorporated) HKLM\...\Run: [UpdateLBPShortCut] => C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.) HKLM\...\Run: [CLMLServer] => C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe [103720 2009-06-03] (CyberLink) HKLM\...\Run: [UpdateP2GoShortCut] => C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.) HKLM\...\Run: [UpdatePDRShortCut] => C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe [222504 2008-01-04] (CyberLink Corp.) HKLM\...\Run: [UpdatePPShortCut] => C:\Program Files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.) HKLM\...\Run: [UpdatePSTShortCut] => C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe [210216 2009-07-21] (CyberLink Corp.) HKLM\...\Run: [UCam_Menu] => C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.) HKLM\...\Run: [hpqSRMon] => C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe [150528 2008-07-22] (Hewlett-Packard) HKLM\...\Run: [Cm108Sound] => RunDll32 cm108.cpl,CMICtrlWnd HKLM\...\Run: [AppleSyncNotifier] => C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [59240 2011-10-06] (Apple Inc.) HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.) HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [737872 2014-06-03] (Avira Operations GmbH & Co. KG) HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM\...\Run: [HP Software Update] => C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [49208 2011-05-10] (Hewlett-Packard) HKLM\...\Run: [] => [X] HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.) HKLM\...\Run: [MailCheck IE Broker] => C:\Program Files\GMX MailCheck\IE\GMX_MailCheck_Broker.exe [1728064 2013-10-17] (1und1 Mail und Media GmbH) HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.) HKLM\...\Runonce: [SPUpdSentinel] - "C:\Program Files\Common Files\Umbrella\Umbrella_bkp.exe" -SERVICEARGS=c -HKLMRunOnce=1 HKLM\...\RunOnce: [*Restore] - C:\windows\System32\rstrui.exe /runonce [262656 2010-11-20] (Microsoft Corporation) HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\Run: [Mobile Partner] => C:\Program Files\Mobile Partner\Mobile Partner.exe [540672 2010-01-08] () HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\Run: [Facebook Update] => C:\Users\Angelique\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-09-16] (Facebook Inc.) HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\Run: [IncrediMail] => C:\Program Files\IncrediMail\bin\IncMail.exe [366576 2012-12-01] (IncrediMail, Ltd.) HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\Run: [swg] => C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2010-03-05] (Google Inc.) HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\MountPoints2: F - F:\AutoRun.exe HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\MountPoints2: {32a285c4-0323-11e1-9b96-0024548754ef} - F:\AutoRun.exe HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\MountPoints2: {4f2ba709-fd98-11e0-bd08-0024548754ef} - F:\AutoRun.exe HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\MountPoints2: {4f2ba72a-fd98-11e0-bd08-0024548754ef} - F:\AutoRun.exe HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\MountPoints2: {4f2ba786-fd98-11e0-bd08-001e101faa49} - F:\AutoRun.exe HKU\S-1-5-21-2339853823-2107313754-116825072-1000\...\MountPoints2: {a253fd9b-317b-11df-a1e6-806e6f6e6963} - E:\Autorun.exe Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Biet-O-Matic.lnk ShortcutTarget: Biet-O-Matic.lnk -> C:\Program Files\Biet-O-Matic\Biet-O-Matic.exe (www.bid-o-matic.org) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\phase-6 Reminder.lnk ShortcutTarget: phase-6 Reminder.lnk -> C:\Program Files\phase-6\phase-6\reminder\reminder.exe (phase-6) Startup: C:\Users\Angelique\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\Angelique\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) Startup: C:\Users\Angelique\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe (No File) GroupPolicy: Group Policy on Chrome detected <======= ATTENTION ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.iminent.com/?appId=3588C76C-B676-4FA8-8BCC-F2C6C664916D HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=smsn&bmod=smsn SearchScopes: HKLM - DefaultScope value is missing. SearchScopes: HKLM - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN SearchScopes: HKCU - DefaultScope {0C8FA76F-EB1B-4951-8477-4358700462DE} URL = hxxp://start.iminent.com/?appId=3588C76C-B676-4FA8-8BCC-F2C6C664916D&ref=toolbox&q={searchTerms} SearchScopes: HKCU - {0C8FA76F-EB1B-4951-8477-4358700462DE} URL = hxxp://start.iminent.com/?appId=3588C76C-B676-4FA8-8BCC-F2C6C664916D&ref=toolbox&q={searchTerms} SearchScopes: HKCU - {0D7562AE-8EF6-416d-A838-AB665251703A} URL = hxxp://start.facemoods.com/?a=wbst&s={searchTerms}&f=4 SearchScopes: HKCU - {460C3D19-B3D4-4964-A550-77D263B0CCCB} URL = hxxp://go.gmx.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8 SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN_de SearchScopes: HKCU - {913EFC05-49A2-46C4-8CF1-7B5C8AB004D2} URL = hxxp://go.web.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8 SearchScopes: HKCU - {9F269F2D-4B93-4149-AAD9-88148B946E08} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms} SearchScopes: HKCU - {CFF4DB9B-135F-47c0-9269-B4C6572FD61A} URL = hxxp://mystart.incredimail.com/?search={searchTerms}&loc=search_box_fs SearchScopes: HKCU - {EAF954B9-B349-4A20-BFB1-674445DE695B} URL = hxxp://go.mail.com/tb/en-us/ie_searchplugin/?q={searchTerms}&enc=UTF-8 SearchScopes: HKCU - {F1386E8E-9EBB-4FE8-B14A-B55DF1F18DD0} URL = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie SearchScopes: HKCU - {F4428DA7-6596-44EC-8987-7FA604AB46DD} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8 BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.) BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) BHO: GMX MailCheck BHO - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.) Toolbar: HKLM - No Name - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - No File Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Toolbar: HKCU - No Name - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - No File Toolbar: HKCU - No Name - {C424171E-592A-415A-9EB1-DFD6D95D3530} - No File DPF: {1ABA5FAC-1417-422B-BA82-45C35E2C908B} hxxp://kitchenplanner.ikea.com/DE/Core/Player/2020PlayerAX_IKEA_Win32.cab DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler: gmx - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH) Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation) Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation) Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation) Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) Winsock: Catalog5 10 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 Tcpip\..\Interfaces\{029509DA-91DB-45AF-9F70-4D08C7407C19}: [NameServer]193.189.244.225 193.189.244.206 Tcpip\..\Interfaces\{516F3F00-D2D0-4057-AF58-1EB4A6F30C9B}: [NameServer]193.189.244.225 193.189.244.206 FireFox: ======== FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF32_14_0_0_125.dll () FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin: @pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.) FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Angelique\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited) FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll (Sun Microsystems, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.) FF Extension: Kaspersky Anti-Banner - C:\Program Files\Mozilla Firefox\extensions\KavAntiBanner@Kaspersky.ru [2012-11-03] FF Extension: Kaspersky URL Advisor - C:\Program Files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru [2012-11-03] FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2012-11-03] FF Extension: Skype extension for Firefox - C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2012-11-03] FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010-07-01] FF HKLM\...\Firefox\Extensions: [{528C49FC-FEDF-41D8-A2F7-E0E81A6D445A}] - C:\windows\Installer\{967637D2-BA8E-485A-82AF-BAF00B595051}\{528C49FC-FEDF-41D8-A2F7-E0E81A6D445A}.xpi FF Extension: Download Protect - C:\windows\Installer\{967637D2-BA8E-485A-82AF-BAF00B595051}\{528C49FC-FEDF-41D8-A2F7-E0E81A6D445A}.xpi [2014-05-19] FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010-07-01] Chrome: ======= Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION CHR Extension: (Google Docs) - C:\Users\Angelique\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-02] CHR Extension: (Google Drive) - C:\Users\Angelique\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-02] CHR Extension: (YouTube) - C:\Users\Angelique\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-02] CHR Extension: (Google Cast) - C:\Users\Angelique\AppData\Local\Google\Chrome\User Data\Default\Extensions\boadgeojelhgndaghljhdicfkmllpafd [2014-05-12] CHR Extension: (Google Search) - C:\Users\Angelique\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-02] CHR Extension: (Google Wallet) - C:\Users\Angelique\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-03] CHR Extension: (Gmail) - C:\Users\Angelique\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-02] ========================== Services (Whitelisted) ================= R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-06-03] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-06-03] (Avira Operations GmbH & Co. KG) R2 HitmanProScheduler; C:\Program Files\HitmanPro\hmpsched.exe [106248 2014-06-18] (SurfRight B.V.) R3 hpqcxs08; C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll [249344 2009-09-20] (Hewlett-Packard Co.) [File not signed] R2 hpqddsvc; C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-09-20] (Hewlett-Packard Co.) [File not signed] R2 HPSLPSVC; C:\Program Files\HP\Digital Imaging\bin\HPSLPSVC32.DLL [694784 2009-09-20] (Hewlett-Packard Co.) [File not signed] R2 lmhosts; C:\windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation) R2 Net Driver HPZ12; C:\windows\system32\HPZinw12.dll [44032 2010-08-06] (Hewlett-Packard) [File not signed] R2 NlaSvc; C:\windows\System32\svchost.exe [20992 2009-07-14] (Microsoft Corporation) R2 nsi; C:\windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation) R2 OberonGameConsoleService; C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe [44312 2009-08-13] () R2 Pml Driver HPZ12; C:\windows\system32\HPZipm12.dll [53760 2010-08-06] (Hewlett-Packard) [File not signed] R2 Rezip; C:\windows\SYSTEM32\Rezip.exe [311296 2009-03-05] () [File not signed] R2 RichVideo; C:\Program Files\CyberLink\Shared files\RichVideo.exe [247152 2009-07-07] () ==================== Drivers (Whitelisted) ==================== R2 avgntflt; C:\windows\System32\DRIVERS\avgntflt.sys [93528 2014-06-03] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\windows\System32\DRIVERS\avipbb.sys [136216 2014-06-03] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-01] (Avira Operations GmbH & Co. KG) S3 DxVGrb; C:\windows\System32\drivers\DxVGrb.sys [179200 2012-01-10] (Dexetek ) S3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-06-18] (Malwarebytes Corporation) S3 Netaapl; C:\windows\System32\DRIVERS\netaapl.sys [18432 2011-08-02] (Apple Inc.) [File not signed] R1 ssmdrv; C:\windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH) S3 USBPNPA; C:\windows\System32\drivers\CM108.sys [1499648 2008-09-10] (C-Media Electronics Inc) R3 yukonw7; C:\windows\System32\DRIVERS\yk62x86.sys [315392 2009-09-28] () R1 {e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw; C:\windows\System32\drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw.sys [52928 2014-04-24] (StdLib) R1 {e63d9559-e4c3-499e-867a-a3c9d0a21400}w; C:\windows\System32\drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}w.sys [52928 2014-04-24] (StdLib) S3 EagleNT; \??\C:\windows\system32\drivers\EagleNT.sys [X] S3 XDva389; \??\C:\windows\system32\XDva389.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-06-18 20:02 - 2014-06-18 20:02 - 00020939 _____ () C:\Users\Angelique\Desktop\FRST.txt 2014-06-18 20:01 - 2014-06-18 20:02 - 00000000 ____D () C:\FRST 2014-06-18 20:01 - 2014-06-18 20:01 - 01072640 _____ (Farbar) C:\Users\Angelique\Desktop\FRST.exe 2014-06-18 19:57 - 2014-06-18 19:57 - 00000000 _____ () C:\Users\Armin\defogger_reenable 2014-06-18 19:46 - 2014-06-18 19:48 - 00000000 ____D () C:\PC-Säuberung 2014-06-18 18:55 - 2014-06-18 18:55 - 00001905 _____ () C:\Users\Public\Desktop\HitmanPro.lnk 2014-06-18 18:55 - 2014-06-18 18:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro 2014-06-18 18:55 - 2014-06-18 18:55 - 00000000 ____D () C:\Program Files\HitmanPro 2014-06-18 18:38 - 2014-06-18 18:39 - 00001796 _____ () C:\sc-cleaner.txt 2014-06-18 18:29 - 2014-06-18 18:29 - 00000000 ____D () C:\windows\ERUNT 2014-06-18 18:22 - 2014-06-18 18:34 - 00000628 _____ () C:\windows\PFRO.log 2014-06-18 17:12 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\windows\system32\sqlite3.dll 2014-06-18 17:10 - 2014-06-18 18:33 - 00000000 ____D () C:\AdwCleaner 2014-06-18 16:26 - 2014-06-18 16:29 - 00110296 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys 2014-06-18 16:26 - 2014-06-18 16:26 - 00001060 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2014-06-18 16:26 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys 2014-06-18 16:26 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys 2014-06-18 16:26 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys 2014-06-17 10:13 - 2014-06-17 10:13 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\Origin 2014-06-15 11:20 - 2014-06-18 19:18 - 00000392 _____ () C:\windows\setupact.log 2014-06-15 11:20 - 2014-06-15 11:20 - 00000000 _____ () C:\windows\setuperr.log 2014-06-14 06:55 - 2014-06-14 06:56 - 00020003 _____ () C:\Users\Angelique\Documents\Party 21.06.14.odt 2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\OCD 2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\Shared Application Data Repository 2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\OCD 2014-06-13 08:27 - 2014-06-13 08:27 - 04748896 _____ (Piriform Ltd) C:\Users\Angelique\Documents\ccsetup414.exe 2014-06-12 13:53 - 2014-05-30 11:18 - 17271296 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll 2014-06-12 13:53 - 2014-05-30 11:02 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb 2014-06-12 13:53 - 2014-05-30 11:02 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll 2014-06-12 13:53 - 2014-05-30 10:44 - 00455168 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll 2014-06-12 13:53 - 2014-05-30 10:43 - 00061952 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll 2014-06-12 13:53 - 2014-05-30 10:42 - 00051200 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll 2014-06-12 13:53 - 2014-05-30 10:38 - 02179072 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll 2014-06-12 13:53 - 2014-05-30 10:34 - 00043008 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll 2014-06-12 13:53 - 2014-05-30 10:33 - 00032768 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll 2014-06-12 13:53 - 2014-05-30 10:30 - 00440832 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll 2014-06-12 13:53 - 2014-05-30 10:28 - 00112128 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe 2014-06-12 13:53 - 2014-05-30 10:28 - 00108032 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe 2014-06-12 13:53 - 2014-05-30 10:27 - 00592896 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll 2014-06-12 13:53 - 2014-05-30 10:21 - 00646144 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe 2014-06-12 13:53 - 2014-05-30 10:16 - 00368128 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll 2014-06-12 13:53 - 2014-05-30 10:10 - 00032256 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll 2014-06-12 13:53 - 2014-05-30 10:06 - 00164864 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll 2014-06-12 13:53 - 2014-05-30 10:04 - 00069632 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll 2014-06-12 13:53 - 2014-05-30 10:02 - 00242688 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll 2014-06-12 13:53 - 2014-05-30 09:57 - 00595968 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe 2014-06-12 13:53 - 2014-05-30 09:56 - 04244992 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll 2014-06-12 13:53 - 2014-05-30 09:54 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll 2014-06-12 13:53 - 2014-05-30 09:50 - 01068032 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll 2014-06-12 13:53 - 2014-05-30 09:49 - 01964544 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl 2014-06-12 13:53 - 2014-05-30 09:40 - 11725312 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll 2014-06-12 13:53 - 2014-05-30 09:21 - 01790976 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll 2014-06-12 13:53 - 2014-05-30 09:15 - 01143296 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll 2014-06-12 13:53 - 2014-05-30 09:13 - 00704512 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll 2014-06-12 13:52 - 2014-06-08 10:48 - 00391680 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll 2014-06-12 13:52 - 2014-06-08 10:43 - 00302592 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll 2014-06-12 13:52 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\windows\system32\usp10.dll 2014-06-12 13:52 - 2014-04-05 04:25 - 01294272 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tcpip.sys 2014-06-12 13:52 - 2014-04-05 04:24 - 00187840 _____ (Microsoft Corporation) C:\windows\system32\Drivers\FWPKCLNT.SYS 2014-06-12 13:52 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\windows\system32\msxml6.dll 2014-06-12 13:52 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\windows\system32\msxml3.dll 2014-06-12 13:52 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml6r.dll 2014-06-12 13:52 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml3r.dll 2014-06-05 13:20 - 2014-06-05 13:20 - 00011881 _____ () C:\Users\Angelique\Documents\Thaimassage 1.odt 2014-05-28 08:28 - 2014-05-28 08:28 - 01110476 _____ () C:\Users\Angelique\Documents\7z920.exe 2014-05-21 06:57 - 2014-05-21 06:57 - 00000000 __SHD () C:\Users\Angelique\AppData\Local\EmieUserList 2014-05-21 06:57 - 2014-05-21 06:57 - 00000000 __SHD () C:\Users\Angelique\AppData\Local\EmieSiteList ==================== One Month Modified Files and Folders ======= 2014-06-18 20:02 - 2014-06-18 20:02 - 00020939 _____ () C:\Users\Angelique\Desktop\FRST.txt 2014-06-18 20:02 - 2014-06-18 20:01 - 00000000 ____D () C:\FRST 2014-06-18 20:02 - 2010-06-29 19:54 - 00000000 ____D () C:\Users\Angelique\AppData\Local\Temp 2014-06-18 20:01 - 2014-06-18 20:01 - 01072640 _____ (Farbar) C:\Users\Angelique\Desktop\FRST.exe 2014-06-18 19:57 - 2014-06-18 19:57 - 00000000 _____ () C:\Users\Armin\defogger_reenable 2014-06-18 19:57 - 2012-12-04 10:52 - 00000000 ____D () C:\Users\Armin 2014-06-18 19:57 - 2010-09-02 10:16 - 00000000 ____D () C:\Program Files\Opera 2014-06-18 19:52 - 2012-04-02 08:16 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job 2014-06-18 19:48 - 2014-06-18 19:46 - 00000000 ____D () C:\PC-Säuberung 2014-06-18 19:28 - 2010-03-05 06:29 - 01396407 _____ () C:\windows\WindowsUpdate.log 2014-06-18 19:25 - 2009-07-14 06:34 - 00014512 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-06-18 19:25 - 2009-07-14 06:34 - 00014512 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-06-18 19:22 - 2009-07-26 22:06 - 01620612 _____ () C:\windows\system32\PerfStringBackup.INI 2014-06-18 19:21 - 2013-09-08 14:39 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\BOM 2014-06-18 19:20 - 2013-09-08 14:40 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\BOM 2014-06-18 19:20 - 2013-09-08 14:39 - 00000000 ____D () C:\Program Files\Biet-O-Matic 2014-06-18 19:19 - 2014-05-17 09:01 - 00000000 ___RD () C:\Users\Angelique\Dropbox 2014-06-18 19:19 - 2014-05-17 09:01 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\DropboxMaster 2014-06-18 19:19 - 2014-05-17 08:59 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\Dropbox 2014-06-18 19:19 - 2010-06-29 21:14 - 00001094 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-06-18 19:18 - 2014-06-15 11:20 - 00000392 _____ () C:\windows\setupact.log 2014-06-18 19:18 - 2009-07-14 06:53 - 00000006 ____H () C:\windows\Tasks\SA.DAT 2014-06-18 19:14 - 2012-09-16 01:09 - 00000944 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2339853823-2107313754-116825072-1000UA.job 2014-06-18 19:07 - 2010-06-29 21:14 - 00001098 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-06-18 18:55 - 2014-06-18 18:55 - 00001905 _____ () C:\Users\Public\Desktop\HitmanPro.lnk 2014-06-18 18:55 - 2014-06-18 18:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro 2014-06-18 18:55 - 2014-06-18 18:55 - 00000000 ____D () C:\Program Files\HitmanPro 2014-06-18 18:55 - 2014-02-21 21:01 - 00000000 ____D () C:\Users\Katja 2014-06-18 18:53 - 2014-05-13 08:19 - 00000000 ____D () C:\Program Files\PSHD-9.9 2014-06-18 18:39 - 2014-06-18 18:38 - 00001796 _____ () C:\sc-cleaner.txt 2014-06-18 18:34 - 2014-06-18 18:22 - 00000628 _____ () C:\windows\PFRO.log 2014-06-18 18:33 - 2014-06-18 17:10 - 00000000 ____D () C:\AdwCleaner 2014-06-18 18:29 - 2014-06-18 18:29 - 00000000 ____D () C:\windows\ERUNT 2014-06-18 18:21 - 2012-11-30 22:48 - 00000933 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk 2014-06-18 18:21 - 2012-11-30 22:48 - 00000921 _____ () C:\Users\Public\Desktop\Opera.lnk 2014-06-18 16:53 - 2014-05-17 08:18 - 00000306 __RSH () C:\ProgramData\ntuser.pol 2014-06-18 16:29 - 2014-06-18 16:26 - 00110296 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys 2014-06-18 16:26 - 2014-06-18 16:26 - 00001060 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2014-06-18 06:45 - 2009-07-14 04:04 - 00000683 _____ () C:\windows\win.ini 2014-06-17 23:07 - 2012-04-02 08:16 - 00699056 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerApp.exe 2014-06-17 23:07 - 2011-08-15 19:31 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerCPLApp.cpl 2014-06-17 19:25 - 2010-06-29 19:54 - 00000000 ____D () C:\Users\Angelique 2014-06-17 19:24 - 2009-07-14 04:37 - 00000000 ____D () C:\windows\system32\wfp 2014-06-17 19:23 - 2013-09-08 22:15 - 00000000 ____D () C:\Program Files\Origin 2014-06-17 19:23 - 2010-03-05 06:39 - 00000000 ____D () C:\ProgramData\WinClon 2014-06-17 19:23 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public 2014-06-17 19:23 - 2009-07-14 04:37 - 00000000 ____D () C:\windows\registration 2014-06-17 10:13 - 2014-06-17 10:13 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\Origin 2014-06-17 10:13 - 2013-09-08 22:15 - 00000000 ____D () C:\ProgramData\Origin 2014-06-17 10:07 - 2013-02-10 23:22 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\Apple Computer 2014-06-16 06:42 - 2012-09-16 01:09 - 00000922 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2339853823-2107313754-116825072-1000Core.job 2014-06-15 11:20 - 2014-06-15 11:20 - 00000000 _____ () C:\windows\setuperr.log 2014-06-14 06:56 - 2014-06-14 06:55 - 00020003 _____ () C:\Users\Angelique\Documents\Party 21.06.14.odt 2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\OCD 2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\Shared Application Data Repository 2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\OCD 2014-06-13 09:26 - 2009-07-14 04:37 - 00000000 ____D () C:\windows\rescache 2014-06-13 08:27 - 2014-06-13 08:27 - 04748896 _____ (Piriform Ltd) C:\Users\Angelique\Documents\ccsetup414.exe 2014-06-13 08:27 - 2012-11-30 23:23 - 00000965 _____ () C:\Users\Public\Desktop\CCleaner.lnk 2014-06-13 08:27 - 2012-11-30 23:23 - 00000000 ____D () C:\Program Files\CCleaner 2014-06-13 06:29 - 2014-05-02 18:14 - 00000000 ___SD () C:\windows\system32\CompatTel 2014-06-13 06:13 - 2013-08-14 23:51 - 00000000 ____D () C:\windows\system32\MRT 2014-06-13 06:10 - 2010-06-30 11:23 - 92708840 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe 2014-06-11 22:11 - 2014-05-01 09:17 - 00002121 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2014-06-08 10:48 - 2014-06-12 13:52 - 00391680 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll 2014-06-08 10:43 - 2014-06-12 13:52 - 00302592 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll 2014-06-05 13:20 - 2014-06-05 13:20 - 00011881 _____ () C:\Users\Angelique\Documents\Thaimassage 1.odt 2014-06-03 12:26 - 2012-11-30 22:59 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys 2014-06-03 12:26 - 2012-11-30 22:59 - 00093528 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys 2014-05-30 11:18 - 2014-06-12 13:53 - 17271296 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll 2014-05-30 11:02 - 2014-06-12 13:53 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb 2014-05-30 11:02 - 2014-06-12 13:53 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll 2014-05-30 10:44 - 2014-06-12 13:53 - 00455168 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll 2014-05-30 10:43 - 2014-06-12 13:53 - 00061952 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll 2014-05-30 10:42 - 2014-06-12 13:53 - 00051200 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll 2014-05-30 10:38 - 2014-06-12 13:53 - 02179072 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll 2014-05-30 10:34 - 2014-06-12 13:53 - 00043008 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll 2014-05-30 10:33 - 2014-06-12 13:53 - 00032768 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll 2014-05-30 10:30 - 2014-06-12 13:53 - 00440832 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll 2014-05-30 10:28 - 2014-06-12 13:53 - 00112128 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe 2014-05-30 10:28 - 2014-06-12 13:53 - 00108032 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe 2014-05-30 10:27 - 2014-06-12 13:53 - 00592896 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll 2014-05-30 10:21 - 2014-06-12 13:53 - 00646144 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe 2014-05-30 10:16 - 2014-06-12 13:53 - 00368128 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll 2014-05-30 10:10 - 2014-06-12 13:53 - 00032256 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll 2014-05-30 10:06 - 2014-06-12 13:53 - 00164864 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll 2014-05-30 10:04 - 2014-06-12 13:53 - 00069632 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll 2014-05-30 10:02 - 2014-06-12 13:53 - 00242688 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll 2014-05-30 09:57 - 2014-06-12 13:53 - 00595968 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe 2014-05-30 09:56 - 2014-06-12 13:53 - 04244992 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll 2014-05-30 09:54 - 2014-06-12 13:53 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll 2014-05-30 09:50 - 2014-06-12 13:53 - 01068032 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll 2014-05-30 09:49 - 2014-06-12 13:53 - 01964544 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl 2014-05-30 09:40 - 2014-06-12 13:53 - 11725312 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll 2014-05-30 09:21 - 2014-06-12 13:53 - 01790976 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll 2014-05-30 09:15 - 2014-06-12 13:53 - 01143296 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll 2014-05-30 09:13 - 2014-06-12 13:53 - 00704512 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll 2014-05-28 08:28 - 2014-05-28 08:28 - 01110476 _____ () C:\Users\Angelique\Documents\7z920.exe 2014-05-23 06:37 - 2014-05-17 09:01 - 00001033 _____ () C:\Users\Angelique\Desktop\Dropbox.lnk 2014-05-23 06:37 - 2014-05-17 09:01 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox 2014-05-21 06:57 - 2014-05-21 06:57 - 00000000 __SHD () C:\Users\Angelique\AppData\Local\EmieUserList 2014-05-21 06:57 - 2014-05-21 06:57 - 00000000 __SHD () C:\Users\Angelique\AppData\Local\EmieSiteList Some content of TEMP: ==================== C:\Users\Angelique\AppData\Local\Temp\avgnt.exe C:\Users\Angelique\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmppfhejy.dll ==================== Bamital & volsnap Check ================= C:\windows\explorer.exe => File is digitally signed C:\windows\system32\winlogon.exe => File is digitally signed C:\windows\system32\wininit.exe => File is digitally signed C:\windows\system32\svchost.exe => File is digitally signed C:\windows\system32\services.exe => File is digitally signed C:\windows\system32\User32.dll => File is digitally signed C:\windows\system32\userinit.exe => File is digitally signed C:\windows\system32\rpcss.dll => File is digitally signed C:\windows\system32\Drivers\volsnap.sys => File is digitally signed ==================== End Of Log ============================ Additional scan result of Farbar Recovery Scan Tool (x86) Version:16-06-2014 Ran by Angelique at 2014-06-18 20:02:46 Running from C:\Users\Angelique\Desktop Boot Mode: Normal ========================================================== ==================== Security Center ======================== AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859} AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4} AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installed Programs ====================== 32 Bit HP CIO Components Installer (Version: 7.1.8 - Hewlett-Packard) Hidden Adobe AIR (HKLM\...\Adobe AIR) (Version: 3.9.0.1210 - Adobe Systems Incorporated) Adobe AIR (Version: 3.9.0.1210 - Adobe Systems Incorporated) Hidden Adobe Flash Player 13 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated) Adobe Flash Player 14 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 14.0.0.125 - Adobe Systems Incorporated) Adobe Reader XI (11.0.07) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated) AIO_CDB_ProductContext (Version: 130.0.365.000 - Hewlett-Packard) Hidden AIO_CDB_Software (Version: 130.0.365.000 - Hewlett-Packard) Hidden AIO_Scan (Version: 130.0.421.000 - Hewlett-Packard) Hidden Alice Greenfingers (HKLM\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112920767}) (Version: - Oberon Media) Amazon Music Importer (HKLM\...\com.amazon.music.uploader) (Version: 2.1.0 - Amazon Services LLC) Amazon Music Importer (Version: 2.1.0 - Amazon Services LLC) Hidden Apple Application Support (HKLM\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.) Apple Mobile Device Support (HKLM\...\{0592EF96-69D8-4E4B-9CC9-88F58EA86F01}) (Version: 7.0.0.117 - Apple Inc.) Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.) ArcSoft ShowBiz (HKLM\...\{9D41D2EF-2D33-4CFD-8A3E-C7E6FCC3303B}) (Version: - ArcSoft) Atheros Client Installation Program (HKLM\...\{D1434266-0486-4469-B338-A60082CC04E1}) (Version: 1.0.2.1119 - Atheros) Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.4.672 - Avira) AVS Update Manager 1.0 (HKLM\...\AVS Update Manager_is1) (Version: - Online Media Technologies Ltd.) AVS4YOU Software Navigator 1.4 (HKLM\...\AVS4YOU Software Navigator_is1) (Version: - Online Media Technologies Ltd.) BatteryLifeExtender (HKLM\...\{853F8A41-A3C9-43FA-87FA-1AE74FC6F3F7}) (Version: 1.0.1 - Samsung) Biet-O-Matic v2.14.12 (HKLM\...\Biet-O-Matic v2.14.12) (Version: 2.14.12 - BOM Development Team) Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.) BufferChm (Version: 130.0.331.000 - Hewlett-Packard) Hidden CCleaner (HKLM\...\CCleaner) (Version: 4.14 - Piriform) ChargeableUSB (HKLM\...\{92D50865-FC60-4EA8-BA7A-5581B0D13EFB}) (Version: 1.0.0.0 - SAMSUNG) Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation) Conexant Polaris Unused CIR Function (HKLM\...\Uninstaller52bc73a10) (Version: 1.0.0.0 - Conexant Systems) Copy (Version: 130.0.428.000 - Hewlett-Packard) Hidden CyberLink DVD Suite (HKLM\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 6.0.2806 - CyberLink Corp.) CyberLink DVD Suite (Version: 6.0.2806 - CyberLink Corp.) Hidden CyberLink LabelPrint (HKLM\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.1916 - CyberLink Corp.) CyberLink LabelPrint (Version: 2.5.1916 - CyberLink Corp.) Hidden CyberLink Power2Go (HKLM\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.0.3108a - CyberLink Corp.) CyberLink Power2Go (Version: 6.0.3108a - CyberLink Corp.) Hidden CyberLink PowerDirector (HKLM\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 7.0.3213 - CyberLink Corp.) CyberLink PowerDirector (Version: 7.0.3213 - CyberLink Corp.) Hidden CyberLink PowerDVD 8 (HKLM\...\InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}) (Version: 8.0.2815b - CyberLink Corp.) CyberLink PowerDVD 8 (Version: 8.0.2815b - CyberLink Corp.) Hidden CyberLink PowerProducer (HKLM\...\InstallShield_{B7A0CE06-068E-11D6-97FD-0050BACBF861}) (Version: 5.0.1.1812 - CyberLink Corp.) CyberLink PowerProducer (Version: 5.0.1.1812 - CyberLink Corp.) Hidden CyberLink YouCam (HKLM\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 2.0.3625 - CyberLink Corp.) CyberLink YouCam (Version: 2.0.3625 - CyberLink Corp.) Hidden Dairy Dash (HKLM\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115053100}) (Version: - Oberon Media) DeviceDiscovery (Version: 130.0.465.000 - Hewlett-Packard) Hidden Die Sims™ 3 (HKLM\...\{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}) (Version: 1.57.62 - Electronic Arts) DocProc (Version: 13.0.0.0 - Hewlett-Packard) Hidden Dropbox (HKCU\...\Dropbox) (Version: 2.8.2 - Dropbox, Inc.) Easy Display Manager (HKLM\...\{17283B95-21A8-4996-97DA-547A48DB266F}) (Version: 3.0 - Samsung Electronics Co., Ltd.) Easy Network Manager (HKLM\...\{34B76DCB-BF7C-440F-B058-C84172C1E338}) (Version: 4.2.8 - Samsung) EasyBatteryManager (HKLM\...\{178EE5F4-0F86-4BF0-A0D1-9790AFF409D1}) (Version: 4.0.0.3 - Samsung) ElsterFormular (HKLM\...\ElsterFormular) (Version: 15.0.13587 - Landesfinanzdirektion Thüringen) eReg (Version: 1.20.138.34 - Logitech, Inc.) Hidden F300 (Version: 130.0.365.000 - Hewlett-Packard) Hidden F300_Help (Version: 82.0.242.000 - Hewlett-Packard) Hidden F300Trb (Version: 82.0.242.000 - Hewlett-Packard) Hidden Facebook Video Calling 2.0.0.447 (HKLM\...\{8DF41A9F-FE13-43E8-A003-5F9B55A011EE}) (Version: 2.0.447 - Skype Limited) Farm Frenzy 2 (HKLM\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11531173}) (Version: - Oberon Media) Fax (Version: 130.0.418.000 - Hewlett-Packard) Hidden Game Pack (HKLM\...\{63eafc52-b963-4297-a7eb-d412944e7065}_is1) (Version: 5.3.0.10 - Oberon Media, Inc.) GIMP 2.8.6 (HKLM\...\GIMP-2_is1) (Version: 2.8.6 - The GIMP Team) GMX Desktop Icons (HKLM\...\1&1 Mail & Media GmbH 1und1DesktopIconsInstaller) (Version: 3.0.3.0 - 1&1 Mail & Media GmbH) GMX MailCheck für Internet Explorer (HKLM\...\1&1 Mail & Media GmbH Toolbar IE8) (Version: 2.4.0.0 - 1&1 Mail & Media GmbH) GMX Softwareaktualisierung (HKLM\...\1&1 Mail & Media GmbH 1und1Softwareaktualisierung) (Version: 3.0.0.55 - 1&1 Mail & Media GmbH) Google Chrome (HKLM\...\Google Chrome) (Version: 35.0.1916.153 - Google Inc.) Google Earth (HKLM\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google) Google SketchUp 8 (HKLM\...\{15F02176-0D12-4FAF-B2CD-2767C7781427}) (Version: 3.0.4993 - Google, Inc.) Google Toolbar for Internet Explorer (HKLM\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.) Google Toolbar for Internet Explorer (Version: 1.0.0 - Google Inc.) Hidden Google Update Helper (Version: 1.3.25.0 - Google Inc.) Hidden GPBaseService2 (Version: 130.0.371.000 - Hewlett-Packard) Hidden HitmanPro 3.7 (HKLM\...\HitmanPro37) (Version: 3.7.9.216 - SurfRight B.V.) HP Photosmart Officejet and Deskjet All-In-One Driver Software 13.0 Rel. B (HKLM\...\{B61ED343-0B14-4241-999C-490CB1A20DA4}) (Version: 13.0 - HP) HP Update (HKLM\...\{97486FBE-A3FC-4783-8D55-EA37E9D171CC}) (Version: 5.005.000.001 - Hewlett-Packard) HPDiagnosticAlert (Version: 1.00.0000 - Microsoft) Hidden HPPhotoGadget (Version: 130.0.282.000 - Hewlett-Packard) Hidden HPPhotoSmartDiscLabelContent1 (Version: 2.04.0000 - Hewlett-Packard) Hidden HPPhotosmartEssential (Version: 2.04.0000 - Hewlett-Packard) Hidden HPProductAssistant (Version: 130.0.371.000 - Hewlett-Packard) Hidden HPSSupply (Version: 130.0.371.000 - Hewlett-Packard) Hidden iCloud (HKLM\...\{00A61104-74B5-4056-AD00-4397EF4FB141}) (Version: 3.1.0.40 - Apple Inc.) IcoFX 1.6.4 (HKLM\...\IcoFX_is1) (Version: - ) IncrediMail (Version: 6.3.9.5248 - IncrediMail) Hidden IncrediMail 2.0 (HKLM\...\IncrediMail) (Version: 6.3.9.5248 - IncrediMail Ltd.) Intel(R) Rapid Storage Technology (HKLM\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.6.3.1001 - Intel Corporation) Intel(R) Turbo Boost Technology Driver (HKLM\...\{D6C630BF-8DBB-4042-8562-DC9A52CB6E7E}) (Version: 01.00.01.1003 - Intel Corporation) iTunes (HKLM\...\{C197BC08-3D82-4651-8886-E68C21578A38}) (Version: 11.1.3.8 - Apple Inc.) Java 7 Update 55 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.550 - Oracle) Java Auto Updater (Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden Java(TM) 6 Update 29 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83216026FF}) (Version: 6.0.290 - Oracle) Junk Mail filter update (Version: 14.0.8089.726 - Microsoft Corporation) Hidden Logitech SetPoint 6.32 (HKLM\...\sp6) (Version: 6.32.20 - Logitech) Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation) MarketResearch (Version: 130.0.374.000 - Hewlett-Packard) Hidden Marvell Miniport Driver (HKLM\...\Marvell Miniport Driver) (Version: 11.22.3.3 - Marvell) Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden Microsoft Choice Guard (Version: 2.0.48.0 - Microsoft Corporation) Hidden Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation) Microsoft Office Suite Activation Assistant (HKLM\...\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation) Microsoft PowerPoint Viewer (HKLM\...\{95140000-00AF-0407-0000-0000000FF1CE}) (Version: 14.0.7015.1000 - Microsoft Corporation) Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation) Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation) Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation) Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Works (HKLM\...\{39D0E034-1042-4905-BECB-5502909FCB7C}) (Version: 9.7.0621 - Microsoft Corporation) Microsoft WSE 3.0 Runtime (HKLM\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.) Mobile Partner (HKLM\...\Mobile Partner) (Version: 16.002.03.01.40 - Huawei Technologies Co.,Ltd) MobileMe Control Panel (HKLM\...\{926BD0E8-24A3-41D2-AF9B-340F1A37ED12}) (Version: 3.1.8.0 - Apple Inc.) MSVCRT (Version: 14.0.1468.721 - Microsoft) Hidden MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation) MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation) Network (Version: 130.0.572.000 - Hewlett-Packard) Hidden Nur Deinstallierung der CopyTrans Suite möglich. (HKCU\...\CopyTrans Suite) (Version: 2.27 - WindSolutions) NVIDIA Display Control Panel (HKLM\...\NVIDIA Display Control Panel) (Version: 6.14.12.5896 - NVIDIA Corporation) NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.10.62.40 - NVIDIA Corporation) OpenOffice 4.0.1 (HKLM\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation) Opera 12.17 (HKLM\...\Opera 12.17.1863) (Version: 12.17.1863 - Opera Software ASA) Origin (HKLM\...\Origin) (Version: 9.3.2.2730 - Electronic Arts, Inc.) Pando Media Booster (HKLM\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: 2.3.5.6 - Pando Networks Inc.) phase-6 2.3.3 (HKLM\...\phase-6) (Version: 2.3.3 - phase-6) PhotoScape (HKLM\...\PhotoScape) (Version: - ) QuickTime 7 (HKLM\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.) Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6003 - Realtek Semiconductor Corp.) REALTEK Wireless LAN Software (HKLM\...\{F2BC3383-F000-410C-A038-3846ADBE8D90}) (Version: 1.01.0088 - REALTEK Semiconductor Corp.) Samsung Recovery Solution 4 (HKLM\...\{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}) (Version: 4.0.0.6 - Samsung) Samsung R-Series (HKLM\...\{3EED7541-55F8-4DC6-B9CD-28762D71310E}) (Version: 1.0 - Samsung) Samsung Support Center (HKLM\...\{0A353130-D22C-41DD-8C67-1B02A05F2CE0}) (Version: 1.1.0 - Samsung) Samsung Update Plus (HKLM\...\{D3F2FAA5-FEC4-42AA-9ABA-1F763919A2B5}) (Version: 2.0 - Samsung Electronics Co., Ltd.) Skype™ 6.11 (HKLM\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.) SmartWebPrinting (Version: 130.0.457.000 - Hewlett-Packard) Hidden SolutionCenter (Version: 130.0.373.000 - Hewlett-Packard) Hidden Status (Version: 130.0.469.000 - Hewlett-Packard) Hidden Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.0.10.0 - Synaptics Incorporated) System Requirements Lab (HKLM\...\SystemRequirementsLab) (Version: - ) TeamViewer 7 (HKLM\...\TeamViewer 7) (Version: 7.0.15723 - TeamViewer) Tinypic 3.18 (HKLM\...\{E3723A04-A894-4036-A78E-282E18F43C0A}_is1) (Version: Tinypic 3.18 - E. Fiedler) TippKönigin 5.5 (HKLM\...\TippKönigin_is1) (Version: - Giletech e.K.) TomTom HOME Visual Studio Merge Modules (HKLM\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.) Toolbox (Version: 130.0.648.000 - Hewlett-Packard) Hidden TrayApp (Version: 130.0.422.000 - Hewlett-Packard) Hidden TrueCrypt (HKLM\...\TrueCrypt) (Version: 7.1a - TrueCrypt Foundation) TuneAid 3.76 (HKLM\...\TuneAid_is1) (Version: 3.76 - DigiDNA) UnloadSupport (Version: 11.0.0 - Hewlett-Packard) Hidden USB PnP Sound Device (HKLM\...\C-Media CM108 Like Sound Driver) (Version: - ) USB PnP Sound Device (HKLM\...\Generic USB 108 Sound) (Version: - ) User Guide (HKLM\...\{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}) (Version: 1.0 - ) Video Grabber (HKLM\...\Uninstaller52bc73a00) (Version: 1.0.0.0 - Conexant Systems) WebReg (Version: 130.0.132.017 - Hewlett-Packard) Hidden Windows Live Call (Version: 14.0.8064.0206 - Microsoft Corporation) Hidden Windows Live Communications Platform (Version: 14.0.8064.206 - Microsoft Corporation) Hidden Windows Live Essentials (HKLM\...\WinLiveSuite_Wave3) (Version: 14.0.8089.0726 - Microsoft Corporation) Windows Live Essentials (Version: 14.0.8089.726 - Microsoft Corporation) Hidden Windows Live Family Safety (Version: 14.0.8093.805 - Microsoft Corporation) Hidden Windows Live Fotogalerie (Version: 14.0.8081.709 - Microsoft Corporation) Hidden Windows Live ID-Anmelde-Assistent (HKLM\...\{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}) (Version: 6.500.3165.0 - Microsoft Corporation) Windows Live Mail (Version: 14.0.8089.0726 - Microsoft Corporation) Hidden Windows Live Messenger (Version: 14.0.8089.0726 - Microsoft Corporation) Hidden Windows Live Movie Maker (Version: 14.0.8091.0730 - Microsoft Corporation) Hidden Windows Live Sync (HKLM\...\{76618402-179D-4699-A66B-D351C59436BC}) (Version: 14.0.8089.726 - Microsoft Corporation) Windows Live Writer (Version: 14.0.8089.0726 - Microsoft Corporation) Hidden Windows Live-Uploadtool (HKLM\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation) WinZip 14.5 (HKLM\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C240BD}) (Version: 14.5.9095 - WinZip Computing, S.L. ) ==================== Restore Points ========================= Could not list Restore Points. Check "winmgmt" service or repair WMI. ==================== Hosts content: ========================== 2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: C:\windows\Tasks\Adobe Flash Player Updater.job => ? Task: C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2339853823-2107313754-116825072-1000Core.job => C:\Users\Angelique\AppData\Local\Facebook\Update\FacebookUpdate.exe Task: C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2339853823-2107313754-116825072-1000UA.job => C:\Users\Angelique\AppData\Local\Facebook\Update\FacebookUpdate.exe Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => ? Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => ? ==================== Loaded Modules (whitelisted) ============= 2010-03-05 06:38 - 2006-08-12 05:48 - 00049152 _____ () C:\Program Files\Samsung\Easy Display Manager\HookDllPS2.dll 2009-06-03 13:59 - 2009-06-03 13:59 - 00619816 ____N () C:\Program Files\CyberLink\Power2Go\CLMediaLibrary.dll 2009-06-03 13:59 - 2009-06-03 13:59 - 00013096 ____N () C:\Program Files\CyberLink\Power2Go\CLMLSvcPS.dll 2011-11-02 00:26 - 2011-11-02 00:26 - 00087912 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll 2011-11-02 00:26 - 2011-11-02 00:26 - 01242472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll 2014-06-18 19:19 - 2014-06-18 19:19 - 00043008 _____ () C:\Users\Angelique\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmppfhejy.dll 2013-08-23 21:01 - 2013-08-23 21:01 - 25100288 _____ () C:\Users\Angelique\AppData\Roaming\Dropbox\bin\libcef.dll ==================== Alternate Data Streams (whitelisted) ========= AlternateDataStreams: C:\ProgramData\Temp:4CF61E54 AlternateDataStreams: C:\ProgramData\Temp:A42A9F39 AlternateDataStreams: C:\ProgramData\Temp:E1F04E8D ==================== Safe Mode (whitelisted) =================== HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcmscsvc => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service" ==================== EXE Association (whitelisted) ============= ==================== MSCONFIG/TASK MANAGER disabled items ========= MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk => C:\windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup MSCONFIG\startupfolder: C:^Users^Angelique^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.2.lnk => C:\windows\pss\OpenOffice.org 3.2.lnk.Startup MSCONFIG\startupreg: AppleSyncNotifier => C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe MSCONFIG\startupreg: IncrediMail => C:\Program Files\IncrediMail\bin\IncMail.exe /c MSCONFIG\startupreg: iTunesHelper => "C:\Program Files\iTunes\iTunesHelper.exe" MSCONFIG\startupreg: PDVD8LanguageShortcut => "C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe" MSCONFIG\startupreg: QuickTime Task => "C:\Program Files\QuickTime\QTTask.exe" -atboottime MSCONFIG\startupreg: RemoteControl8 => "C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe" MSCONFIG\startupreg: Skype => "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized ==================== Faulty Device Manager Devices ============= Name: Teredo Tunneling Pseudo-Interface Description: Microsoft-Teredo-Tunneling-Adapter Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318} Manufacturer: Microsoft Service: tunnel Problem: : This device cannot start. (Code10) Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device. On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard. ==================== Event log errors: ========================= Application errors: ================== Error: (06/18/2014 06:52:54 PM) (Source: SideBySide) (EventID: 33) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1". Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". Error: (06/18/2014 06:36:17 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: IncMail.exe, Version: 6.3.9.5248, Zeitstempel: 0x50a8f106 Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x531599f6 Ausnahmecode: 0xe06d7363 Fehleroffset: 0x0000812f ID des fehlerhaften Prozesses: 0xe04 Startzeit der fehlerhaften Anwendung: 0xIncMail.exe0 Pfad der fehlerhaften Anwendung: IncMail.exe1 Pfad des fehlerhaften Moduls: IncMail.exe2 Berichtskennung: IncMail.exe3 Error: (06/18/2014 06:36:13 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: IncMail.exe, Version: 6.3.9.5248, Zeitstempel: 0x50a8f106 Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000 Ausnahmecode: 0xc0000005 Fehleroffset: 0x00000000 ID des fehlerhaften Prozesses: 0xe04 Startzeit der fehlerhaften Anwendung: 0xIncMail.exe0 Pfad der fehlerhaften Anwendung: IncMail.exe1 Pfad des fehlerhaften Moduls: IncMail.exe2 Berichtskennung: IncMail.exe3 Error: (06/18/2014 06:35:54 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: ImApp.exe, Version: 6.3.9.5248, Zeitstempel: 0x50a8eb91 Name des fehlerhaften Moduls: MSVCR80.dll, Version: 8.0.50727.6195, Zeitstempel: 0x4dcddbf3 Ausnahmecode: 0xc000000d Fehleroffset: 0x00045d67 ID des fehlerhaften Prozesses: 0x69c Startzeit der fehlerhaften Anwendung: 0xImApp.exe0 Pfad der fehlerhaften Anwendung: ImApp.exe1 Pfad des fehlerhaften Moduls: ImApp.exe2 Berichtskennung: ImApp.exe3 System errors: ============= Microsoft Office Sessions: ========================= Error: (06/18/2014 06:52:54 PM) (Source: SideBySide) (EventID: 33) (User: ) Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"C:\Users\Angelique\AppData\Lo cal\Opera\Opera\temporary_downloads\hitmanpro379\hitmanpro_x64.exe Error: (06/18/2014 06:36:17 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: IncMail.exe6.3.9.524850a8f106KERNELBASE.dll6.1.7601.18409531599f6e06d73630000812fe0401cf8b133fd0346bC:\Program Files\IncrediMail\Bin\IncMail.exeC:\windows\system32\KERNELBASE.dllab644363-f706-11e3-9cd4-0024548754ef Error: (06/18/2014 06:36:13 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: IncMail.exe6.3.9.524850a8f106unknown0.0.0.000000000c000000500000000e0401cf8b133fd0346bC:\Program Files\IncrediMail\Bin\IncMail.exeunknowna8f49adb-f706-11e3-9cd4-0024548754ef Error: (06/18/2014 06:35:54 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: ImApp.exe6.3.9.524850a8eb91MSVCR80.dll8.0.50727.61954dcddbf3c000000d00045d6769c01cf8b13441f1ca4C:\Program Files\IncrediMail\Bin\ImApp.exeC:\windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\MSVCR80.dll9d4d6a34-f706-11e3-9cd4-0024548754ef ==================== Memory info =========================== Percentage of memory in use: 39% Total physical RAM: 3565.61 MB Available physical RAM: 2158.88 MB Total Pagefile: 7129.52 MB Available Pagefile: 5554.95 MB Total Virtual: 2047.88 MB Available Virtual: 1895.5 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:141.49 GB) (Free:82.04 GB) NTFS Drive d: (Volume) (Fixed) (Total:141.5 GB) (Free:42.62 GB) NTFS ==================== MBR & Partition Table ================== ==================== End Of Log ============================ defogger_disable by jpshortstuff (23.02.10.1) Log created at 20:58 on 18/06/2014 (Armin) Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers... -=E.O.F=- Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 18.06.2014 Suchlauf-Zeit: 19:23:00 Logdatei: Malwarebytes.txt Administrator: Nein Version: 2.00.2.1012 Malware Datenbank: v2014.06.18.07 Rootkit Datenbank: v2014.06.02.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Self-protection: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x86 Dateisystem: NTFS Benutzer: Angelique Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 209728 Verstrichene Zeit: 9 Min, 46 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristics: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 14 PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{4B62762D-AA67-4312-A5BF-91BCB7A4720A}, Löschen bei Neustart, [935cde9b601bd561d77992e8eb17cc34], PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\TypeLib\{105F25A9-C42F-48A6-998D-0494E8AE336A}, In Quarantäne, [13dcccade695c57195bbfb7f936fb749], PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{506DD7C6-B05D-43CE-81FF-AA05E11DBDFD}, Löschen bei Neustart, [13dcccade695c57195bbfb7f936fb749], PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{6D3C9858-2674-46E1-9112-107340758481}, Löschen bei Neustart, [13dcccade695c57195bbfb7f936fb749], PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{79C9FA6C-352A-49BA-89BA-85077BC35DC3}, Löschen bei Neustart, [13dcccade695c57195bbfb7f936fb749], PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{909112FE-C4A2-4990-A499-E58867D55B15}, Löschen bei Neustart, [13dcccade695c57195bbfb7f936fb749], PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{9BEEB5A2-8B02-465A-904D-FE5A447F59EB}, Löschen bei Neustart, [13dcccade695c57195bbfb7f936fb749], PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{B618C19D-A418-4586-80C6-09DBDA9C748E}, Löschen bei Neustart, [13dcccade695c57195bbfb7f936fb749], PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{B68B00A0-95B9-4162-BA45-7A1113317DA9}, Löschen bei Neustart, [13dcccade695c57195bbfb7f936fb749], PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{BFE45A8B-650C-4E99-A3F4-CC6A2874893B}, Löschen bei Neustart, [13dcccade695c57195bbfb7f936fb749], PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{E413D78F-283C-45F1-9992-8EF7D55A4933}, Löschen bei Neustart, [13dcccade695c57195bbfb7f936fb749], PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{E7C2FDF1-1635-41B4-8207-C1684B6807D7}, Löschen bei Neustart, [13dcccade695c57195bbfb7f936fb749], PUP.Optional.SearchGolTB.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{F9F5A267-FA5A-4CA3-8BE5-4C1EEAD01011}, Löschen bei Neustart, [13dcccade695c57195bbfb7f936fb749], PUP.Optional.PlusHD.A, HKLM\SOFTWARE\PSHD-9.9, Löschen bei Neustart, [19d697e21368f73fa69f3579f210e917], Registrierungswerte: 0 (No malicious items detected) Registrierungsdaten: 0 (No malicious items detected) Ordner: 1 PUP.Optional.PlusHD.A, C:\Program Files\PSHD-9.9, Löschen bei Neustart, [f5fa50297209b87eaf431089917122de], Dateien: 7 PUP.Optional.PlusHD.A, C:\Program Files\PSHD-9.9\1293297481.mxaddon, Löschen bei Neustart, [f5fa50297209b87eaf431089917122de], PUP.Optional.PlusHD.A, C:\Program Files\PSHD-9.9\360-52916.crx, Löschen bei Neustart, [f5fa50297209b87eaf431089917122de], PUP.Optional.PlusHD.A, C:\Program Files\PSHD-9.9\52916.crx, Löschen bei Neustart, [f5fa50297209b87eaf431089917122de], PUP.Optional.PlusHD.A, C:\Program Files\PSHD-9.9\52916.xpi, Löschen bei Neustart, [f5fa50297209b87eaf431089917122de], PUP.Optional.PlusHD.A, C:\Program Files\PSHD-9.9\background.html, Löschen bei Neustart, [f5fa50297209b87eaf431089917122de], PUP.Optional.PlusHD.A, C:\Program Files\PSHD-9.9\bgNova.html, Löschen bei Neustart, [f5fa50297209b87eaf431089917122de], PUP.Optional.PlusHD.A, C:\Program Files\PSHD-9.9\PSHD-9.9.ico, Löschen bei Neustart, [f5fa50297209b87eaf431089917122de], Physische Sektoren: 0 (No malicious items detected) (end) ..... im ersten mbam-Scan tauchten noch viele andere "Plagegeister" auf .. dieser Scan hat hier leider nicht reingepasst .. kann auf Wunsch gern als Anhang nachgereicht werden. Herzlichen Dank im Voraus für die Mühe! Katty |
Baum-Darstellung