Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung
Windows 7 - Werbevirus

Windows 7 - Werbevirus


Log-Analyse und Auswertung: Windows 7 - Werbevirus

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML.

 
Vorheriger Beitrag Vorheriger Beitrag   Nächster Beitrag Nächster Beitrag
Alt 18.08.2014, 18:37   #1
OhneHoffnung
 
Windows 7 - Werbevirus - Standard

Windows 7 - Werbevirus


Hallo,
habe den Laptop von verzweifelten Verwandten erhalten.
Anscheinend ist ist dieser Windows 7 Laptop hier seit ca 8 Monaten (seit Weihnachten rum) mit dem Virus befallen. Man bekommt häufig Werbung (während ich hier schreibe, ploppt öfters Werbung auf bzw. ein zweiter Tab ist plötzlich weitergeleitet worden) und auch die Startseite des Firefox führt zu einer fremden Suchmaschine (v9.com).
Diesen möchte ich nun herunterbekommen, im Notfall könnte ich den Laptop auch neuinstallieren, Daten wurden gesichert und ich habe vor ein paar Monaten eine Windows 7 Installations - CD erworben. Allerdings würde ich auch gerne wissen ob der Virus sich auf die Festplatte weiterverbreitet haben könnte.
Habe gemäß dem Tutorial Logfiles erstellt, die Ergebnisse werde ich nun hierdrin veröffentlichen:
Defogger:
Code:
ATTFilter
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 16:36 on 18/08/2014 (Petra)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
FRST
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-08-2014 04
Ran by Petra (administrator) on ***** on 18-08-2014 16:37:52
Running from C:\Users\Petra\Desktop
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE
() C:\ProgramData\IBUpdaterService\ibsvc.exe
() C:\Windows\SysWOW64\srvany.exe
() C:\Windows\KMService.exe
() C:\Program Files (x86)\a2zLyrics-soft\a2zLyricspUb158.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccsvchst.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccsvchst.exe
() C:\Program Files (x86)\a2zLyrics-soft\a2zLyricspUbMDw.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Easy Settings\SmartSetting.exe
(Samsung Electronics) C:\Program Files (x86)\Samsung\Easy Settings\EasySpeedUpManager.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Easy Settings\MovieColorEnhancer.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Easy Settings\dmhkcore.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_IATIHJE.EXE
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(SEC) C:\Program Files (x86)\Samsung\Samsung Recovery Solution 5\WCScheduler.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(SAMSUNG Electronics) C:\Program Files (x86)\Samsung\Easy Support Center\SSCKbdHk.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12666984 2011-08-09] (Realtek Semiconductor)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2776872 2011-08-31] (ELAN Microelectronics Corp.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2011-10-13] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311152 2013-09-04] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
HKLM-x32\...\Run: [mobilegeni daemon] => C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [751184 2014-08-14] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-05-07] (Oracle Corporation)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [189520 2014-07-07] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-983883370-204824152-491102941-1000\...\Run: [ICQ] => C:\Program Files (x86)\ICQ7.7\ICQ.exe [127040 2012-03-17] (ICQ, LLC.)
HKU\S-1-5-21-983883370-204824152-491102941-1000\...\Run: [EPSON SX130 Series] => C:\windows\system32\spool\DRIVERS\x64\3\E_IATIHJE.EXE [232448 2010-12-07] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-983883370-204824152-491102941-1000\...\Run: [Google Update] => C:\Users\Petra\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2012-04-21] (Google Inc.)
HKU\S-1-5-21-983883370-204824152-491102941-1000\...\Run: [swg] => "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
HKU\S-1-5-21-983883370-204824152-491102941-1000\...\Run: [NextLive] => C:\windows\SysWOW64\rundll32.exe "C:\Users\Petra\AppData\Roaming\newnext.me\nengine.dll",EntryPoint -m l
AppInit_DLLs: c:\progra~3\bitguard\271769~1.27\{c16c1~1\loader.dll => c:\progra~3\bitguard\271769~1.27\{c16c1~1\loader.dll File Not Found
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: http=127.0.0.1:13828
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nationzoom.com/?type=hp&ts=1388224585&from=tugs&uid=ST9500325AS_S2W91BRPXXXXS2W91BRP
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nationzoom.com/?type=hp&ts=1388224585&from=tugs&uid=ST9500325AS_S2W91BRPXXXXS2W91BRP
HKCU\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = hxxp://search.babylon.com/?affID=119776&tt=190313_wo1&babsrc=HP_ss_bad2g&mntrId=30008A1132EA3E7A
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1388224585&from=tugs&uid=ST9500325AS_S2W91BRPXXXXS2W91BRP&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nationzoom.com/?type=hp&ts=1388224585&from=tugs&uid=ST9500325AS_S2W91BRPXXXXS2W91BRP
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nationzoom.com/?type=hp&ts=1388224585&from=tugs&uid=ST9500325AS_S2W91BRPXXXXS2W91BRP
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.nationzoom.com/web/?type=ds&ts=1388224585&from=tugs&uid=ST9500325AS_S2W91BRPXXXXS2W91BRP&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1388224585&from=tugs&uid=ST9500325AS_S2W91BRPXXXXS2W91BRP&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nationzoom.com/?type=hp&ts=1388224585&from=tugs&uid=ST9500325AS_S2W91BRPXXXXS2W91BRP
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nationzoom.com/?type=hp&ts=1388224585&from=tugs&uid=ST9500325AS_S2W91BRPXXXXS2W91BRP
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.nationzoom.com/web/?type=ds&ts=1388224585&from=tugs&uid=ST9500325AS_S2W91BRPXXXXS2W91BRP&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.nationzoom.com/?type=sc&ts=1388224585&from=tugs&uid=ST9500325AS_S2W91BRPXXXXS2W91BRP
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1388224585&from=tugs&uid=ST9500325AS_S2W91BRPXXXXS2W91BRP&q={searchTerms}
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1388224585&from=tugs&uid=ST9500325AS_S2W91BRPXXXXS2W91BRP&q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1388224585&from=tugs&uid=ST9500325AS_S2W91BRPXXXXS2W91BRP&q={searchTerms}
SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1388224585&from=tugs&uid=ST9500325AS_S2W91BRPXXXXS2W91BRP&q={searchTerms}
SearchScopes: HKLM-x32 - {EEE6C360-6118-11DC-9C72-001320C79847} URL = hxxp://search.sweetim.com/search.asp?src=6&q={searchTerms}&barid={1090E704-B489-47B1-9765-27A835E10ACD}
SearchScopes: HKCU - bProtectorDefaultScope {EEE6C360-6118-11DC-9C72-001320C79847}
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = 
SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1388224585&from=tugs&uid=ST9500325AS_S2W91BRPXXXXS2W91BRP&q={searchTerms}
BHO: Plus-HD-1.6 -> {11111111-1111-1111-1111-110311201102} -> C:\Program Files (x86)\Plus-HD-1.6\Plus-HD-1.6-bho64.dll No File
BHO: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Easy Photo Print -> {9421DD08-935F-4701-A9CA-22DF90AC4EA6} -> C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
BHO: Skype add-on for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll No File
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Symantec NCO BHO -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\coIEPlg.dll (Symantec Corporation)
BHO-x32: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO-x32: Symantec Intrusion Prevention -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Yontoo -> {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} -> C:\Program Files (x86)\Yontoo\YontooIEClient.dll (Yontoo LLC)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\coIEPlg.dll (Symantec Corporation)
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Toolbar: HKCU - No Name - {977AE9CC-AF83-45E8-9E03-E2798216E2D5} -  No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -  No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\7vkweq9l.default
FF NewTab: hxxp://www.nationzoom.com/newtab/?type=nt&ts=1388224585&from=tugs&uid=ST9500325AS_S2W91BRPXXXXS2W91BRP
FF DefaultSearchEngine: nationzoom
FF SelectedSearchEngine: nationzoom
FF Homepage: hxxp://www.nationzoom.com/?type=hp&ts=1388224585&from=tugs&uid=ST9500325AS_S2W91BRPXXXXS2W91BRP
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.60.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.60.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 -> C:\Users\Petra\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 -> C:\Users\Petra\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF user.js: detected! => C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\7vkweq9l.default\user.js
FF SearchPlugin: C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\7vkweq9l.default\searchplugins\babylon.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Widget context - C:\Users\Petra\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{140A2D0E-85CC-4ed3-9BA5-8FA35DA7FABA}.xpi [2014-01-11]
FF Extension: Plus-HD-1.6c - C:\Users\Petra\AppData\Roaming\Mozilla\Firefox\Profiles\7vkweq9l.default\Extensions\9d29e4ccd2024f2d8e320@ad524784406d4c8dab290.com [2014-08-09]
FF Extension: Iminent WebBooster - C:\Program Files (x86)\Mozilla Firefox\extensions\webbooster@iminent.com [2014-08-17]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-08-17]
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\IPSFFPlgn
FF Extension: Symantec Intrusion Prevention - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\IPSFFPlgn [2012-03-08]
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\coFFPlgn_2011_7_13_2
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\coFFPlgn_2011_7_13_2 [2014-08-18]
FF HKLM-x32\...\Firefox\Extensions: [webbooster@iminent.com] - C:\Program Files (x86)\Iminent\webbooster@iminent.com
FF HKCU\...\Firefox\Extensions: [{E87482A9-095B-A360-6877-0290FD09E7D5}] - C:\Program Files (x86)\a2zLyrics-soft\158.xpi
FF Extension: a2zLyrics - C:\Program Files (x86)\a2zLyrics-soft\158.xpi [2014-05-21]

Chrome: 
=======
CHR HomePage: hxxp://www.nationzoom.com/?type=hp&ts=1388224585&from=tugs&uid=ST9500325AS_S2W91BRPXXXXS2W91BRP
CHR StartupUrls: "hxxp://www.nationzoom.com/?type=hp&ts=1388224585&from=tugs&uid=ST9500325AS_S2W91BRPXXXXS2W91BRP"
CHR NewTab: "chrome-extension://ifohbjbgfchkkfhphahclmkpgejiplfo/index.html"
CHR DefaultSearchKeyword: nationzoom
CHR DefaultNewTabURL: 
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Petra\AppData\Local\Google\Chrome\Application\36.0.1985.143\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Petra\AppData\Local\Google\Chrome\Application\36.0.1985.143\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Users\Petra\AppData\Local\Google\Chrome\Application\36.0.1985.143\gcswf32.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll No File
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll No File
CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (Google Update) - C:\Users\Petra\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Extension: (YouTube) - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-04-21]
CHR Extension: (Extended Protection) - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\cekcjpgehmohobmdiikfnopibipmgnml [2013-12-28]
CHR Extension: (Google-Suche) - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-04-21]
CHR Extension: (Lightning Newtab) - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\ifohbjbgfchkkfhphahclmkpgejiplfo [2014-07-19]
CHR Extension: (Plus-HD-1.6) - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\jidjhchcblhlapbcpheibgdjkajekhbh [2013-09-26]
CHR Extension: (Yontoo) - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\niapdbllcanepiiimjjndipklodoedlc [2013-05-21]
CHR Extension: (Google Wallet) - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-11-23]
CHR Extension: (Widget context) - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\ombmmloebnfnpehgjnmkcgoegfachobp [2014-01-11]
CHR Extension: (GoPhoto.it) - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\pfmopbbadnfoelckkcmjjeaaegjpjjbk [2013-05-21]
CHR Extension: (Google Mail) - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-04-21]
CHR Extension: (Extended Protection) - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\cekcjpgehmohobmdiikfnopibipmgnml\1.3_0\ [2012-04-21]
CHR HKLM-x32\...\Chrome\Extension: [blaofbhgbmeikidhlkmjhbkbfohpgekf] - C:\Program Files (x86)\Movie2KDownloader.com\Movie2KDownloader10.crx [2012-04-21]
CHR HKLM-x32\...\Chrome\Extension: [ifohbjbgfchkkfhphahclmkpgejiplfo] - C:\Users\Petra\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtab.crx [2013-12-28]
CHR HKLM-x32\...\Chrome\Extension: [niapdbllcanepiiimjjndipklodoedlc] - C:\Program Files (x86)\Yontoo\YontooLayers.crx [2012-12-10]
CHR HKLM-x32\...\Chrome\Extension: [pfmopbbadnfoelckkcmjjeaaegjpjjbk] - C:\Program Files (x86)\Gophoto.it\gophotoit14.crx [2012-07-31]
CHR StartMenuInternet: Google Chrome - C:\Users\Carolin\AppData\Local\Google\Chrome\Application\chrome.exe hxxp://www.nationzoom.com/?type=sc&ts=1388224585&from=tugs&uid=ST9500325AS_S2W91BRPXXXXS2W91BRP

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-08-14] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-14] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1021520 2014-08-14] (Avira Operations GmbH & Co. KG)
S2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [141392 2014-07-07] (Avira Operations GmbH & Co. KG)
R2 IBUpdaterService; C:\ProgramData\IBUpdaterService\ibsvc.exe [554368 2012-12-10] ()
R2 KMService; C:\windows\SysWOW64\srvany.exe [8192 2012-06-04] () [File not signed]
R2 LyricsSay; C:\Program Files (x86)\a2zLyrics-soft\a2zLyricspUb158.exe [142848 2014-05-21] () [File not signed]
R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe [130008 2011-04-17] (Symantec Corporation)
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-01] (Symantec Corporation)
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [244904 2009-12-01] () [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 acedrv10; C:\windows\system32\drivers\acedrv10.sys [277904 2012-06-04] (Protect Software GmbH)
R2 acehlp10; C:\windows\system32\drivers\acehlp10.sys [228000 2012-06-04] (Protect Software GmbH)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-06-24] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-05-09] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-05-09] (Avira Operations GmbH & Co. KG)
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\BASHDefs\20120507.001\BHDrvx64.sys [1160824 2012-04-03] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [482936 2012-03-09] (Symantec Corporation)
S3 h643331; C:\Windows\System32\drivers\h643331.sys [63552 2008-05-19] ( )
S3 hid3331; C:\Windows\SysWOW64\drivers\hid3331.sys [41336 2008-05-19] ( )
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\IPSDefs\20120510.001\IDSvia64.sys [488568 2012-04-28] (Symantec Corporation)
S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20120510.033\ENG64.SYS [117880 2012-03-09] (Symantec Corporation)
S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20120510.033\EX64.SYS [2048632 2012-03-09] (Symantec Corporation)
S3 rtport; C:\windows\SysWOW64\drivers\rtport.sys [15144 2011-12-28] (Windows (R) 2003 DDK 3790 provider)
R2 SGDrv; C:\Windows\System32\DRIVERS\SGdrv64.sys [7680 2011-04-11] (Phoenix Technologies Ltd.)
S3 SRTSP; C:\Windows\System32\Drivers\NISx64\1207020.003\SRTSP64.SYS [744568 2011-03-31] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1207020.003\SRTSPX64.SYS [40568 2011-03-31] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NISx64\1207020.003\SYMDS64.SYS [450680 2011-01-27] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NISx64\1207020.003\SYMEFA64.SYS [912504 2011-03-15] (Symantec Corporation)
R3 SymEvent; C:\windows\system32\Drivers\SYMEVENT64x86.SYS [174200 2012-03-09] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NISx64\1207020.003\Ironx64.SYS [171128 2011-01-27] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1207020.003\SYMNETS.SYS [386168 2011-04-21] (Symantec Corporation)
U3 kxddypob; \??\C:\Users\Petra\AppData\Local\Temp\kxddypob.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-18 16:37 - 2014-08-18 16:37 - 00030008 _____ () C:\Users\Petra\Desktop\FRST.txt
2014-08-18 16:36 - 2014-08-18 16:36 - 00000472 _____ () C:\Users\Petra\Desktop\defogger_disable.log
2014-08-18 16:18 - 2014-08-18 16:18 - 00003352 ____N () C:\bootsqm.dat
2014-08-17 20:43 - 2014-08-17 20:43 - 00380416 _____ () C:\Users\Petra\Desktop\Gmer-19357.exe
2014-08-17 20:08 - 2014-08-17 20:33 - 00000000 ____D () C:\Users\Petra\AppData\Local\Windows Live
2014-08-17 20:08 - 2014-08-17 20:08 - 00000000 ____D () C:\Users\Petra\AppData\Local\{F0DA4742-F4B6-453C-889D-FD0AAC8373FE}
2014-08-17 20:08 - 2014-08-17 20:08 - 00000000 ____D () C:\Users\Petra\AppData\Local\{DB61EB1B-E156-44D3-BD41-D2F0D176CFFF}
2014-08-17 19:24 - 2014-08-17 19:24 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-08-17 18:56 - 2014-08-18 16:37 - 00000000 ____D () C:\FRST
2014-08-17 18:56 - 2014-08-17 18:56 - 02101760 _____ (Farbar) C:\Users\Petra\Desktop\FRST64.exe
2014-08-17 18:53 - 2014-08-17 18:53 - 00000000 _____ () C:\Users\Petra\defogger_reenable
2014-08-17 18:52 - 2014-08-17 18:52 - 00050477 _____ () C:\Users\Petra\Desktop\Defogger.exe
2014-08-14 18:34 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\windows\system32\icardres.dll
2014-08-14 18:34 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\windows\SysWOW64\icardres.dll
2014-08-14 18:34 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\windows\system32\icardagt.exe
2014-08-14 18:34 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\windows\system32\infocardapi.dll
2014-08-14 18:34 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\windows\SysWOW64\icardagt.exe
2014-08-14 18:34 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\windows\SysWOW64\infocardapi.dll
2014-08-14 18:33 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\windows\SysWOW64\TsWpfWrp.exe
2014-08-14 18:33 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\windows\system32\TsWpfWrp.exe
2014-08-14 15:46 - 2014-07-16 05:25 - 00404480 _____ (Microsoft Corporation) C:\windows\system32\gdi32.dll
2014-08-14 15:46 - 2014-07-16 05:23 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\tzres.dll
2014-08-14 15:46 - 2014-07-16 04:46 - 00311808 _____ (Microsoft Corporation) C:\windows\SysWOW64\gdi32.dll
2014-08-14 15:46 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\tzres.dll
2014-08-14 15:46 - 2014-07-16 04:12 - 03163648 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2014-08-14 15:46 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\windows\system32\KBDYAK.DLL
2014-08-14 15:46 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\windows\system32\KBDTAT.DLL
2014-08-14 15:46 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\windows\system32\KBDRU1.DLL
2014-08-14 15:46 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\windows\system32\KBDBASH.DLL
2014-08-14 15:46 - 2014-07-09 04:03 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\KBDRU.DLL
2014-08-14 15:46 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDYAK.DLL
2014-08-14 15:46 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDTAT.DLL
2014-08-14 15:46 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDRU1.DLL
2014-08-14 15:46 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDRU.DLL
2014-08-14 15:46 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\KBDBASH.DLL
2014-08-14 15:46 - 2014-07-09 00:38 - 00419992 _____ () C:\windows\system32\locale.nls
2014-08-14 15:46 - 2014-07-09 00:30 - 00419992 _____ () C:\windows\SysWOW64\locale.nls
2014-08-14 15:46 - 2014-06-25 04:05 - 14175744 _____ (Microsoft Corporation) C:\windows\system32\shell32.dll
2014-08-14 15:46 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\windows\SysWOW64\shell32.dll
2014-08-14 15:46 - 2014-06-16 04:10 - 00985536 _____ (Microsoft Corporation) C:\windows\system32\Drivers\dxgkrnl.sys
2014-08-14 15:46 - 2014-06-03 12:02 - 03241984 _____ (Microsoft Corporation) C:\windows\system32\msi.dll
2014-08-14 15:46 - 2014-06-03 12:02 - 01941504 _____ (Microsoft Corporation) C:\windows\system32\authui.dll
2014-08-14 15:46 - 2014-06-03 12:02 - 00504320 _____ (Microsoft Corporation) C:\windows\system32\msihnd.dll
2014-08-14 15:46 - 2014-06-03 12:02 - 00112064 _____ (Microsoft Corporation) C:\windows\system32\consent.exe
2014-08-14 15:46 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\windows\SysWOW64\msi.dll
2014-08-14 15:46 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\windows\SysWOW64\authui.dll
2014-08-14 15:46 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\windows\SysWOW64\msihnd.dll
2014-08-14 15:45 - 2014-08-01 01:41 - 00348856 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2014-08-14 15:45 - 2014-08-01 01:16 - 00307384 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2014-08-14 15:45 - 2014-07-25 16:52 - 23645696 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-08-14 15:45 - 2014-07-25 16:02 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-08-14 15:45 - 2014-07-25 16:01 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2014-08-14 15:45 - 2014-07-25 15:51 - 17524224 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2014-08-14 15:45 - 2014-07-25 15:30 - 00066048 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2014-08-14 15:45 - 2014-07-25 15:28 - 00548352 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2014-08-14 15:45 - 2014-07-25 15:28 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2014-08-14 15:45 - 2014-07-25 15:25 - 02774528 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2014-08-14 15:45 - 2014-07-25 15:25 - 00083968 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
2014-08-14 15:45 - 2014-07-25 15:11 - 00051200 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2014-08-14 15:45 - 2014-07-25 15:10 - 00033792 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2014-08-14 15:45 - 2014-07-25 15:04 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2014-08-14 15:45 - 2014-07-25 15:03 - 00598016 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2014-08-14 15:45 - 2014-07-25 15:00 - 00139264 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2014-08-14 15:45 - 2014-07-25 15:00 - 00111616 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2014-08-14 15:45 - 2014-07-25 14:59 - 00758272 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2014-08-14 15:45 - 2014-07-25 14:47 - 00940032 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2014-08-14 15:45 - 2014-07-25 14:40 - 00452096 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2014-08-14 15:45 - 2014-07-25 14:34 - 00455168 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2014-08-14 15:45 - 2014-07-25 14:34 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2014-08-14 15:45 - 2014-07-25 14:33 - 00051200 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll
2014-08-14 15:45 - 2014-07-25 14:30 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll
2014-08-14 15:45 - 2014-07-25 14:28 - 05824512 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2014-08-14 15:45 - 2014-07-25 14:28 - 00072704 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2014-08-14 15:45 - 2014-07-25 14:21 - 02184704 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2014-08-14 15:45 - 2014-07-25 14:19 - 00195584 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2014-08-14 15:45 - 2014-07-25 14:18 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2014-08-14 15:45 - 2014-07-25 14:17 - 00085504 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-08-14 15:45 - 2014-07-25 14:17 - 00032768 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2014-08-14 15:45 - 2014-07-25 14:12 - 00438784 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2014-08-14 15:45 - 2014-07-25 14:10 - 00292864 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2014-08-14 15:45 - 2014-07-25 14:10 - 00112128 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2014-08-14 15:45 - 2014-07-25 14:08 - 00597504 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll
2014-08-14 15:45 - 2014-07-25 14:06 - 04204032 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2014-08-14 15:45 - 2014-07-25 13:52 - 00367104 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2014-08-14 15:45 - 2014-07-25 13:47 - 00631808 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2014-08-14 15:45 - 2014-07-25 13:43 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-08-14 15:45 - 2014-07-25 13:42 - 00692736 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2014-08-14 15:45 - 2014-07-25 13:39 - 02087936 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2014-08-14 15:45 - 2014-07-25 13:39 - 01249280 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2014-08-14 15:45 - 2014-07-25 13:36 - 00164864 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2014-08-14 15:45 - 2014-07-25 13:34 - 00069632 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2014-08-14 15:45 - 2014-07-25 13:29 - 00239616 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2014-08-14 15:45 - 2014-07-25 13:23 - 13547008 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2014-08-14 15:45 - 2014-07-25 13:13 - 00526336 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2014-08-14 15:45 - 2014-07-25 13:07 - 02001920 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2014-08-14 15:45 - 2014-07-25 13:07 - 01068032 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll
2014-08-14 15:45 - 2014-07-25 13:03 - 11772928 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2014-08-14 15:45 - 2014-07-25 12:52 - 02266624 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2014-08-14 15:45 - 2014-07-25 12:26 - 01431040 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2014-08-14 15:45 - 2014-07-25 12:17 - 00846336 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2014-08-14 15:45 - 2014-07-25 12:09 - 00704512 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2014-08-14 15:45 - 2014-07-25 12:05 - 01792512 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2014-08-14 15:45 - 2014-07-25 12:00 - 01169920 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2014-08-14 15:44 - 2014-08-07 04:06 - 00529920 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2014-08-14 15:44 - 2014-08-07 04:01 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2014-08-14 15:44 - 2014-07-14 04:02 - 01216000 _____ (Microsoft Corporation) C:\windows\system32\rpcrt4.dll
2014-08-14 15:44 - 2014-07-14 03:40 - 00664064 _____ (Microsoft Corporation) C:\windows\SysWOW64\rpcrt4.dll
2014-08-03 11:35 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\windows\system32\wuaueng.dll
2014-08-03 11:35 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\windows\system32\wuauclt.exe
2014-08-03 11:35 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\windows\system32\wups2.dll
2014-08-03 11:35 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\windows\system32\wucltux.dll
2014-08-03 11:34 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\windows\system32\wuapi.dll
2014-08-03 11:34 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapi.dll
2014-08-03 11:34 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\windows\system32\wups.dll
2014-08-03 11:34 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\windows\SysWOW64\wups.dll
2014-08-03 11:34 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\windows\system32\wudriver.dll
2014-08-03 11:34 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\windows\SysWOW64\wudriver.dll
2014-08-03 11:34 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\windows\system32\wuwebv.dll
2014-08-03 11:34 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuwebv.dll
2014-08-03 11:34 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\windows\system32\wuapp.exe
2014-08-03 11:34 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapp.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-18 16:38 - 2014-08-18 16:37 - 00030008 _____ () C:\Users\Petra\Desktop\FRST.txt
2014-08-18 16:37 - 2014-08-17 18:56 - 00000000 ____D () C:\FRST
2014-08-18 16:36 - 2014-08-18 16:36 - 00000472 _____ () C:\Users\Petra\Desktop\defogger_disable.log
2014-08-18 16:36 - 2012-04-27 18:13 - 00001112 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-08-18 16:29 - 2009-07-14 06:45 - 00028624 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-18 16:29 - 2009-07-14 06:45 - 00028624 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-18 16:25 - 2013-08-18 14:54 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-08-18 16:22 - 2013-12-28 11:57 - 00000000 ____D () C:\Users\Petra\AppData\Roaming\newnext.me
2014-08-18 16:21 - 2014-05-21 13:35 - 00000406 _____ () C:\windows\Tasks\a2zLyrics Update.job
2014-08-18 16:21 - 2014-05-21 13:35 - 00000396 _____ () C:\windows\Tasks\a2zLyrics_wd.job
2014-08-18 16:21 - 2013-09-25 16:45 - 00001830 _____ () C:\windows\Tasks\Plus-HD-1.6-firefoxinstaller.job
2014-08-18 16:21 - 2013-09-25 16:45 - 00001294 _____ () C:\windows\Tasks\Plus-HD-1.6-updater.job
2014-08-18 16:21 - 2013-09-25 16:45 - 00001198 _____ () C:\windows\Tasks\Plus-HD-1.6-codedownloader.job
2014-08-18 16:21 - 2013-09-25 16:45 - 00001098 _____ () C:\windows\Tasks\Plus-HD-1.6-enabler.job
2014-08-18 16:21 - 2013-09-25 16:44 - 00001906 _____ () C:\windows\Tasks\Plus-HD-1.6-chromeinstaller.job
2014-08-18 16:21 - 2012-04-27 18:13 - 00001108 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-08-18 16:20 - 2009-07-14 07:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-08-18 16:20 - 2009-07-14 06:51 - 00163373 _____ () C:\windows\setupact.log
2014-08-18 16:20 - 2009-07-14 06:45 - 00428424 _____ () C:\windows\system32\FNTCACHE.DAT
2014-08-18 16:18 - 2014-08-18 16:18 - 00003352 ____N () C:\bootsqm.dat
2014-08-17 21:19 - 2011-11-04 10:55 - 01101906 _____ () C:\windows\WindowsUpdate.log
2014-08-17 20:44 - 2013-05-11 16:44 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-08-17 20:43 - 2014-08-17 20:43 - 00380416 _____ () C:\Users\Petra\Desktop\Gmer-19357.exe
2014-08-17 20:41 - 2012-03-26 17:34 - 00001128 _____ () C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-983883370-204824152-491102941-1003UA.job
2014-08-17 20:33 - 2014-08-17 20:08 - 00000000 ____D () C:\Users\Petra\AppData\Local\Windows Live
2014-08-17 20:23 - 2014-06-15 19:12 - 00000000 ____D () C:\Users\Carolin\Documents\AA_Speichern
2014-08-17 20:19 - 2012-04-21 13:16 - 00001120 _____ () C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-983883370-204824152-491102941-1000UA.job
2014-08-17 20:08 - 2014-08-17 20:08 - 00000000 ____D () C:\Users\Petra\AppData\Local\{F0DA4742-F4B6-453C-889D-FD0AAC8373FE}
2014-08-17 20:08 - 2014-08-17 20:08 - 00000000 ____D () C:\Users\Petra\AppData\Local\{DB61EB1B-E156-44D3-BD41-D2F0D176CFFF}
2014-08-17 19:24 - 2014-08-17 19:24 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-08-17 18:56 - 2014-08-17 18:56 - 02101760 _____ (Farbar) C:\Users\Petra\Desktop\FRST64.exe
2014-08-17 18:53 - 2014-08-17 18:53 - 00000000 _____ () C:\Users\Petra\defogger_reenable
2014-08-17 18:53 - 2012-03-08 19:04 - 00000000 ____D () C:\Users\Petra
2014-08-17 18:52 - 2014-08-17 18:52 - 00050477 _____ () C:\Users\Petra\Desktop\Defogger.exe
2014-08-17 18:41 - 2012-03-26 17:34 - 00001076 _____ () C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-983883370-204824152-491102941-1003Core.job
2014-08-17 16:44 - 2009-07-14 07:32 - 00000000 ____D () C:\windows\system32\FxsTmp
2014-08-16 20:49 - 2012-03-19 16:32 - 00000000 ____D () C:\Users\Carolin\AppData\Roaming\Skype
2014-08-16 15:32 - 2012-04-21 13:17 - 00002544 _____ () C:\Users\Petra\Desktop\Google Chrome.lnk
2014-08-15 21:48 - 2012-03-26 17:35 - 00002362 _____ () C:\Users\Carolin\Desktop\Google Chrome.lnk
2014-08-15 21:27 - 2013-04-26 18:51 - 00001268 _____ () C:\Users\Public\Desktop\SimCity™.lnk
2014-08-15 21:27 - 2013-04-26 18:31 - 00000000 ____D () C:\Program Files (x86)\Origin Games
2014-08-15 21:26 - 2013-04-26 18:28 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-08-15 21:26 - 2013-04-26 18:24 - 00000000 ____D () C:\ProgramData\Origin
2014-08-15 18:23 - 2012-06-04 15:46 - 00000000 ____D () C:\Users\Petra\Documents\Outlook-Dateien
2014-08-15 17:11 - 2012-03-18 15:08 - 00000000 ____D () C:\Users\Carolin\AppData\Roaming\SoftGrid Client
2014-08-15 16:19 - 2012-04-21 13:16 - 00001068 _____ () C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-983883370-204824152-491102941-1000Core.job
2014-08-15 14:43 - 2014-06-15 19:41 - 00000000 ____D () C:\Users\Carolin\AppData\Roaming\.minecraft
2014-08-15 14:43 - 2011-11-04 10:21 - 00738312 _____ () C:\windows\system32\perfh00C.dat
2014-08-15 14:43 - 2011-11-04 10:21 - 00149982 _____ () C:\windows\system32\perfc00C.dat
2014-08-15 14:43 - 2011-11-04 10:10 - 00732642 _____ () C:\windows\system32\perfh010.dat
2014-08-15 14:43 - 2011-11-04 10:10 - 00147248 _____ () C:\windows\system32\perfc010.dat
2014-08-15 14:43 - 2011-11-04 10:02 - 00700134 _____ () C:\windows\system32\perfh007.dat
2014-08-15 14:43 - 2011-11-04 10:02 - 00149984 _____ () C:\windows\system32\perfc007.dat
2014-08-15 14:43 - 2009-07-14 07:13 - 03389512 _____ () C:\windows\system32\PerfStringBackup.INI
2014-08-15 14:29 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\PolicyDefinitions
2014-08-14 18:59 - 2012-03-16 08:57 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-08-14 18:50 - 2013-10-13 16:42 - 00000000 ____D () C:\windows\system32\MRT
2014-08-14 18:43 - 2013-10-13 16:42 - 99218768 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-08-14 18:33 - 2014-05-07 09:07 - 00000000 ___SD () C:\windows\system32\CompatTel
2014-08-07 04:06 - 2014-08-14 15:44 - 00529920 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2014-08-07 04:01 - 2014-08-14 15:44 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2014-08-06 16:20 - 2012-03-30 15:18 - 00000000 ____D () C:\Users\Petra\AppData\Local\CrashDumps
2014-08-01 01:41 - 2014-08-14 15:45 - 00348856 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2014-08-01 01:16 - 2014-08-14 15:45 - 00307384 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2014-07-31 11:29 - 2009-07-14 07:08 - 00032632 _____ () C:\windows\Tasks\SCHEDLGU.TXT
2014-07-25 17:37 - 2013-03-14 19:49 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-07-25 17:37 - 2013-03-14 19:49 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-07-25 16:52 - 2014-08-14 15:45 - 23645696 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-07-25 16:02 - 2014-08-14 15:45 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-07-25 16:01 - 2014-08-14 15:45 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2014-07-25 15:51 - 2014-08-14 15:45 - 17524224 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2014-07-25 15:30 - 2014-08-14 15:45 - 00066048 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2014-07-25 15:28 - 2014-08-14 15:45 - 00548352 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2014-07-25 15:28 - 2014-08-14 15:45 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2014-07-25 15:25 - 2014-08-14 15:45 - 02774528 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2014-07-25 15:25 - 2014-08-14 15:45 - 00083968 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
2014-07-25 15:11 - 2014-08-14 15:45 - 00051200 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2014-07-25 15:10 - 2014-08-14 15:45 - 00033792 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2014-07-25 15:04 - 2014-08-14 15:45 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2014-07-25 15:03 - 2014-08-14 15:45 - 00598016 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2014-07-25 15:00 - 2014-08-14 15:45 - 00139264 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2014-07-25 15:00 - 2014-08-14 15:45 - 00111616 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2014-07-25 14:59 - 2014-08-14 15:45 - 00758272 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2014-07-25 14:47 - 2014-08-14 15:45 - 00940032 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2014-07-25 14:40 - 2014-08-14 15:45 - 00452096 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2014-07-25 14:34 - 2014-08-14 15:45 - 00455168 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2014-07-25 14:34 - 2014-08-14 15:45 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2014-07-25 14:33 - 2014-08-14 15:45 - 00051200 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll
2014-07-25 14:30 - 2014-08-14 15:45 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll
2014-07-25 14:28 - 2014-08-14 15:45 - 05824512 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2014-07-25 14:28 - 2014-08-14 15:45 - 00072704 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2014-07-25 14:21 - 2014-08-14 15:45 - 02184704 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2014-07-25 14:19 - 2014-08-14 15:45 - 00195584 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2014-07-25 14:18 - 2014-08-14 15:45 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2014-07-25 14:17 - 2014-08-14 15:45 - 00085504 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-07-25 14:17 - 2014-08-14 15:45 - 00032768 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2014-07-25 14:12 - 2014-08-14 15:45 - 00438784 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2014-07-25 14:10 - 2014-08-14 15:45 - 00292864 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2014-07-25 14:10 - 2014-08-14 15:45 - 00112128 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2014-07-25 14:08 - 2014-08-14 15:45 - 00597504 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll
2014-07-25 14:06 - 2014-08-14 15:45 - 04204032 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2014-07-25 13:52 - 2014-08-14 15:45 - 00367104 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2014-07-25 13:47 - 2014-08-14 15:45 - 00631808 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2014-07-25 13:43 - 2014-08-14 15:45 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-07-25 13:42 - 2014-08-14 15:45 - 00692736 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2014-07-25 13:39 - 2014-08-14 15:45 - 02087936 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2014-07-25 13:39 - 2014-08-14 15:45 - 01249280 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2014-07-25 13:36 - 2014-08-14 15:45 - 00164864 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2014-07-25 13:34 - 2014-08-14 15:45 - 00069632 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2014-07-25 13:29 - 2014-08-14 15:45 - 00239616 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2014-07-25 13:23 - 2014-08-14 15:45 - 13547008 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2014-07-25 13:13 - 2014-08-14 15:45 - 00526336 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2014-07-25 13:07 - 2014-08-14 15:45 - 02001920 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2014-07-25 13:07 - 2014-08-14 15:45 - 01068032 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll
2014-07-25 13:03 - 2014-08-14 15:45 - 11772928 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2014-07-25 12:52 - 2014-08-14 15:45 - 02266624 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2014-07-25 12:26 - 2014-08-14 15:45 - 01431040 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2014-07-25 12:17 - 2014-08-14 15:45 - 00846336 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2014-07-25 12:09 - 2014-08-14 15:45 - 00704512 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2014-07-25 12:05 - 2014-08-14 15:45 - 01792512 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2014-07-25 12:00 - 2014-08-14 15:45 - 01169920 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2014-07-24 10:42 - 2013-03-14 19:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-07-19 09:53 - 2012-03-16 18:26 - 00000000 ____D () C:\Users\Petra\Documents\Petra

Some content of TEMP:
====================
C:\Users\Carolin\AppData\Local\Temp\avgnt.exe
C:\Users\Carolin\AppData\Local\Temp\COMAP.EXE
C:\Users\Carolin\AppData\Local\Temp\FP_PL_PFS_INSTALLER_32bit.exe
C:\Users\Carolin\AppData\Local\Temp\Shortcut_SweetImSetup.exe
C:\Users\Carolin\AppData\Local\Temp\SIMEEIInstaller.exe
C:\Users\Carolin\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Carolin\AppData\Local\Temp\uninst1.exe
C:\Users\Carolin\AppData\Local\Temp\wajam_install.exe
C:\Users\Petra\AppData\Local\Temp\avgnt.exe
C:\Users\Petra\AppData\Local\Temp\BackupSetup.exe
C:\Users\Petra\AppData\Local\Temp\COMAP.EXE
C:\Users\Petra\AppData\Local\Temp\f.exe
C:\Users\Petra\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe
C:\Users\Petra\AppData\Local\Temp\jre-7u60-windows-i586-iftw.exe
C:\Users\Petra\AppData\Local\Temp\ose00000.exe
C:\Users\Petra\AppData\Local\Temp\SkypeSetup.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-06-12 13:17

==================== End Of Log ============================
und Gmer ( habe das Antivirenprogramm,wie im Tutorial gefordert, nicht beenden können, schien trotzdem zu klappen?)
Code:
ATTFilter
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-08-18 19:05:48
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\00000077 ST950032 rev.0004 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\Petra\AppData\Local\Temp\kxddypob.sys


---- Kernel code sections - GMER 2.1 ----

INITKDBG  C:\windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528                                        fffff80003201000 45 bytes [00, 00, 51, 02, 54, 68, 72, ...]
INITKDBG  C:\windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 575                                        fffff8000320102f 16 bytes [00, 01, 00, 00, 00, 00, 00, ...]

---- User code sections - GMER 2.1 ----

.text     C:\ProgramData\IBUpdaterService\ibsvc.exe[2040] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69   0000000076cf1465 2 bytes [CF, 76]
.text     C:\ProgramData\IBUpdaterService\ibsvc.exe[2040] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155  0000000076cf14bb 2 bytes [CF, 76]
.text     ...                                                                                                       * 2
?         C:\windows\system32\mssprxy.dll [2172] entry point in ".rdata" section                                    0000000074e871e6

---- Threads - GMER 2.1 ----

Thread    C:\windows\System32\svchost.exe [964:1704]                                                                000007fefd7b20b0
Thread    C:\windows\System32\svchost.exe [1012:2480]                                                               000007fef96b88f8
Thread    C:\windows\System32\svchost.exe [1012:3924]                                                               000007fef93544e0
Thread    C:\windows\system32\svchost.exe [340:5988]                                                                000007fef88cb1b0
Thread    C:\windows\system32\svchost.exe [416:1360]                                                                000007fefa201e00
Thread    C:\windows\system32\svchost.exe [416:1364]                                                                000007fefa0d1a50
Thread    C:\windows\system32\svchost.exe [416:1736]                                                                000007fefd061a70
Thread    C:\windows\system32\svchost.exe [416:2496]                                                                000007fefd061a70
Thread    C:\windows\system32\svchost.exe [416:2868]                                                                000007fef8d4506c
Thread    C:\windows\system32\svchost.exe [416:2872]                                                                000007fef8d61c20
Thread    C:\windows\system32\svchost.exe [416:2876]                                                                000007fef8d61c20
Thread    C:\windows\system32\svchost.exe [416:11680]                                                               000007fef90117f8
Thread    C:\windows\system32\svchost.exe [416:6728]                                                                000007fef90117f8
Thread    C:\windows\system32\svchost.exe [416:8060]                                                                000007fefaf74164
Thread    C:\windows\system32\svchost.exe [1052:1264]                                                               000007fefabf8274
Thread    C:\windows\system32\svchost.exe [1052:2700]                                                               000007fefabf8274
Thread    C:\windows\System32\spoolsv.exe [1396:2112]                                                               000007fef82110c8
Thread    C:\windows\System32\spoolsv.exe [1396:2120]                                                               000007fef81d6144
Thread    C:\windows\System32\spoolsv.exe [1396:2144]                                                               000007fef7fc5fd0
Thread    C:\windows\System32\spoolsv.exe [1396:2604]                                                               000007fef7fb3438
Thread    C:\windows\System32\spoolsv.exe [1396:2632]                                                               000007fef7fc63ec
Thread    C:\windows\System32\spoolsv.exe [1396:2640]                                                               000007fef82a5e5c
Thread    C:\windows\System32\spoolsv.exe [1396:2644]                                                               000007fef82b5074
Thread    C:\windows\System32\spoolsv.exe [1396:3132]                                                               0000000001aee0bc
Thread    C:\windows\System32\spoolsv.exe [1396:1180]                                                               0000000001ae81fc
Thread    C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2440:2652]                0000000070be6358
Thread    C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2440:3028]                000000007031f71d
Thread    C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2440:3036]                000000007031f71d
Thread    C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2440:3040]                0000000070315b1a
Thread    C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2440:3476]                0000000070b90b14
Thread    C:\windows\system32\taskhost.exe [2940:2908]                                                              000007fef8d01f38
Thread    C:\windows\system32\taskhost.exe [2940:2928]                                                              000007fef7eb2740
Thread    C:\windows\system32\taskhost.exe [2940:2748]                                                              000007fefb191010
Thread    C:\windows\system32\taskhost.exe [2940:2152]                                                              000007fef97f5170
Thread    C:\windows\Explorer.EXE [2432:4808]                                                                       000007fefb212154
Thread    C:\windows\Explorer.EXE [2432:5096]                                                                       000007fefbd76204
Thread    C:\windows\Explorer.EXE [2432:380]                                                                        000007fef3112118
Thread    C:\windows\Explorer.EXE [2432:2268]                                                                       000007fef2a02f9c
Thread    C:\windows\Explorer.EXE [2432:7028]                                                                       000007fefb191010
Thread    C:\windows\Explorer.EXE [2432:7952]                                                                       000007fef320a3f8
Thread    C:\windows\Explorer.EXE [2432:7976]                                                                       000007fef2a02f9c
Thread    C:\windows\Explorer.EXE [2432:7980]                                                                       000007fef2a02f9c

---- Registry - GMER 2.1 ----

Reg       HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\002454f1e134                               
Reg       HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\002454f44829                               
Reg       HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\002454f1e134 (not active ControlSet)           
Reg       HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\002454f44829 (not active ControlSet)           

---- Disk sectors - GMER 2.1 ----

Disk      \Device\Harddisk0\DR0                                                                                     unknown MBR code

---- EOF - GMER 2.1 ----
So das war es, die addition text datei habe ich nicht bekommen,als ich mit FRST gescannt habe. Hoffe einer von euch kann sich meines Problems annehmen
Gruß

 

Themen zu Windows 7 - Werbevirus
avira, bonjour, browser, festplatte, flash player, google, iexplore.exe, js/securitydisabler.a.gen, js/toolbar.crossrider.b, lightning, mobogenie, mobogenie entfernen, nationzoom, nationzoom entfernen, newtab, programm, registry, software, suchmaschine, svchost.exe, symantec, werbevirus, werbung, win32/adware.yontoo.b, win32/installcore.a, win32/nationzoom.a, win32/toolbar.iminent.e, zweiter tab


« win7; HpUI.exe; lässt sich nicht aus taskleiste entfernen | Malsign.Dailytools.3A7 »


Ähnliche Themen: Windows 7 - Werbevirus


  1. Windows 8.1: Runtime Errror c:\windows\syswow64\rundll32.exe und Update-Fehler bei Windows
    Log-Analyse und Auswertung - 24.11.2015 (14)
  2. Werbevirus auf Computer und Handy
    Plagegeister aller Art und deren Bekämpfung - 24.08.2015 (5)
  3. Werbevirus-UnisAlles
    Alles rund um Windows - 01.01.2015 (5)
  4. Windows 8, Windows 7, Android, Windows Phone - Websiten werden auf adfoc.us umgeleitet
    Plagegeister aller Art und deren Bekämpfung - 30.11.2014 (7)
  5. Windows 8: Werbevirus-Befall trotz Antivirenprogramm,Malwarebytes nicht installierbar
    Plagegeister aller Art und deren Bekämpfung - 04.08.2014 (16)
  6. Werbevirus Oxy
    Plagegeister aller Art und deren Bekämpfung - 03.04.2014 (23)
  7. Werbevirus benötige hilfe
    Plagegeister aller Art und deren Bekämpfung - 16.02.2014 (1)
  8. Windows 7: Windows-Sicherheitscenter und Windows Defender funktionieren nicht mehr, Services.exe verseucht?
    Log-Analyse und Auswertung - 07.01.2014 (8)
  9. Werbevirus (u.a. Vendo, ..., ...) seit der Installation von JDownloader
    Plagegeister aller Art und deren Bekämpfung - 30.08.2013 (6)
  10. Werbevirus - Log erstellt
    Log-Analyse und Auswertung - 11.01.2013 (17)
  11. Werbevirus und Windows 7 Sicherheitscenter deaktiviert!
    Plagegeister aller Art und deren Bekämpfung - 28.07.2011 (19)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema Windows 7 - Werbevirus - Hallo, habe den Laptop von verzweifelten Verwandten erhalten. Anscheinend ist ist dieser Windows 7 Laptop hier seit ca 8 Monaten (seit Weihnachten rum) mit dem Virus befallen. Man bekommt häufig - Windows 7 - Werbevirus...
Archiv
Du betrachtest: Windows 7 - Werbevirus auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19