| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Windows 7: MBAM meldet immer wieder den gleichen FundWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
25.08.2014, 16:50
| #1 |
| |  Windows 7: MBAM meldet immer wieder den gleichen Fund Moin, Seit kurzem bekomme ich bei jedem Suchlauf von MBAM eine Bedrohung angezeigt. Zwar schiebe ich sie dann mit dem Programm in Quarantäne, jedoch meldet MBAM dann beim nächsten Suchlauf (am nächsten Tag) die Bedrohung wieder. Nun wende ich mich an euch, vielleicht wisst ihr ja was der Grund dafür ist und wie man das Problem beheben kann  Vielleicht mache ich ja auch nur einen Fehler.. Nach dem GMER Scan wollte sich Avira nicht mehr einschalten lassen, habe es nun gelöscht und durch Avast ersetzt. Desweiteren ist mir aufgefallen, das mein Laptop beim Starten oft sehr langsam ist. Das anmelden am Benutzerkonto läuft noch flüssig, wenn dann der Desktop angezeigt wird, dauert es allerdings zwischen 5 und 10 Minuten bis ich Chrome o.ä. öffnen kann. Ich denke mal es wird an der Autostart datei liegen, oder? Wie kann ich die Aufräumen und was darf ich da bedenkenlos raus werfen? wäre für den ein oder anderen Tipp sehr dankbar Nachfolgend die Log Dateien: defogger: Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 17:03 on 25/08/2014 (Schramm_Felix)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-08-2014 03 Ran by Felix_Schramm (ATTENTION: The logged in user is not administrator) on LIFEBOOK on 25-08-2014 17:04:42 Running from C:\Users\Felix_Schramm\Downloads Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 Boot Mode: Normal The only official download link for FRST: Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (OpenLimit SignCubes AG) C:\Program Files (x86)\AusweisApp\siqBootLoader.exe (Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe (Dominik Reichl) C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13657304 2013-10-18] (Realtek Semiconductor) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [751184 2014-08-07] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [KeePass 2 PreLoad] => C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [2117632 2014-07-06] (Dominik Reichl) HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [161584 2014-08-04] (Avira Operations GmbH & Co. KG) HKLM-x32\...\RunOnce: [BCSETUP_REBOOT] => [X] Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKU\S-1-5-21-1720165562-133132595-3868955016-1006\...\Run: [AusweisApp] => C:\Program Files (x86)\AusweisApp\siqBootLoader.exe [2518656 2014-01-24] (OpenLimit SignCubes AG) HKU\S-1-5-21-1720165562-133132595-3868955016-1006\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1 Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia) Startup: C:\Users\Felix_Schramm\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE (No File) Startup: C:\Users\Felix_Schramm\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\Felix_Schramm\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) Startup: C:\Users\Schramm_Felix\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk ShortcutTarget: Adobe Gamma.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.) ShellIconOverlayIdentifiers: SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File ShellIconOverlayIdentifiers: SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File ShellIconOverlayIdentifiers: SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/ HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x354A654078A6CF01 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.de HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.de SearchScopes: HKLM - DefaultScope {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms} SearchScopes: HKLM - {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms} SearchScopes: HKLM-x32 - DefaultScope value is missing. SearchScopes: HKLM-x32 - {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms} SearchScopes: HKCU - DefaultScope {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms} SearchScopes: HKCU - {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms} BHO: AusweisApp 1.12.0.0 -> {C9EE92B7-EDD5-4ad9-8029-2EC6818E653A} -> C:\Program Files (x86)\AusweisApp\siqeCardClientIE64.ols (OpenLimit SignCubes AG) BHO-x32: No Name -> {02478D38-C3F9-4efb-9B51-7695ECA05670} -> No File BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Avira Savings Advisor BHO -> {A18A516C-AA41-46A9-92DB-60208917E442} -> C:\Program Files (x86)\avira\Internet Explorer\avira32.dll () BHO-x32: AusweisApp 1.12.0.0 -> {C9EE92B7-EDD5-4ad9-8029-2EC6818E653A} -> C:\Program Files (x86)\AusweisApp\siqeCardClientIE32.ols (OpenLimit SignCubes AG) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.) Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - No File Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @Skype Technologies S.A..com/Skype Web Plugin -> C:\Program Files (x86)\SkypeWebPlugin\npSkypeWebPlugin64.dll (Skype) FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/DownloadManager,version=1.1 -> C:\Windows\ () FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin-x32: @Skype Technologies S.A..com/Skype Web Plugin -> C:\Program Files (x86)\SkypeWebPlugin\npSkypeWebPlugin.dll (Skype) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Felix_Schramm\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2014-02-23] Chrome: ======= CHR DefaultSuggestURL: {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&xssi=t&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}{google:pageClassification}sugkey={google:suggestAPIKeyParameter} CHR Extension: (Google Docs) - C:\Users\Felix_Schramm\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-02-23] CHR Extension: (Google Drive) - C:\Users\Felix_Schramm\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-02-23] CHR Extension: (YouTube) - C:\Users\Felix_Schramm\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-02-23] CHR Extension: (Adblock Plus) - C:\Users\Felix_Schramm\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-05-07] CHR Extension: (Avira Sparberater) - C:\Users\Felix_Schramm\AppData\Local\Google\Chrome\User Data\Default\Extensions\cojnmaaohncijldefpkpkkakjonfmgeb [2014-02-23] CHR Extension: (Google-Suche) - C:\Users\Felix_Schramm\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-02-23] CHR Extension: (Google Wallet) - C:\Users\Felix_Schramm\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-02-23] CHR Extension: (Google Mail) - C:\Users\Felix_Schramm\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-02-23] CHR HKLM-x32\...\Chrome\Extension: [cojnmaaohncijldefpkpkkakjonfmgeb] - C:\Program Files (x86)\avira\Chrome\avira-1.5.14.crx [2013-12-11] CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2014-02-17] (Adobe Systems) [File not signed] R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-08-07] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-07] (Avira Operations GmbH & Co. KG) R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [149296 2014-08-04] (Avira Operations GmbH & Co. KG) R2 cjpcsc; C:\Windows\SysWOW64\cjpcsc.exe [514128 2012-03-19] (REINER SCT) R3 hpqcxs08; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll [249344 2009-09-20] (Hewlett-Packard Co.) [File not signed] R2 hpqddsvc; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-09-20] (Hewlett-Packard Co.) [File not signed] R2 HPSLPSVC; C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL [1037824 2009-09-20] (Hewlett-Packard Co.) [File not signed] R2 lmhosts; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation) R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [50688 2013-05-16] (Hewlett-Packard) [File not signed] R2 NlaSvc; C:\Windows\System32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) R2 nsi; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [66048 2013-05-16] (Hewlett-Packard) [File not signed] R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia) R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia) R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [2671376 2012-04-17] (Intel® Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-06-24] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-05-22] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-02-14] (Avira Operations GmbH & Co. KG) S3 cjusb; C:\Windows\System32\DRIVERS\cjusb.sys [34672 2011-03-29] (REINER SCT) R3 FUJ02B1; C:\Windows\System32\DRIVERS\FUJ02B1.sys [7808 2006-11-01] (FUJITSU LIMITED) R3 FUJ02E3; C:\Windows\System32\DRIVERS\FUJ02E3.sys [7296 2006-11-01] (FUJITSU LIMITED) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation) S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-06-23] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation) R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-12-06] (Secunia) R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.) R3 SMSCIRDA; C:\Windows\System32\DRIVERS\SMSCir64.sys [37760 2007-04-25] (SMSC) U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation) S3 catchme; \??\C:\ComboFix\catchme.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-08-25 17:04 - 2014-08-25 17:05 - 00015941 _____ () C:\Users\Felix_Schramm\Downloads\FRST.txt 2014-08-25 17:04 - 2014-08-25 17:04 - 00000000 ____D () C:\FRST 2014-08-25 17:03 - 2014-08-25 17:03 - 02103296 _____ (Farbar) C:\Users\Felix_Schramm\Downloads\FRST64.exe 2014-08-25 17:03 - 2014-08-25 17:03 - 00000488 _____ () C:\Users\Felix_Schramm\Downloads\defogger_disable.log 2014-08-25 17:03 - 2014-08-25 17:03 - 00000000 _____ () C:\Users\Schramm_Felix\defogger_reenable 2014-08-25 17:02 - 2014-08-25 17:02 - 00050477 _____ () C:\Users\Felix_Schramm\Downloads\Defogger.exe 2014-08-25 17:01 - 2014-08-25 17:01 - 00001259 _____ () C:\Users\Felix_Schramm\Desktop\Malwarebytes Anti-Malware 25.08.2014.txt 2014-08-25 15:59 - 2014-08-25 15:59 - 21543568 _____ () C:\WindowsMSYH.tt2 2014-08-25 15:59 - 2014-08-25 15:59 - 21302624 _____ () C:\WindowsMSJH.tt2 2014-08-25 15:59 - 2014-08-25 15:59 - 14381616 _____ () C:\WindowsMSYHBD.tt2 2014-08-25 15:59 - 2014-08-25 15:59 - 14343024 _____ () C:\WindowsMSJHBD.tt2 2014-08-25 15:59 - 2014-08-25 15:59 - 00199772 _____ () C:\WindowsGARABD.tt2 2014-08-25 15:59 - 2014-08-25 15:59 - 00198072 _____ () C:\WindowsGARA.tt2 2014-08-25 15:59 - 2014-08-25 15:59 - 00189464 _____ () C:\WindowsGARAIT.tt2 2014-08-25 15:59 - 2014-08-25 15:59 - 00076588 _____ () C:\WindowsALGER.tt2 2014-08-25 15:59 - 2014-08-25 15:59 - 00066696 _____ () C:\WindowsVIVALDII.tt2 2014-08-25 15:59 - 2014-08-25 15:59 - 00056596 _____ () C:\WindowsHARLOWSI.tt2 2014-08-25 15:59 - 2014-08-25 15:59 - 00047644 _____ () C:\WindowsBAUHS93.tt2 2014-08-25 15:27 - 2014-08-25 15:27 - 00000020 _____ () C:\Windows\°õ! 2014-08-24 16:21 - 2014-08-24 16:21 - 43077153 _____ () C:\Users\Felix_Schramm\Desktop\Finales_Bild.psd 2014-08-24 15:56 - 2014-08-24 15:57 - 00000332 _____ () C:\Users\Felix_Schramm\Downloads\bayern3_2.m3u 2014-08-24 15:56 - 2014-08-24 15:57 - 00000332 _____ () C:\Users\Felix_Schramm\Downloads\bayern3_2 (1).m3u 2014-08-23 22:52 - 2014-08-23 22:52 - 00000000 ____D () C:\Users\Felix_Schramm\AppData\Roaming\IrfanView 2014-08-23 22:51 - 2014-08-23 22:51 - 10741384 _____ (Irfan Skiljan) C:\Users\Felix_Schramm\Downloads\irfanview_plugins_438_setup.exe 2014-08-23 22:48 - 2014-08-23 22:59 - 00000000 ____D () C:\Users\Schramm_Felix\AppData\Roaming\IrfanView 2014-08-23 22:46 - 2014-08-23 22:46 - 02197648 _____ (Irfan Skiljan) C:\Users\Felix_Schramm\Downloads\iview438g_setup.exe 2014-08-23 22:46 - 2014-08-23 22:46 - 02197648 _____ (Irfan Skiljan) C:\Users\Felix_Schramm\Downloads\iview438g_setup (1).exe 2014-08-23 21:46 - 2014-08-23 21:46 - 01744299 _____ () C:\Users\Felix_Schramm\Desktop\sonnenuntergang_Fabi_bearbeitet.psd 2014-08-23 21:41 - 2014-08-23 21:41 - 05909368 _____ () C:\Users\Felix_Schramm\Desktop\sonnenuntergang_Fabi.psd 2014-08-23 20:05 - 2014-08-23 20:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Phone 2014-08-23 20:05 - 2014-08-23 20:05 - 00000000 ____D () C:\Program Files (x86)\Windows Phone 2014-08-23 20:03 - 2014-08-23 20:03 - 00000000 ____D () C:\ProgramData\Applications 2014-08-23 20:02 - 2014-08-23 20:02 - 06745792 _____ (Microsoft Corporation) C:\Users\Felix_Schramm\Downloads\WindowsPhone.exe 2014-08-22 15:43 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll 2014-08-22 15:43 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll 2014-08-22 15:43 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll 2014-08-22 15:43 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe 2014-08-22 15:43 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll 2014-08-22 15:43 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll 2014-08-22 15:43 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll 2014-08-22 15:43 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll 2014-08-22 15:43 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll 2014-08-22 15:43 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll 2014-08-22 15:42 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll 2014-08-22 15:42 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll 2014-08-22 15:42 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe 2014-08-22 15:42 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe 2014-08-22 00:10 - 2014-08-22 00:10 - 00000000 ____D () C:\Users\Schramm_Felix\AppData\Roaming\thriXXX 2014-08-22 00:10 - 2014-08-22 00:10 - 00000000 ____D () C:\Users\Schramm_Felix\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\thriXXX 2014-08-22 00:10 - 2014-08-22 00:10 - 00000000 ____D () C:\ProgramData\thriXXX 2014-08-22 00:10 - 2014-08-22 00:10 - 00000000 ____D () C:\Program Files (x86)\thriXXX 2014-08-22 00:05 - 2014-08-22 00:06 - 15937152 _____ () C:\Users\Felix_Schramm\Downloads\thriXXX Launcher.exe 2014-08-21 20:48 - 2014-08-21 20:49 - 01101648 _____ () C:\Users\Felix_Schramm\Downloads\micro SIM Schablone - CHIP-Installer.exe 2014-08-20 11:20 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll 2014-08-20 11:20 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll 2014-08-20 11:20 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe 2014-08-20 11:20 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe 2014-08-20 11:20 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe 2014-08-20 11:20 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll 2014-08-20 11:20 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe 2014-08-20 11:20 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll 2014-08-19 21:40 - 2014-08-01 01:41 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-08-19 21:40 - 2014-08-01 01:16 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2014-08-19 21:40 - 2014-07-25 16:52 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-08-19 21:40 - 2014-07-25 16:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-08-19 21:40 - 2014-07-25 16:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-08-19 21:40 - 2014-07-25 15:51 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-08-19 21:40 - 2014-07-25 15:30 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-08-19 21:40 - 2014-07-25 15:28 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-08-19 21:40 - 2014-07-25 15:28 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-08-19 21:40 - 2014-07-25 15:25 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-08-19 21:40 - 2014-07-25 15:25 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-08-19 21:40 - 2014-07-25 15:11 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-08-19 21:40 - 2014-07-25 15:10 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-08-19 21:40 - 2014-07-25 15:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-08-19 21:40 - 2014-07-25 15:03 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-08-19 21:40 - 2014-07-25 15:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-08-19 21:40 - 2014-07-25 15:00 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-08-19 21:40 - 2014-07-25 14:59 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-08-19 21:40 - 2014-07-25 14:47 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-08-19 21:40 - 2014-07-25 14:40 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-08-19 21:40 - 2014-07-25 14:34 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-08-19 21:40 - 2014-07-25 14:34 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-08-19 21:40 - 2014-07-25 14:33 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-08-19 21:40 - 2014-07-25 14:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2014-08-19 21:40 - 2014-07-25 14:28 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-08-19 21:40 - 2014-07-25 14:28 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-08-19 21:40 - 2014-07-25 14:21 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-08-19 21:40 - 2014-07-25 14:19 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-08-19 21:40 - 2014-07-25 14:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-08-19 21:40 - 2014-07-25 14:17 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-08-19 21:40 - 2014-07-25 14:17 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-08-19 21:40 - 2014-07-25 14:12 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-08-19 21:40 - 2014-07-25 14:10 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-08-19 21:40 - 2014-07-25 14:10 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-08-19 21:40 - 2014-07-25 14:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-08-19 21:40 - 2014-07-25 14:06 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-08-19 21:40 - 2014-07-25 13:52 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-08-19 21:40 - 2014-07-25 13:47 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-08-19 21:40 - 2014-07-25 13:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2014-08-19 21:40 - 2014-07-25 13:42 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-08-19 21:40 - 2014-07-25 13:39 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-08-19 21:40 - 2014-07-25 13:39 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2014-08-19 21:40 - 2014-07-25 13:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-08-19 21:40 - 2014-07-25 13:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-08-19 21:40 - 2014-07-25 13:29 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-08-19 21:40 - 2014-07-25 13:23 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-08-19 21:40 - 2014-07-25 13:13 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-08-19 21:40 - 2014-07-25 13:07 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-08-19 21:40 - 2014-07-25 13:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2014-08-19 21:40 - 2014-07-25 13:03 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-08-19 21:40 - 2014-07-25 12:52 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-08-19 21:40 - 2014-07-25 12:26 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-08-19 21:40 - 2014-07-25 12:17 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-08-19 21:40 - 2014-07-25 12:09 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-08-19 21:40 - 2014-07-25 12:05 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-08-19 21:40 - 2014-07-25 12:00 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-08-19 21:39 - 2014-07-16 05:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2014-08-19 21:39 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll 2014-08-19 21:39 - 2014-06-25 04:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll 2014-08-19 21:39 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll 2014-08-19 21:38 - 2014-06-16 04:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys 2014-08-19 21:38 - 2014-06-03 12:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll 2014-08-19 21:38 - 2014-06-03 12:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll 2014-08-19 21:38 - 2014-06-03 12:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll 2014-08-19 21:38 - 2014-06-03 12:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe 2014-08-19 21:38 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll 2014-08-19 21:38 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll 2014-08-19 21:38 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll 2014-08-19 21:33 - 2014-07-14 04:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll 2014-08-19 21:33 - 2014-07-14 03:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll 2014-08-19 21:32 - 2014-08-07 04:06 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-08-19 21:32 - 2014-08-07 04:01 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-08-07 14:52 - 2014-08-24 15:50 - 00001154 _____ () C:\Users\Public\Desktop\Avira.lnk 2014-08-07 14:47 - 2014-08-07 14:47 - 00000000 ____D () C:\Users\Felix_Schramm\AppData\Local\Verlag_Heinrich_Vogel_in_ 2014-08-07 14:42 - 2014-08-24 15:50 - 00000000 ____D () C:\ProgramData\Package Cache 2014-08-05 17:52 - 2014-08-05 17:53 - 00000000 ____D () C:\Users\Felix_Schramm\Documents\OneNote-Notizbücher 2014-08-05 17:45 - 2014-08-05 17:45 - 00002525 _____ () C:\Users\Public\Desktop\Microsoft Download Manager.lnk 2014-08-05 17:45 - 2014-08-05 17:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Download Manager 2014-08-05 17:45 - 2014-08-05 17:45 - 00000000 ____D () C:\Program Files (x86)\Microsoft Download Manager 2014-08-05 17:34 - 2014-08-05 17:35 - 01426944 _____ () C:\Users\Felix_Schramm\Downloads\MSDownloadManager.msi 2014-08-05 17:18 - 2014-08-05 17:18 - 01034432 _____ (Microsoft Corporation) C:\Users\Felix_Schramm\Downloads\setuponenotefreeretail.x86.de-de_.exe 2014-08-05 15:38 - 2014-08-05 15:38 - 00000000 ____D () C:\Users\Felix_Schramm\AppData\Roaming\.mono 2014-08-05 15:38 - 2014-08-05 15:38 - 00000000 ____D () C:\ProgramData\.mono 2014-08-05 15:36 - 2014-08-05 15:36 - 00000000 ____D () C:\Users\Felix_Schramm\AppData\Local\Unity 2014-08-05 15:35 - 2014-08-05 15:36 - 01080480 _____ (Unity Technologies ApS) C:\Users\Felix_Schramm\Downloads\UnityWebPlayer.exe ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-08-25 17:05 - 2014-08-25 17:04 - 00015941 _____ () C:\Users\Felix_Schramm\Downloads\FRST.txt 2014-08-25 17:04 - 2014-08-25 17:04 - 00000000 ____D () C:\FRST 2014-08-25 17:03 - 2014-08-25 17:03 - 02103296 _____ (Farbar) C:\Users\Felix_Schramm\Downloads\FRST64.exe 2014-08-25 17:03 - 2014-08-25 17:03 - 00000488 _____ () C:\Users\Felix_Schramm\Downloads\defogger_disable.log 2014-08-25 17:03 - 2014-08-25 17:03 - 00000000 _____ () C:\Users\Schramm_Felix\defogger_reenable 2014-08-25 17:03 - 2013-12-18 17:42 - 00000000 ____D () C:\Users\Schramm_Felix 2014-08-25 17:02 - 2014-08-25 17:02 - 00050477 _____ () C:\Users\Felix_Schramm\Downloads\Defogger.exe 2014-08-25 17:01 - 2014-08-25 17:01 - 00001259 _____ () C:\Users\Felix_Schramm\Desktop\Malwarebytes Anti-Malware 25.08.2014.txt 2014-08-25 16:15 - 2014-01-30 20:38 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office 2014-08-25 16:15 - 2009-07-14 05:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared 2014-08-25 16:07 - 2014-01-09 16:22 - 00001124 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-08-25 15:59 - 2014-08-25 15:59 - 21543568 _____ () C:\WindowsMSYH.tt2 2014-08-25 15:59 - 2014-08-25 15:59 - 21302624 _____ () C:\WindowsMSJH.tt2 2014-08-25 15:59 - 2014-08-25 15:59 - 14381616 _____ () C:\WindowsMSYHBD.tt2 2014-08-25 15:59 - 2014-08-25 15:59 - 14343024 _____ () C:\WindowsMSJHBD.tt2 2014-08-25 15:59 - 2014-08-25 15:59 - 00199772 _____ () C:\WindowsGARABD.tt2 2014-08-25 15:59 - 2014-08-25 15:59 - 00198072 _____ () C:\WindowsGARA.tt2 2014-08-25 15:59 - 2014-08-25 15:59 - 00189464 _____ () C:\WindowsGARAIT.tt2 2014-08-25 15:59 - 2014-08-25 15:59 - 00076588 _____ () C:\WindowsALGER.tt2 2014-08-25 15:59 - 2014-08-25 15:59 - 00066696 _____ () C:\WindowsVIVALDII.tt2 2014-08-25 15:59 - 2014-08-25 15:59 - 00056596 _____ () C:\WindowsHARLOWSI.tt2 2014-08-25 15:59 - 2014-08-25 15:59 - 00047644 _____ () C:\WindowsBAUHS93.tt2 2014-08-25 15:40 - 2014-02-24 18:17 - 00111920 _____ () C:\Users\Felix_Schramm\AppData\Local\GDIPFONTCACHEV1.DAT 2014-08-25 15:30 - 2014-01-15 17:53 - 00000422 _____ () C:\Windows\Tasks\DriverEasy Scheduled Scan.job 2014-08-25 15:30 - 2013-12-18 23:02 - 00000000 ____D () C:\Users\Schramm_Felix\AppData\Roaming\Dropbox 2014-08-25 15:28 - 2014-07-02 14:10 - 00000000 ____D () C:\Users\Schramm_Felix\AppData\Local\Windows Live 2014-08-25 15:27 - 2014-08-25 15:27 - 00000020 _____ () C:\Windows\°õ! 2014-08-25 15:23 - 2014-07-09 17:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation 2014-08-25 15:21 - 2013-12-18 18:06 - 00111920 _____ () C:\Users\Schramm_Felix\AppData\Local\GDIPFONTCACHEV1.DAT 2014-08-25 15:17 - 2014-07-09 22:03 - 00000000 ____D () C:\ProgramData\boost_interprocess 2014-08-25 15:11 - 2013-12-18 17:33 - 01461165 ____N () C:\Windows\WindowsUpdate.log 2014-08-25 15:01 - 2009-07-14 06:45 - 00033088 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-08-25 15:01 - 2009-07-14 06:45 - 00033088 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-08-25 14:54 - 2014-07-23 15:14 - 00000000 ____D () C:\Users\Felix_Schramm\.ausweisapp 2014-08-25 14:54 - 2014-04-05 22:23 - 00000000 ___RD () C:\Users\Felix_Schramm\Dropbox 2014-08-25 14:54 - 2014-04-05 22:18 - 00000000 ____D () C:\Users\Felix_Schramm\AppData\Roaming\Dropbox 2014-08-25 14:51 - 2014-01-09 16:22 - 00001120 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-08-25 14:51 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-08-25 03:01 - 2014-02-23 20:15 - 00000000 ____D () C:\Users\Felix_Schramm\AppData\Roaming\KeePass 2014-08-24 19:04 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache 2014-08-24 16:21 - 2014-08-24 16:21 - 43077153 _____ () C:\Users\Felix_Schramm\Desktop\Finales_Bild.psd 2014-08-24 15:57 - 2014-08-24 15:56 - 00000332 _____ () C:\Users\Felix_Schramm\Downloads\bayern3_2.m3u 2014-08-24 15:57 - 2014-08-24 15:56 - 00000332 _____ () C:\Users\Felix_Schramm\Downloads\bayern3_2 (1).m3u 2014-08-24 15:50 - 2014-08-07 14:52 - 00001154 _____ () C:\Users\Public\Desktop\Avira.lnk 2014-08-24 15:50 - 2014-08-07 14:42 - 00000000 ____D () C:\ProgramData\Package Cache 2014-08-24 15:50 - 2014-02-21 17:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira 2014-08-24 15:50 - 2014-02-05 18:41 - 00000000 ____D () C:\Program Files (x86)\Avira 2014-08-23 22:59 - 2014-08-23 22:48 - 00000000 ____D () C:\Users\Schramm_Felix\AppData\Roaming\IrfanView 2014-08-23 22:52 - 2014-08-23 22:52 - 00000000 ____D () C:\Users\Felix_Schramm\AppData\Roaming\IrfanView 2014-08-23 22:51 - 2014-08-23 22:51 - 10741384 _____ (Irfan Skiljan) C:\Users\Felix_Schramm\Downloads\irfanview_plugins_438_setup.exe 2014-08-23 22:46 - 2014-08-23 22:46 - 02197648 _____ (Irfan Skiljan) C:\Users\Felix_Schramm\Downloads\iview438g_setup.exe 2014-08-23 22:46 - 2014-08-23 22:46 - 02197648 _____ (Irfan Skiljan) C:\Users\Felix_Schramm\Downloads\iview438g_setup (1).exe 2014-08-23 22:32 - 2014-04-29 14:54 - 00271360 _____ () C:\Users\Felix_Schramm\Desktop\archive.pst 2014-08-23 21:46 - 2014-08-23 21:46 - 01744299 _____ () C:\Users\Felix_Schramm\Desktop\sonnenuntergang_Fabi_bearbeitet.psd 2014-08-23 21:41 - 2014-08-23 21:41 - 05909368 _____ () C:\Users\Felix_Schramm\Desktop\sonnenuntergang_Fabi.psd 2014-08-23 20:06 - 2014-08-23 20:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Phone 2014-08-23 20:05 - 2014-08-23 20:05 - 00000000 ____D () C:\Program Files (x86)\Windows Phone 2014-08-23 20:03 - 2014-08-23 20:03 - 00000000 ____D () C:\ProgramData\Applications 2014-08-23 20:02 - 2014-08-23 20:02 - 06745792 _____ (Microsoft Corporation) C:\Users\Felix_Schramm\Downloads\WindowsPhone.exe 2014-08-23 02:03 - 2014-02-23 19:52 - 00000000 ____D () C:\Users\Felix_Schramm\AppData\Roaming\Skype 2014-08-22 00:10 - 2014-08-22 00:10 - 00000000 ____D () C:\Users\Schramm_Felix\AppData\Roaming\thriXXX 2014-08-22 00:10 - 2014-08-22 00:10 - 00000000 ____D () C:\Users\Schramm_Felix\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\thriXXX 2014-08-22 00:10 - 2014-08-22 00:10 - 00000000 ____D () C:\ProgramData\thriXXX 2014-08-22 00:10 - 2014-08-22 00:10 - 00000000 ____D () C:\Program Files (x86)\thriXXX 2014-08-22 00:06 - 2014-08-22 00:05 - 15937152 _____ () C:\Users\Felix_Schramm\Downloads\thriXXX Launcher.exe 2014-08-21 20:49 - 2014-08-21 20:48 - 01101648 _____ () C:\Users\Felix_Schramm\Downloads\micro SIM Schablone - CHIP-Installer.exe 2014-08-20 12:04 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions 2014-08-20 11:19 - 2014-05-07 13:55 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-08-19 20:33 - 2014-04-05 22:23 - 00001057 _____ () C:\Users\Felix_Schramm\Desktop\Dropbox.lnk 2014-08-19 20:33 - 2014-04-05 22:22 - 00000000 ____D () C:\Users\Felix_Schramm\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox 2014-08-07 20:32 - 2013-12-19 16:36 - 00000000 ____D () C:\ProgramData\Skype 2014-08-07 14:47 - 2014-08-07 14:47 - 00000000 ____D () C:\Users\Felix_Schramm\AppData\Local\Verlag_Heinrich_Vogel_in_ 2014-08-07 14:42 - 2013-12-18 18:26 - 00000000 ____D () C:\ProgramData\Avira 2014-08-07 04:06 - 2014-08-19 21:32 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-08-07 04:01 - 2014-08-19 21:32 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-08-06 21:18 - 2009-07-14 06:45 - 00438592 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-08-05 17:53 - 2014-08-05 17:52 - 00000000 ____D () C:\Users\Felix_Schramm\Documents\OneNote-Notizbücher 2014-08-05 17:45 - 2014-08-05 17:45 - 00002525 _____ () C:\Users\Public\Desktop\Microsoft Download Manager.lnk 2014-08-05 17:45 - 2014-08-05 17:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Download Manager 2014-08-05 17:45 - 2014-08-05 17:45 - 00000000 ____D () C:\Program Files (x86)\Microsoft Download Manager 2014-08-05 17:35 - 2014-08-05 17:34 - 01426944 _____ () C:\Users\Felix_Schramm\Downloads\MSDownloadManager.msi 2014-08-05 17:18 - 2014-08-05 17:18 - 01034432 _____ (Microsoft Corporation) C:\Users\Felix_Schramm\Downloads\setuponenotefreeretail.x86.de-de_.exe 2014-08-05 15:38 - 2014-08-05 15:38 - 00000000 ____D () C:\Users\Felix_Schramm\AppData\Roaming\.mono 2014-08-05 15:38 - 2014-08-05 15:38 - 00000000 ____D () C:\ProgramData\.mono 2014-08-05 15:36 - 2014-08-05 15:36 - 00000000 ____D () C:\Users\Felix_Schramm\AppData\Local\Unity 2014-08-05 15:36 - 2014-08-05 15:35 - 01080480 _____ (Unity Technologies ApS) C:\Users\Felix_Schramm\Downloads\UnityWebPlayer.exe 2014-08-01 01:41 - 2014-08-19 21:40 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-08-01 01:16 - 2014-08-19 21:40 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2014-07-26 19:41 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\LiveKernelReports Some content of TEMP: ==================== C:\Users\Felix_Schramm\AppData\Local\temp\avgnt.exe C:\Users\Felix_Schramm\AppData\Local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp_3brcv.dll C:\Users\Felix_Schramm\AppData\Local\temp\npp.6.6.7.Installer.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed ==================== End Of Log ============================ Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24-08-2014 03
Ran by Felix_Schramm at 2014-08-25 17:05:52
Running from C:\Users\Felix_Schramm\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
64 Bit HP CIO Components Installer (Version: 15.2.1 - Hewlett-Packard) Hidden
Adobe Bridge 1.0 (x32 Version: 001.000.001 - Adobe Systems) Hidden
Adobe Common File Installer (x32 Version: 1.00.001 - Adobe System Incorporated) Hidden
Adobe Flash Player 14 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Help Center 1.0 (x32 Version: 1.0.1 - Adobe Systems) Hidden
Adobe Photoshop CS2 (HKLM-x32\...\Adobe Photoshop CS2 - {236BB7C4-4419-42FD-0407-1E257A25E34D}) (Version: 9.0 - Adobe Systems, Inc.)
Adobe Photoshop CS2 (x32 Version: 9.0 - Adobe Systems, Inc.) Hidden
Adobe Reader XI (11.0.08) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.08 - Adobe Systems Incorporated)
Adobe Stock Photos 1.0 (x32 Version: 1.0.1 - Adobe Systems) Hidden
AIO_CDB_Software (x32 Version: 130.0.365.000 - Hewlett-Packard) Hidden
AIO_Scan (x32 Version: 130.0.421.000 - Hewlett-Packard) Hidden
AusweisApp (HKLM-x32\...\{BA6CDB7A-F5D7-4341-99E1-1FF0AAEAF1D8}) (Version: 1.13.0 - OpenLimit SignCubes AG)
Avira (HKLM-x32\...\{e67154a7-9cc5-4167-b782-f3982bc6c70d}) (Version: 1.1.19.30000 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.19.30000 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.6.552 - Avira)
Avira Savings Advisor (HKLM-x32\...\{A18A516C-AA41-46A9-92DB-60208917E442}) (Version: 1.5.14 - Avira) <==== ATTENTION
BufferChm (x32 Version: 130.0.331.000 - Hewlett-Packard) Hidden
calibre 64bit (HKLM\...\{52E45FA3-B1CE-4852-8E93-774BB3F4D468}) (Version: 1.25.0 - Kovid Goyal)
CCleaner (HKLM\...\CCleaner) (Version: 4.14 - Piriform)
Compatibility Pack for the 2007 Office system (HKLM-x32\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Copy (x32 Version: 130.0.428.000 - Hewlett-Packard) Hidden
cyberJack Base Components (HKLM-x32\...\{FC338210-F594-11D3-BA24-00001C3AB4DF}) (Version: 6.10.0 - REINER SCT)
Destinations (x32 Version: 130.0.0.0 - Hewlett-Packard) Hidden
DeviceDiscovery (x32 Version: 130.0.465.000 - Hewlett-Packard) Hidden
DMUninstaller (HKLM-x32\...\DMUninstaller) (Version: - ) <==== ATTENTION
DocProc (x32 Version: 13.0.0.0 - Hewlett-Packard) Hidden
Dropbox (HKCU\...\Dropbox) (Version: 2.10.28 - Dropbox, Inc.)
Fax (x32 Version: 130.0.418.000 - Hewlett-Packard) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 32.0.1700.107 - Google Inc.)
Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden
GPBaseService2 (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
HP Customer Participation Program 13.0 (HKLM\...\HPExtendedCapabilities) (Version: 13.0 - HP)
HP Imaging Device Functions 13.0 (HKLM\...\HP Imaging Device Functions) (Version: 13.0 - HP)
HP Install Network Printer Wizard (HKLM-x32\...\{6C0F5857-E3C0-4D2D-8450-DFD320799AD6}) (Version: 8.02.0009 - Hewlett-Packard)
HP Photosmart Essential 3.5 (HKLM\...\HP Photosmart Essential) (Version: 3.5 - HP)
HP Photosmart Officejet and Deskjet All-In-One Driver Software 13.0 Rel. B (HKLM\...\{B61ED343-0B14-4241-999C-490CB1A20DA4}) (Version: 13.0 - HP)
HP Smart Web Printing 4.51 (HKLM\...\HP Smart Web Printing) (Version: 4.51 - HP)
HP Solution Center 13.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 13.0 - HP)
HP Update (HKLM-x32\...\{7059BDA7-E1DB-442C-B7A1-6144596720A4}) (Version: 4.000.011.006 - Hewlett-Packard)
HPPhotoGadget (x32 Version: 130.0.282.000 - Hewlett-Packard) Hidden
HPPhotoSmartDiscLabelContent1 (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
HPPhotosmartEssential (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
HPProductAssistant (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
HPSSupply (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
Intel PROSet Wireless (Version: - ) Hidden
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.15.10.1930 - Intel Corporation)
Intel(R) PROSet/Wireless for Bluetooth(R) + High Speed (HKLM\...\{705EE775-5776-48FD-B704-C3C9CF535420}) (Version: 15.1.1.0170 - Intel Corporation)
Intel® PROSet/Wireless WiFi-Software (HKLM\...\{BAA0BE9B-9E6D-4802-91CB-FB7ED5CD4BEF}) (Version: 15.01.1500.1034 - Intel Corporation)
Java 7 Update 51 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417051FF}) (Version: 7.0.510 - Oracle)
Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.510 - Oracle)
KeePass Password Safe 2.27 (HKLM-x32\...\KeePassPasswordSafe2_is1) (Version: 2.27 - Dominik Reichl)
LSI HDA Modem (HKLM\...\LSI Soft Modem) (Version: 2.2.97 - LSI Corporation)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
MarketResearch (x32 Version: 130.0.374.000 - Hewlett-Packard) Hidden
Marvell Miniport Driver (HKLM-x32\...\Marvell Miniport Driver) (Version: 12.10.14.3 - Marvell)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Download Manager (HKLM-x32\...\{654977DB-0001-0002-0001-EABD228DDE8B}) (Version: 1.2.1 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Outlook Connector (HKLM-x32\...\{95140000-007A-0407-0000-0000000FF1CE}) (Version: 14.0.5118.5000 - Microsoft Corporation)
Microsoft Office Professional Edition 2003 (HKLM-x32\...\{90110407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft OneDrive (HKCU\...\OneDriveSetup.exe) (Version: 17.0.4035.0328 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 (x32 Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 (x32 Version: 11.0.61030 - Microsoft Corporation) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Network64 (Version: 130.0.572.000 - Hewlett-Packard) Hidden
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.6.7 - Notepad++ Team)
NVIDIA Photoshop Plug-ins 64 bit (HKLM-x32\...\{5E386C5B-CDE7-435A-B5C9-EC73A1B0553A}) (Version: 8.50 - )
O2Micro 1394 OHCI Compliant Host Controller Driver (HKLM-x32\...\InstallShield_{AFC44A23-E6A8-4625-B6B1-23D438525D59}) (Version: 1.0.00 - O2Micro International LTD.)
O2Micro 1394 OHCI Compliant Host Controller Driver (Version: 1.0.00 - O2Micro International LTD.) Hidden
OCR Software by I.R.I.S. 13.0 (HKLM\...\HPOCR) (Version: 13.0 - HP)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7071 - Realtek Semiconductor Corp.)
Scan (x32 Version: 13.0.0.0 - Hewlett-Packard) Hidden
Secunia PSI (3.0.0.9016) (HKLM-x32\...\Secunia PSI) (Version: 3.0.0.9016 - Secunia)
Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 13.0 - HP)
Skype Web Plugin (HKLM-x32\...\{B51DD93B-3CB5-4D9D-BFF2-FD19DBBBFD9A}) (Version: 2.9.13008.18866 - Skype Technologies S.A.)
Skype™ 6.18 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.18.106 - Skype Technologies S.A.)
SmartWebPrinting (x32 Version: 130.0.457.000 - Hewlett-Packard) Hidden
SolutionCenter (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden
SpywareBlaster 5.0 (HKLM-x32\...\SpywareBlaster_is1) (Version: 5.0.0 - BrightFort LLC)
Status (x32 Version: 130.0.469.000 - Hewlett-Packard) Hidden
thriXXX Launcher (HKLM-x32\...\thriXXX Launcher) (Version: - thriXXX Software GmbH)
TIPP10 Version 2.1.0 (HKLM-x32\...\TIPP10_is1) (Version: - (c) 2006-2011, Tom Thielicke IT Solutions)
Toolbox (x32 Version: 130.0.648.000 - Hewlett-Packard) Hidden
TrayApp (x32 Version: 130.0.422.000 - Hewlett-Packard) Hidden
Unity Web Player (HKCU\...\UnityWebPlayer) (Version: 4.5.2f1 - Unity Technologies ApS)
UnloadSupport (x32 Version: 11.0.0 - Hewlett-Packard) Hidden
WebReg (x32 Version: 130.0.132.017 - Hewlett-Packard) Hidden
Windows Phone app for desktop (HKLM-x32\...\{19773614-FC22-4ACC-AAA3-E6BDA81ACF92}) (Version: 1.1.2726.0 - Microsoft Corporation)
WinRAR 5.01 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
Could not list Restore Points. Check "winmgmt" service or repair WMI.
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:34 - 2014-02-10 23:53 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: C:\Windows\Tasks\DriverEasy Scheduled Scan.job => ?
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => ?
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => ?
==================== Loaded Modules (whitelisted) =============
2014-05-12 11:49 - 2014-05-12 11:49 - 00222720 _____ () C:\Program Files (x86)\Notepad++\NppShell_06.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\ProgramData\TEMP:5C321E34
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk => C:\Windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^Schramm_Felix^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk => C:\Windows\pss\Dropbox.lnk.Startup
MSCONFIG\startupreg: HP Software Update => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
MSCONFIG\startupreg: hpqSRMon => C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe
==================== Faulty Device Manager Devices =============
Name: hp color LaserJet 4650
Description: hp color LaserJet 4650
Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}
Manufacturer: Hewlett-Packard
Service:
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (08/25/2014 04:10:06 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\Windows\system32\msiexec.exe /V; Beschreibung = Microsoft Office Professional Edition 2003 wird entfernt; Fehler = 0x80042319).
Error: (08/25/2014 03:22:43 PM) (Source: Microsoft-Windows-RestartManager) (EventID: 10006) (User: Lifebook)
Description: Die Anwendung oder der Dienst "Windows Search" konnte nicht heruntergefahren werden.
Error: (08/25/2014 02:58:04 PM) (Source: MsiInstaller) (EventID: 1024) (User: Lifebook)
Description: Produkt: Adobe Reader XI (11.0.07) - Deutsch - Update "{AC76BA86-7AD7-0000-2550-7A8C40011008}" konnte nicht installiert werden. Fehlercode 1625. Windows Installer kann Protokolle erstellen, um bei der Problembehandlung betreffend der Installation von Softwarepaketen behilflich zu sein. Verwenden Sie folgenden Link, um Anweisungen zur Aktivierung der Protokollierungsunterstützung zu erhalten: hxxp://go.microsoft.com/fwlink/?LinkId=23127
Error: (08/25/2014 02:52:50 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/24/2014 06:48:36 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc.manifest.
Komponente 2: C:\Program Files (x86)\Hewlett-Packard\HP Install Network Printer Wizard 8.2\Microsoft.VC80.CRT.MANIFEST.
Error: (08/24/2014 03:46:56 PM) (Source: MsiInstaller) (EventID: 1024) (User: Lifebook)
Description: Produkt: Adobe Reader XI (11.0.07) - Deutsch - Update "{AC76BA86-7AD7-0000-2550-7A8C40011008}" konnte nicht installiert werden. Fehlercode 1625. Windows Installer kann Protokolle erstellen, um bei der Problembehandlung betreffend der Installation von Softwarepaketen behilflich zu sein. Verwenden Sie folgenden Link, um Anweisungen zur Aktivierung der Protokollierungsunterstützung zu erhalten: hxxp://go.microsoft.com/fwlink/?LinkId=23127
Error: (08/24/2014 03:41:35 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/23/2014 07:31:09 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/23/2014 07:08:01 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: PSIA.exe, Version: 3.0.0.9016, Zeitstempel: 0x52a1d50f
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000
ID des fehlerhaften Prozesses: 0x920
Startzeit der fehlerhaften Anwendung: 0xPSIA.exe0
Pfad der fehlerhaften Anwendung: PSIA.exe1
Pfad des fehlerhaften Moduls: PSIA.exe2
Berichtskennung: PSIA.exe3
Error: (08/23/2014 06:56:10 PM) (Source: MsiInstaller) (EventID: 1024) (User: Lifebook)
Description: Produkt: Adobe Reader XI (11.0.07) - Deutsch - Update "{AC76BA86-7AD7-0000-2550-7A8C40011008}" konnte nicht installiert werden. Fehlercode 1625. Windows Installer kann Protokolle erstellen, um bei der Problembehandlung betreffend der Installation von Softwarepaketen behilflich zu sein. Verwenden Sie folgenden Link, um Anweisungen zur Aktivierung der Protokollierungsunterstützung zu erhalten: hxxp://go.microsoft.com/fwlink/?LinkId=23127
System errors:
=============
Error: (08/25/2014 04:00:58 PM) (Source: volsnap) (EventID: 36) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
Error: (08/25/2014 02:55:10 PM) (Source: volsnap) (EventID: 36) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
Error: (08/25/2014 02:52:07 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows Live ID Sign-in Assistant" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (08/25/2014 02:52:07 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Live ID Sign-in Assistant erreicht.
Error: (08/24/2014 03:48:34 PM) (Source: volsnap) (EventID: 36) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
Error: (08/23/2014 07:08:15 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Secunia PSI Agent" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (08/22/2014 09:37:20 PM) (Source: volsnap) (EventID: 36) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
Error: (08/22/2014 03:30:55 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Avira Service Host erreicht.
Error: (08/22/2014 03:29:53 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am 22.08.2014 um 01:05:44 unerwartet heruntergefahren.
Error: (08/22/2014 00:06:41 AM) (Source: volsnap) (EventID: 36) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
Microsoft Office Sessions:
=========================
Error: (08/25/2014 04:10:06 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: C:\Windows\system32\msiexec.exe /VMicrosoft Office Professional Edition 2003 wird entfernt0x80042319
Error: (08/25/2014 03:22:43 PM) (Source: Microsoft-Windows-RestartManager) (EventID: 10006) (User: Lifebook)
Description: 1SearchIndexer.exeWindows Search03026216150040
Error: (08/25/2014 02:58:04 PM) (Source: MsiInstaller) (EventID: 1024) (User: Lifebook)
Description: Adobe Reader XI (11.0.07) - Deutsch{AC76BA86-7AD7-0000-2550-7A8C40011008}1625(NULL)(NULL)(NULL)
Error: (08/25/2014 02:52:50 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/24/2014 06:48:36 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc.manifestC:\Program Files (x86)\Hewlett-Packard\HP Install Network Printer Wizard 8.2\Microsoft.VC80.CRT.MANIFESTC:\Program Files (x86)\Hewlett-Packard\HP Install Network Printer Wizard 8.2\hpjsi.exe
Error: (08/24/2014 03:46:56 PM) (Source: MsiInstaller) (EventID: 1024) (User: Lifebook)
Description: Adobe Reader XI (11.0.07) - Deutsch{AC76BA86-7AD7-0000-2550-7A8C40011008}1625(NULL)(NULL)(NULL)
Error: (08/24/2014 03:41:35 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/23/2014 07:31:09 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/23/2014 07:08:01 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: PSIA.exe3.0.0.901652a1d50funknown0.0.0.000000000c00000050000000092001cfbef2562475b6C:\Program Files (x86)\Secunia\PSI\PSIA.exeunknown0971da9a-2ae8-11e4-86d2-00174274436d
Error: (08/23/2014 06:56:10 PM) (Source: MsiInstaller) (EventID: 1024) (User: Lifebook)
Description: Adobe Reader XI (11.0.07) - Deutsch{AC76BA86-7AD7-0000-2550-7A8C40011008}1625(NULL)(NULL)(NULL)
CodeIntegrity Errors:
===================================
Date: 2014-02-10 22:52:36.345
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-02-10 22:52:36.292
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Processor: Intel(R) Core(TM)2 CPU T5600 @ 1.83GHz
Percentage of memory in use: 80%
Total physical RAM: 2038.49 MB
Available physical RAM: 402.28 MB
Total Pagefile: 4076.98 MB
Available Pagefile: 1627.35 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB
==================== Drives ================================
Drive c: (Windows/Programme) (Fixed) (Total:37.17 GB) (Free:7.16 GB) NTFS
Drive d: (Dateien) (Fixed) (Total:37.26 GB) (Free:22.46 GB) NTFS
==================== MBR & Partition Table ==================
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net Rootkit scan 2014-08-25 17:19:33 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 FUJITSU_MHW2080BH rev.00000012 74,53GB Running: Gmer-19357.exe; Driver: C:\Users\SCHRAM~1\AppData\Local\Temp\kxtdapow.sys ---- Kernel code sections - GMER 2.1 ---- .text C:\Windows\System32\win32k.sys!W32pServiceTable fffff96000114000 7 bytes [00, 93, F3, FF, 01, A0, F0] .text C:\Windows\System32\win32k.sys!W32pServiceTable + 8 fffff96000114008 3 bytes [C0, 06, 02] ---- User code sections - GMER 2.1 ---- .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2512] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077591465 2 bytes [59, 77] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2512] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000775914bb 2 bytes [59, 77] .text ... * 2 ? C:\Windows\system32\mssprxy.dll [2512] entry point in ".rdata" section 0000000074bb71e6 .text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[3448] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000077591465 2 bytes [59, 77] .text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[3448] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000775914bb 2 bytes [59, 77] .text ... * 2 .text C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe[3296] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077591465 2 bytes [59, 77] .text C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe[3296] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000775914bb 2 bytes [59, 77] .text ... * 2 ---- Threads - GMER 2.1 ---- Thread C:\Windows\system32\svchost.exe [992:4292] 000007fef7745124 Thread C:\Windows\system32\svchost.exe [992:5012] 000007fef9471ab0 Thread C:\Windows\system32\svchost.exe [992:4820] 000007fef9494164 Thread C:\Windows\system32\svchost.exe [1468:4444] 000007fef1c08470 Thread C:\Windows\system32\svchost.exe [1468:4460] 000007fef1c12418 Thread C:\Windows\system32\svchost.exe [1468:5644] 000007fef53c5fd0 Thread C:\Windows\system32\svchost.exe [1468:5652] 000007fef53c63ec Thread C:\Windows\system32\svchost.exe [1468:3856] 000007fef1c1976c Thread C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2184:1236] 00000000770d7587 Thread C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2184:5884] 000000006f187712 Thread C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2184:2232] 0000000077612e65 Thread C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2184:4272] 0000000077613e85 Thread C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2184:1120] 0000000077613e85 Thread C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2184:5512] 0000000077613e85 ---- Processes - GMER 2.1 ---- Library C:\Windows\system32\livessp.DLL (*** suspicious ***) @ C:\Windows\system32\lsass.exe [560] 000007fefc580000 Library C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (*** suspicious ***) @ C:\Windows\Explorer.EXE [2344] 000007fef6df0000 Library C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\MSVCR100.dll (*** suspicious ***) @ C:\Windows\Explorer.EXE [2344] 000000006f480000 Library C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\MSVCP100.dll (*** suspicious ***) @ C:\Windows\Explorer.EXE [2344] 000000006f3e0000 Library C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\ATL100.DLL (*** suspicious ***) @ C:\Windows\Explorer.EXE [2344] 0000000070e40000 Library C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\1031\GrooveIntlResource.dll (*** suspicious ***) @ C:\Windows\Explorer.EXE [2344] 000007fef5d30000 Library C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (*** suspicious ***) @ C:\Program Files (x86)\AusweisApp\siqBootLoader.exe [3648] 0000000071bd0000 ---- Registry - GMER 2.1 ---- Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\NewShortcuts@C:\Users\Schramm_Felix\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HP\HP\xa0Update.lnk 1 Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\NewShortcuts@C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP\HP\xa0Update.lnk 1 ---- EOF - GMER 2.1 ---- Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 25.08.2014 Suchlauf-Zeit: 16:21:33 Logdatei: Malwarebytes Anti-Malware 25.08.2014.txt Administrator: Nein Version: 2.00.2.1012 Malware Datenbank: v2014.08.25.03 Rootkit Datenbank: v2014.08.21.01 Lizenz: Premium Malware Schutz: Aktiviert Bösartiger Webseiten Schutz: Aktiviert Self-protection: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: Felix_Schramm Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 263067 Verstrichene Zeit: 14 Min, 56 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Aktiviert Heuristics: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 1 PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\supWPM, , [6760587288f396a0ee857f68d42e837d], Registrierungswerte: 0 (No malicious items detected) Registrierungsdaten: 0 (No malicious items detected) Ordner: 0 (No malicious items detected) Dateien: 0 (No malicious items detected) Physische Sektoren: 0 (No malicious items detected) (end) Felix |
|
25.08.2014, 18:14
| #2 |
| /// the machine /// TB-Ausbilder    | Windows 7: MBAM meldet immer wieder den gleichen Fund hi,
__________________unsere Tools brauchen immer Adminrechte"!! Adware & Co. deinstallieren
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ |
|
25.08.2014, 19:47
| #3 |
| | Windows 7: MBAM meldet immer wieder den gleichen Fund So, ich hab alles wie aufgetragen ausgeführt. Allerdings hat mir das "Junkware Removal Tool" scheinbar den Desktop auf einen sehr viel früherin stand zurück gesetzt. Beispielsweise wurden gut die hälfte der Datein und Programe die dort lagen scheinbar gelöscht.
__________________ Adw Cleaner: Code:
ATTFilter # AdwCleaner v3.308 - Bericht erstellt am 25/08/2014 um 19:45:40
# Aktualisiert 20/08/2014 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : Schramm_Felix - LIFEBOOK
# Gestartet von : C:\Users\Felix_Schramm\Desktop\adwcleaner_3.308.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\Program Files (x86)\AmiExt
Ordner Gelöscht : C:\Program Files\Uninstaller
Ordner Gelöscht : C:\Users\Felix_Schramm\Documents\Updater
Ordner Gelöscht : C:\Users\Schramm_Felix\AppData\Local\genienext
Ordner Gelöscht : C:\Users\Schramm_Felix\AppData\Local\Mobogenie
Ordner Gelöscht : C:\Users\Schramm_Felix\AppData\Roaming\eCyber
Ordner Gelöscht : C:\Users\Schramm_Felix\Documents\Updater
Datei Gelöscht : C:\Windows\System32\log\iSafeKrnlCall.log
Datei Gelöscht : C:\Users\Schramm_Felix\daemonprocess.txt
***** [ Tasks ] *****
***** [ Verknüpfungen ] *****
Verknüpfung Desinfiziert : C:\Users\Schramm_Felix\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{74F475FA-6C75-43BD-AAB9-ECDA6184F600}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Schlüssel Gelöscht : HKCU\Software\Ciuvo
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Re_Markit
Schlüssel Gelöscht : HKLM\SOFTWARE\supWPM
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17239
-\\ Google Chrome v32.0.1700.107
[ Datei : C:\Users\Felix_Schramm\AppData\Local\Google\Chrome\User Data\Default\preferences ]
Gelöscht [Search Provider] : hxxp://www.softonic.de/s/{searchTerms}
[ Datei : C:\Users\Schramm_Felix\AppData\Local\Google\Chrome\User Data\Default\preferences ]
Gelöscht [Extension] : hhlmghjmomaoodfgjeikphfdljhpcpkl
*************************
AdwCleaner[R0].txt - [3037 octets] - [25/08/2014 19:42:40]
AdwCleaner[S0].txt - [2764 octets] - [25/08/2014 19:45:40]
########## EOF - \AdwCleaner\AdwCleaner[S0].txt - [2824 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Professional x64
Ran by Schramm_Felix on 25.08.2014 at 20:10:37,97
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
Successfully deleted: [Folder] "C:\ProgramData\boost_interprocess"
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 25.08.2014 at 20:26:18,47
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-08-2014 03 Ran by Schramm_Felix (administrator) on LIFEBOOK on 25-08-2014 20:43:47 Running from D:\Downloads Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe (Microsoft Corporation) C:\Windows\System32\wlanext.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe (LSI Corporation) C:\Program Files\LSI SoftModem\agr64svc.exe (REINER SCT) C:\Windows\SysWOW64\cjpcsc.exe (Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (OpenLimit SignCubes AG) C:\Program Files (x86)\AusweisApp\siqBootLoader.exe (Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe (Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe (Microsoft Corporation) C:\Windows\System32\PrintIsolationHost.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\VS7DEBUG\MDM.EXE (Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe (Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe (Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe (Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe (Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13657304 2013-10-18] (Realtek Semiconductor) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [KeePass 2 PreLoad] => C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [2117632 2014-07-06] (Dominik Reichl) HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [4085896 2014-08-25] (AVAST Software) HKLM-x32\...\RunOnce: [BCSETUP_REBOOT] => [X] Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKU\S-1-5-21-1720165562-133132595-3868955016-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1 HKU\S-1-5-21-1720165562-133132595-3868955016-1006\...\Run: [AusweisApp] => C:\Program Files (x86)\AusweisApp\siqBootLoader.exe [2518656 2014-01-24] (OpenLimit SignCubes AG) HKU\S-1-5-21-1720165562-133132595-3868955016-1006\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1 Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia) Startup: C:\Users\Felix_Schramm\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE (No File) Startup: C:\Users\Felix_Schramm\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\Schramm_Felix\AppData\Roaming\Dropbox\bin\Dropbox.exe (No File) Startup: C:\Users\Schramm_Felix\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk ShortcutTarget: Adobe Gamma.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.) Startup: C:\Users\Schramm_Felix\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\Schramm_Felix\AppData\Roaming\Dropbox\bin\Dropbox.exe (No File) ShellIconOverlayIdentifiers: SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File ShellIconOverlayIdentifiers: SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File ShellIconOverlayIdentifiers: SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software) ShellIconOverlayIdentifiers-x32: SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File ShellIconOverlayIdentifiers-x32: SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File ShellIconOverlayIdentifiers-x32: SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.de HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xBC31919C08FCCE01 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.de HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.de SearchScopes: HKLM - {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms} SearchScopes: HKLM-x32 - {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms} SearchScopes: HKCU - {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms} BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) BHO: AusweisApp 1.12.0.0 -> {C9EE92B7-EDD5-4ad9-8029-2EC6818E653A} -> C:\Program Files (x86)\AusweisApp\siqeCardClientIE64.ols (OpenLimit SignCubes AG) BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) BHO-x32: AusweisApp 1.12.0.0 -> {C9EE92B7-EDD5-4ad9-8029-2EC6818E653A} -> C:\Program Files (x86)\AusweisApp\siqeCardClientIE32.ols (OpenLimit SignCubes AG) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.) Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - No File Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @Skype Technologies S.A..com/Skype Web Plugin -> C:\Program Files (x86)\SkypeWebPlugin\npSkypeWebPlugin64.dll (Skype) FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/DownloadManager,version=1.1 -> C:\Windows\ () FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin-x32: @Skype Technologies S.A..com/Skype Web Plugin -> C:\Program Files (x86)\SkypeWebPlugin\npSkypeWebPlugin.dll (Skype) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2014-02-23] FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-08-25] FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 Chrome: ======= CHR HomePage: CHR DefaultSuggestURL: {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&xssi=t&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}{google:pageClassification}sugkey={google:suggestAPIKeyParameter} CHR Extension: (Google Docs) - C:\Users\Schramm_Felix\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-01-09] CHR Extension: (Google Drive) - C:\Users\Schramm_Felix\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-01-09] CHR Extension: (YouTube) - C:\Users\Schramm_Felix\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-01-09] CHR Extension: (Adblock Plus) - C:\Users\Schramm_Felix\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-01-24] CHR Extension: (Google-Suche) - C:\Users\Schramm_Felix\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-01-09] CHR Extension: (Google Wallet) - C:\Users\Schramm_Felix\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-01-09] CHR Extension: (Google Mail) - C:\Users\Schramm_Felix\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-01-09] CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-08-25] CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2014-02-17] (Adobe Systems) [File not signed] R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-08-25] (AVAST Software) R2 cjpcsc; C:\Windows\SysWOW64\cjpcsc.exe [514128 2012-03-19] (REINER SCT) R3 hpqcxs08; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll [249344 2009-09-20] (Hewlett-Packard Co.) [File not signed] R2 hpqddsvc; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-09-20] (Hewlett-Packard Co.) [File not signed] R2 HPSLPSVC; C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL [1037824 2009-09-20] (Hewlett-Packard Co.) [File not signed] S2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation) R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [50688 2013-05-16] (Hewlett-Packard) [File not signed] R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [66048 2013-05-16] (Hewlett-Packard) [File not signed] R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia) R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia) R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [2671376 2012-04-17] (Intel® Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-08-25] () R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-08-25] (AVAST Software) R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-08-25] (AVAST Software) R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-08-25] () R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1041168 2014-08-25] (AVAST Software) R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427360 2014-08-25] (AVAST Software) S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [92008 2014-08-25] (AVAST Software) R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [224896 2014-08-25] () S3 cjusb; C:\Windows\System32\DRIVERS\cjusb.sys [34672 2011-03-29] (REINER SCT) R3 FUJ02B1; C:\Windows\System32\DRIVERS\FUJ02B1.sys [7808 2006-11-01] (FUJITSU LIMITED) R3 FUJ02E3; C:\Windows\System32\DRIVERS\FUJ02E3.sys [7296 2006-11-01] (FUJITSU LIMITED) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation) S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-06-23] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation) R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-12-06] (Secunia) R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.) R3 SMSCIRDA; C:\Windows\System32\DRIVERS\SMSCir64.sys [37760 2007-04-25] (SMSC) U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation) S3 catchme; \??\C:\ComboFix\catchme.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-08-25 20:26 - 2014-08-25 20:26 - 00000703 _____ () C:\Users\Schramm_Felix\Desktop\JRT.txt 2014-08-25 20:07 - 2014-08-25 20:07 - 01016261 _____ (Thisisu) C:\Users\Felix_Schramm\Desktop\JRT.exe 2014-08-25 19:52 - 2014-08-25 19:52 - 00000000 ____D () C:\Users\Felix_Schramm\AppData\Roaming\DropboxMaster 2014-08-25 19:51 - 2014-08-25 19:51 - 00000000 ____D () C:\Users\Felix_Schramm\AppData\Roaming\AVAST Software 2014-08-25 19:49 - 2014-08-25 19:49 - 00006838 _____ () C:\Windows\PFRO.log 2014-08-25 19:49 - 2014-08-25 19:49 - 00000056 _____ () C:\Windows\setupact.log 2014-08-25 19:49 - 2014-08-25 19:49 - 00000000 _____ () C:\Windows\setuperr.log 2014-08-25 19:44 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll 2014-08-25 19:42 - 2014-08-25 19:45 - 00000000 ____D () C:\AdwCleaner 2014-08-25 19:38 - 2014-08-25 19:39 - 01364531 _____ () C:\Users\Felix_Schramm\Desktop\adwcleaner_3.308.exe 2014-08-25 19:28 - 2014-08-25 19:28 - 00001281 _____ () C:\Users\Schramm_Felix\Desktop\Revo Uninstaller.lnk 2014-08-25 19:28 - 2014-08-25 19:28 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group 2014-08-25 19:26 - 2014-08-25 19:27 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Felix_Schramm\Desktop\revosetup95.exe 2014-08-25 18:10 - 2014-08-25 18:10 - 00000000 ____D () C:\Users\Schramm_Felix\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox 2014-08-25 18:10 - 2014-08-25 18:10 - 00000000 ____D () C:\Users\Schramm_Felix\AppData\Roaming\DropboxMaster 2014-08-25 17:55 - 2014-08-25 17:55 - 00000000 ____D () C:\Users\Schramm_Felix\AppData\Roaming\AVAST Software 2014-08-25 17:54 - 2014-08-25 17:54 - 00001983 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk 2014-08-25 17:54 - 2014-08-25 17:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast 2014-08-25 17:52 - 2014-08-25 18:06 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update 2014-08-25 17:51 - 2014-08-25 17:52 - 36818984 _____ (Dropbox, Inc.) C:\Users\Public\Desktop\DropboxInstallerAvast.exe 2014-08-25 17:50 - 2014-08-25 17:53 - 00427360 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys 2014-08-25 17:50 - 2014-08-25 17:50 - 01041168 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys 2014-08-25 17:50 - 2014-08-25 17:50 - 00307344 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe 2014-08-25 17:50 - 2014-08-25 17:50 - 00224896 _____ () C:\Windows\system32\Drivers\aswVmm.sys 2014-08-25 17:50 - 2014-08-25 17:50 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys 2014-08-25 17:50 - 2014-08-25 17:50 - 00092008 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys 2014-08-25 17:50 - 2014-08-25 17:50 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys 2014-08-25 17:50 - 2014-08-25 17:50 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys 2014-08-25 17:50 - 2014-08-25 17:50 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr 2014-08-25 17:50 - 2014-08-25 17:50 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys 2014-08-25 17:49 - 2014-08-25 17:49 - 00000000 ____D () C:\Program Files\AVAST Software 2014-08-25 17:46 - 2014-08-25 17:49 - 00000000 ____D () C:\ProgramData\AVAST Software 2014-08-25 17:32 - 2014-08-25 17:32 - 00000000 ____D () C:\OETemp 2014-08-25 17:07 - 2014-08-25 17:07 - 00380416 _____ () C:\Users\Felix_Schramm\Desktop\Gmer-19357.exe 2014-08-25 17:04 - 2014-08-25 20:43 - 00000000 ____D () C:\FRST 2014-08-25 17:03 - 2014-08-25 17:03 - 02103296 _____ (Farbar) C:\Users\Felix_Schramm\Desktop\FRST64.exe 2014-08-25 17:03 - 2014-08-25 17:03 - 00000000 _____ () C:\Users\Schramm_Felix\defogger_reenable 2014-08-25 17:02 - 2014-08-25 17:02 - 00050477 _____ () C:\Users\Felix_Schramm\Desktop\Defogger.exe 2014-08-25 17:01 - 2014-08-25 17:01 - 00001259 _____ () C:\Users\Felix_Schramm\Desktop\Malwarebytes Anti-Malware 25.08.2014.txt 2014-08-25 15:27 - 2014-08-25 15:27 - 00000020 _____ () C:\Windows\°õ! 2014-08-24 16:21 - 2014-08-24 16:21 - 43077153 _____ () C:\Users\Felix_Schramm\Desktop\Finales_Bild.psd 2014-08-23 22:52 - 2014-08-23 22:52 - 00000000 ____D () C:\Users\Felix_Schramm\AppData\Roaming\IrfanView 2014-08-23 22:48 - 2014-08-23 22:59 - 00000000 ____D () C:\Users\Schramm_Felix\AppData\Roaming\IrfanView 2014-08-23 21:46 - 2014-08-23 21:46 - 01744299 _____ () C:\Users\Felix_Schramm\Desktop\sonnenuntergang_Fabi_bearbeitet.psd 2014-08-23 21:41 - 2014-08-23 21:41 - 05909368 _____ () C:\Users\Felix_Schramm\Desktop\sonnenuntergang_Fabi.psd 2014-08-23 20:05 - 2014-08-23 20:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Phone 2014-08-23 20:05 - 2014-08-23 20:05 - 00000000 ____D () C:\Program Files (x86)\Windows Phone 2014-08-23 20:03 - 2014-08-23 20:03 - 00000000 ____D () C:\ProgramData\Applications 2014-08-22 15:43 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll 2014-08-22 15:43 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll 2014-08-22 15:43 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll 2014-08-22 15:43 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe 2014-08-22 15:43 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll 2014-08-22 15:43 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll 2014-08-22 15:43 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll 2014-08-22 15:43 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll 2014-08-22 15:43 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll 2014-08-22 15:43 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll 2014-08-22 15:42 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll 2014-08-22 15:42 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll 2014-08-22 15:42 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe 2014-08-22 15:42 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe 2014-08-22 00:10 - 2014-08-22 00:10 - 00000000 ____D () C:\Users\Schramm_Felix\AppData\Roaming\thriXXX 2014-08-22 00:10 - 2014-08-22 00:10 - 00000000 ____D () C:\Users\Schramm_Felix\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\thriXXX 2014-08-22 00:10 - 2014-08-22 00:10 - 00000000 ____D () C:\ProgramData\thriXXX 2014-08-22 00:10 - 2014-08-22 00:10 - 00000000 ____D () C:\Program Files (x86)\thriXXX 2014-08-20 11:20 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll 2014-08-20 11:20 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll 2014-08-20 11:20 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe 2014-08-20 11:20 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe 2014-08-20 11:20 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe 2014-08-20 11:20 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll 2014-08-20 11:20 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe 2014-08-20 11:20 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll 2014-08-19 21:40 - 2014-08-01 01:41 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-08-19 21:40 - 2014-08-01 01:16 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2014-08-19 21:40 - 2014-07-25 16:52 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-08-19 21:40 - 2014-07-25 16:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-08-19 21:40 - 2014-07-25 16:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-08-19 21:40 - 2014-07-25 15:51 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-08-19 21:40 - 2014-07-25 15:30 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-08-19 21:40 - 2014-07-25 15:28 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-08-19 21:40 - 2014-07-25 15:28 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-08-19 21:40 - 2014-07-25 15:25 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-08-19 21:40 - 2014-07-25 15:25 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-08-19 21:40 - 2014-07-25 15:11 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-08-19 21:40 - 2014-07-25 15:10 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-08-19 21:40 - 2014-07-25 15:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-08-19 21:40 - 2014-07-25 15:03 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-08-19 21:40 - 2014-07-25 15:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-08-19 21:40 - 2014-07-25 15:00 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-08-19 21:40 - 2014-07-25 14:59 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-08-19 21:40 - 2014-07-25 14:47 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-08-19 21:40 - 2014-07-25 14:40 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-08-19 21:40 - 2014-07-25 14:34 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-08-19 21:40 - 2014-07-25 14:34 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-08-19 21:40 - 2014-07-25 14:33 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-08-19 21:40 - 2014-07-25 14:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2014-08-19 21:40 - 2014-07-25 14:28 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-08-19 21:40 - 2014-07-25 14:28 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-08-19 21:40 - 2014-07-25 14:21 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-08-19 21:40 - 2014-07-25 14:19 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-08-19 21:40 - 2014-07-25 14:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-08-19 21:40 - 2014-07-25 14:17 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-08-19 21:40 - 2014-07-25 14:17 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-08-19 21:40 - 2014-07-25 14:12 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-08-19 21:40 - 2014-07-25 14:10 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-08-19 21:40 - 2014-07-25 14:10 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-08-19 21:40 - 2014-07-25 14:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-08-19 21:40 - 2014-07-25 14:06 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-08-19 21:40 - 2014-07-25 13:52 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-08-19 21:40 - 2014-07-25 13:47 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-08-19 21:40 - 2014-07-25 13:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2014-08-19 21:40 - 2014-07-25 13:42 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-08-19 21:40 - 2014-07-25 13:39 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-08-19 21:40 - 2014-07-25 13:39 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2014-08-19 21:40 - 2014-07-25 13:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-08-19 21:40 - 2014-07-25 13:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-08-19 21:40 - 2014-07-25 13:29 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-08-19 21:40 - 2014-07-25 13:23 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-08-19 21:40 - 2014-07-25 13:13 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-08-19 21:40 - 2014-07-25 13:07 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-08-19 21:40 - 2014-07-25 13:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2014-08-19 21:40 - 2014-07-25 13:03 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-08-19 21:40 - 2014-07-25 12:52 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-08-19 21:40 - 2014-07-25 12:26 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-08-19 21:40 - 2014-07-25 12:17 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-08-19 21:40 - 2014-07-25 12:09 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-08-19 21:40 - 2014-07-25 12:05 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-08-19 21:40 - 2014-07-25 12:00 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-08-19 21:39 - 2014-07-16 05:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2014-08-19 21:39 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll 2014-08-19 21:39 - 2014-06-25 04:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll 2014-08-19 21:39 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll 2014-08-19 21:38 - 2014-06-16 04:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys 2014-08-19 21:38 - 2014-06-03 12:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll 2014-08-19 21:38 - 2014-06-03 12:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll 2014-08-19 21:38 - 2014-06-03 12:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll 2014-08-19 21:38 - 2014-06-03 12:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe 2014-08-19 21:38 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll 2014-08-19 21:38 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll 2014-08-19 21:38 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll 2014-08-19 21:33 - 2014-07-14 04:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll 2014-08-19 21:33 - 2014-07-14 03:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll 2014-08-19 21:32 - 2014-08-07 04:06 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-08-19 21:32 - 2014-08-07 04:01 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-08-07 14:47 - 2014-08-07 14:47 - 00000000 ____D () C:\Users\Felix_Schramm\AppData\Local\Verlag_Heinrich_Vogel_in_ 2014-08-07 14:42 - 2014-08-25 17:32 - 00000000 ____D () C:\ProgramData\Package Cache 2014-08-05 17:52 - 2014-08-05 17:53 - 00000000 ____D () C:\Users\Felix_Schramm\Documents\OneNote-Notizbücher 2014-08-05 17:45 - 2014-08-05 17:45 - 00002525 _____ () C:\Users\Public\Desktop\Microsoft Download Manager.lnk 2014-08-05 17:45 - 2014-08-05 17:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Download Manager 2014-08-05 17:45 - 2014-08-05 17:45 - 00000000 ____D () C:\Program Files (x86)\Microsoft Download Manager 2014-08-05 17:31 - 2014-08-05 17:31 - 00000000 ____D () C:\Windows\System32\Tasks\OfficeSoftwareProtectionPlatform 2014-08-05 15:38 - 2014-08-05 15:38 - 00000000 ____D () C:\Users\Felix_Schramm\AppData\Roaming\.mono 2014-08-05 15:38 - 2014-08-05 15:38 - 00000000 ____D () C:\ProgramData\.mono 2014-08-05 15:36 - 2014-08-05 15:36 - 00000000 ____D () C:\Users\Felix_Schramm\AppData\Local\Unity ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-08-25 20:43 - 2014-08-25 17:04 - 00000000 ____D () C:\FRST 2014-08-25 20:35 - 2014-01-22 20:30 - 00000000 ____D () C:\Users\Schramm_Felix\AppData\Roaming\KeePass 2014-08-25 20:26 - 2014-08-25 20:26 - 00000703 _____ () C:\Users\Schramm_Felix\Desktop\JRT.txt 2014-08-25 20:20 - 2013-12-18 17:33 - 01486906 _____ () C:\Windows\WindowsUpdate.log 2014-08-25 20:08 - 2014-01-09 16:22 - 00001124 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-08-25 20:07 - 2014-08-25 20:07 - 01016261 _____ (Thisisu) C:\Users\Felix_Schramm\Desktop\JRT.exe 2014-08-25 20:00 - 2009-07-14 06:45 - 00033088 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-08-25 19:59 - 2009-07-14 06:45 - 00033088 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-08-25 19:53 - 2014-04-05 22:18 - 00000000 ____D () C:\Users\Felix_Schramm\AppData\Roaming\Dropbox 2014-08-25 19:52 - 2014-08-25 19:52 - 00000000 ____D () C:\Users\Felix_Schramm\AppData\Roaming\DropboxMaster 2014-08-25 19:52 - 2014-07-23 15:14 - 00000000 ____D () C:\Users\Felix_Schramm\.ausweisapp 2014-08-25 19:51 - 2014-08-25 19:51 - 00000000 ____D () C:\Users\Felix_Schramm\AppData\Roaming\AVAST Software 2014-08-25 19:50 - 2014-01-09 16:22 - 00001120 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-08-25 19:49 - 2014-08-25 19:49 - 00006838 _____ () C:\Windows\PFRO.log 2014-08-25 19:49 - 2014-08-25 19:49 - 00000056 _____ () C:\Windows\setupact.log 2014-08-25 19:49 - 2014-08-25 19:49 - 00000000 _____ () C:\Windows\setuperr.log 2014-08-25 19:49 - 2014-02-05 18:41 - 00000000 ____D () C:\Program Files (x86)\Avira 2014-08-25 19:49 - 2014-01-15 17:53 - 00000422 _____ () C:\Windows\Tasks\DriverEasy Scheduled Scan.job 2014-08-25 19:49 - 2013-12-18 18:26 - 00000000 ____D () C:\ProgramData\Avira 2014-08-25 19:49 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-08-25 19:49 - 2009-07-14 06:45 - 00437480 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-08-25 19:45 - 2014-08-25 19:42 - 00000000 ____D () C:\AdwCleaner 2014-08-25 19:45 - 2013-12-18 18:12 - 00000000 ____D () C:\Windows\system32\log 2014-08-25 19:45 - 2013-12-18 17:42 - 00000000 ____D () C:\Users\Schramm_Felix 2014-08-25 19:40 - 2014-02-23 20:15 - 00000000 ____D () C:\Users\Felix_Schramm\AppData\Roaming\KeePass 2014-08-25 19:40 - 2014-02-23 19:52 - 00000000 ____D () C:\Users\Felix_Schramm\AppData\Roaming\Skype 2014-08-25 19:39 - 2014-08-25 19:38 - 01364531 _____ () C:\Users\Felix_Schramm\Desktop\adwcleaner_3.308.exe 2014-08-25 19:28 - 2014-08-25 19:28 - 00001281 _____ () C:\Users\Schramm_Felix\Desktop\Revo Uninstaller.lnk 2014-08-25 19:28 - 2014-08-25 19:28 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group 2014-08-25 19:27 - 2014-08-25 19:26 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Felix_Schramm\Desktop\revosetup95.exe 2014-08-25 18:11 - 2013-12-18 23:02 - 00000000 ____D () C:\Users\Schramm_Felix\AppData\Roaming\Dropbox 2014-08-25 18:10 - 2014-08-25 18:10 - 00000000 ____D () C:\Users\Schramm_Felix\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox 2014-08-25 18:10 - 2014-08-25 18:10 - 00000000 ____D () C:\Users\Schramm_Felix\AppData\Roaming\DropboxMaster 2014-08-25 18:06 - 2014-08-25 17:52 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update 2014-08-25 17:55 - 2014-08-25 17:55 - 00000000 ____D () C:\Users\Schramm_Felix\AppData\Roaming\AVAST Software 2014-08-25 17:54 - 2014-08-25 17:54 - 00001983 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk 2014-08-25 17:54 - 2014-08-25 17:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast 2014-08-25 17:53 - 2014-08-25 17:50 - 00427360 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys 2014-08-25 17:52 - 2014-08-25 17:51 - 36818984 _____ (Dropbox, Inc.) C:\Users\Public\Desktop\DropboxInstallerAvast.exe 2014-08-25 17:50 - 2014-08-25 17:50 - 01041168 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys 2014-08-25 17:50 - 2014-08-25 17:50 - 00307344 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe 2014-08-25 17:50 - 2014-08-25 17:50 - 00224896 _____ () C:\Windows\system32\Drivers\aswVmm.sys 2014-08-25 17:50 - 2014-08-25 17:50 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys 2014-08-25 17:50 - 2014-08-25 17:50 - 00092008 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys 2014-08-25 17:50 - 2014-08-25 17:50 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys 2014-08-25 17:50 - 2014-08-25 17:50 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys 2014-08-25 17:50 - 2014-08-25 17:50 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr 2014-08-25 17:50 - 2014-08-25 17:50 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys 2014-08-25 17:49 - 2014-08-25 17:49 - 00000000 ____D () C:\Program Files\AVAST Software 2014-08-25 17:49 - 2014-08-25 17:46 - 00000000 ____D () C:\ProgramData\AVAST Software 2014-08-25 17:32 - 2014-08-25 17:32 - 00000000 ____D () C:\OETemp 2014-08-25 17:32 - 2014-08-07 14:42 - 00000000 ____D () C:\ProgramData\Package Cache 2014-08-25 17:07 - 2014-08-25 17:07 - 00380416 _____ () C:\Users\Felix_Schramm\Desktop\Gmer-19357.exe 2014-08-25 17:03 - 2014-08-25 17:03 - 02103296 _____ (Farbar) C:\Users\Felix_Schramm\Desktop\FRST64.exe 2014-08-25 17:03 - 2014-08-25 17:03 - 00000000 _____ () C:\Users\Schramm_Felix\defogger_reenable 2014-08-25 17:02 - 2014-08-25 17:02 - 00050477 _____ () C:\Users\Felix_Schramm\Desktop\Defogger.exe 2014-08-25 17:01 - 2014-08-25 17:01 - 00001259 _____ () C:\Users\Felix_Schramm\Desktop\Malwarebytes Anti-Malware 25.08.2014.txt 2014-08-25 16:15 - 2014-01-30 20:38 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office 2014-08-25 16:15 - 2009-07-14 05:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared 2014-08-25 15:40 - 2014-02-24 18:17 - 00111920 _____ () C:\Users\Felix_Schramm\AppData\Local\GDIPFONTCACHEV1.DAT 2014-08-25 15:30 - 2014-01-15 17:53 - 00003846 _____ () C:\Windows\System32\Tasks\DriverEasy Scheduled Scan 2014-08-25 15:28 - 2014-07-02 14:10 - 00000000 ____D () C:\Users\Schramm_Felix\AppData\Local\Windows Live 2014-08-25 15:27 - 2014-08-25 15:27 - 00000020 _____ () C:\Windows\°õ! 2014-08-25 15:23 - 2014-07-09 17:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation 2014-08-25 15:21 - 2013-12-18 18:06 - 00111920 _____ () C:\Users\Schramm_Felix\AppData\Local\GDIPFONTCACHEV1.DAT 2014-08-25 14:54 - 2014-04-05 22:23 - 00000000 ___RD () C:\Users\Felix_Schramm\Dropbox 2014-08-24 19:04 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache 2014-08-24 16:21 - 2014-08-24 16:21 - 43077153 _____ () C:\Users\Felix_Schramm\Desktop\Finales_Bild.psd 2014-08-23 22:59 - 2014-08-23 22:48 - 00000000 ____D () C:\Users\Schramm_Felix\AppData\Roaming\IrfanView 2014-08-23 22:52 - 2014-08-23 22:52 - 00000000 ____D () C:\Users\Felix_Schramm\AppData\Roaming\IrfanView 2014-08-23 22:32 - 2014-04-29 14:54 - 00271360 _____ () C:\Users\Felix_Schramm\Desktop\archive.pst 2014-08-23 21:46 - 2014-08-23 21:46 - 01744299 _____ () C:\Users\Felix_Schramm\Desktop\sonnenuntergang_Fabi_bearbeitet.psd 2014-08-23 21:41 - 2014-08-23 21:41 - 05909368 _____ () C:\Users\Felix_Schramm\Desktop\sonnenuntergang_Fabi.psd 2014-08-23 20:06 - 2014-08-23 20:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Phone 2014-08-23 20:05 - 2014-08-23 20:05 - 00000000 ____D () C:\Program Files (x86)\Windows Phone 2014-08-23 20:03 - 2014-08-23 20:03 - 00000000 ____D () C:\ProgramData\Applications 2014-08-22 00:10 - 2014-08-22 00:10 - 00000000 ____D () C:\Users\Schramm_Felix\AppData\Roaming\thriXXX 2014-08-22 00:10 - 2014-08-22 00:10 - 00000000 ____D () C:\Users\Schramm_Felix\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\thriXXX 2014-08-22 00:10 - 2014-08-22 00:10 - 00000000 ____D () C:\ProgramData\thriXXX 2014-08-22 00:10 - 2014-08-22 00:10 - 00000000 ____D () C:\Program Files (x86)\thriXXX 2014-08-20 12:04 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions 2014-08-20 11:19 - 2014-05-07 13:55 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-08-19 20:33 - 2014-04-05 22:23 - 00001057 _____ () C:\Users\Felix_Schramm\Desktop\Dropbox.lnk 2014-08-19 20:33 - 2014-04-05 22:22 - 00000000 ____D () C:\Users\Felix_Schramm\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox 2014-08-07 20:32 - 2013-12-19 16:36 - 00000000 ____D () C:\ProgramData\Skype 2014-08-07 14:47 - 2014-08-07 14:47 - 00000000 ____D () C:\Users\Felix_Schramm\AppData\Local\Verlag_Heinrich_Vogel_in_ 2014-08-07 04:06 - 2014-08-19 21:32 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-08-07 04:01 - 2014-08-19 21:32 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-08-05 17:53 - 2014-08-05 17:52 - 00000000 ____D () C:\Users\Felix_Schramm\Documents\OneNote-Notizbücher 2014-08-05 17:45 - 2014-08-05 17:45 - 00002525 _____ () C:\Users\Public\Desktop\Microsoft Download Manager.lnk 2014-08-05 17:45 - 2014-08-05 17:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Download Manager 2014-08-05 17:45 - 2014-08-05 17:45 - 00000000 ____D () C:\Program Files (x86)\Microsoft Download Manager 2014-08-05 17:31 - 2014-08-05 17:31 - 00000000 ____D () C:\Windows\System32\Tasks\OfficeSoftwareProtectionPlatform 2014-08-05 15:38 - 2014-08-05 15:38 - 00000000 ____D () C:\Users\Felix_Schramm\AppData\Roaming\.mono 2014-08-05 15:38 - 2014-08-05 15:38 - 00000000 ____D () C:\ProgramData\.mono 2014-08-05 15:36 - 2014-08-05 15:36 - 00000000 ____D () C:\Users\Felix_Schramm\AppData\Local\Unity 2014-08-01 01:41 - 2014-08-19 21:40 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-08-01 01:16 - 2014-08-19 21:40 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2014-07-26 19:41 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\LiveKernelReports Some content of TEMP: ==================== C:\Users\Felix_Schramm\AppData\Local\Temp\avgnt.exe C:\Users\Felix_Schramm\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpp7fufs.dll C:\Users\Felix_Schramm\AppData\Local\Temp\npp.6.6.7.Installer.exe C:\Users\Schramm_Felix\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp14kpb5.dll C:\Users\Schramm_Felix\AppData\Local\Temp\Quarantine.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-08-20 13:03 ==================== End Of Log ============================ |
|
26.08.2014, 18:49
| #4 |
| /// the machine /// TB-Ausbilder | Windows 7: MBAM meldet immer wieder den gleichen FundESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Windows 7: MBAM meldet immer wieder den gleichen Fund |
| adware, antivir, antivirus, avira, avira savings advisor, combofix, cpu, desktop, fehlercode 1, flash player, google, helper, installation, langsam, msiexec.exe, officejet, onedrive, problem, programm, prozess, realtek, registry, scan, schutz, security, software, starten, svchost.exe, system, windows |
Revo Uninstaller herunter.
dann auf 
und dann auf 
.
Linear-Darstellung
