| |
| |||||||
Log-Analyse und Auswertung: Trojan.Kazy!WvUyTGribrg (trojan) in AdobeARM.exeWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
26.08.2014, 01:27
| #1 |
 |  Trojan.Kazy!WvUyTGribrg (trojan) in AdobeARM.exe Lieber Helfer, liebe Helferin, Outpost Security Suite meldet mir beim Starten von firefox den Trojaner Trojan.Kazy!WvUyTGribrg Additiv meldet mir avast folgende Viren: izlg8f37.vbt in C:\windows\system32\Filt\TMP Upx.bezukwke in C:\Unsers\AlX\AppData\Local\Temp Upx.mdvwsaqs in C:\Unsers\AlX\AppData\Local\Temp Upx.yaxqpvla in C:\Unsers\AlX\AppData\Local\Temp Ich weiß nicht, ob das eine etwas mit dem anderen zu tun hat. Ich habe leider alles falsch gemacht und es - anders als Regel 1 vorschreibt - auf eigene Faust probiert. Ich habe mit der outpost security suite den virus entfernt, danach mit malwarebytes, spybot search and destroy und avast gescannt. Als die Programme nichts gefunden haben, habe ich trojan hunter runtergeladen und mit der shareware-version gescannt, die aber auch nichts gefunden hat. Wenn ich den Rechner neu starte, ist der trojaner wieder da. Sorry, wenn ich es damit komplizierter gemacht habe. Jetzt weiß ich nicht mehr weiter. Ich habe der Anleitung entsprechend die Scans durchgeführt: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-08-2014 01
Ran by AlX (administrator) on ALX-PC on 26-08-2014 01:24:34
Running from C:\Users\AlX\Downloads
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(Agnitum Ltd.) C:\Program Files\Agnitum\Outpost Security Suite Free\op_mon.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Agnitum Ltd.) C:\Program Files\Agnitum\Outpost Security Suite Free\acs.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Mischel Internet Security) C:\Program Files (x86)\TrojanHunter 5.6\THGuard.exe
() C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
() C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
(Safer Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 6100\Bin\HPNetworkCommunicator.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2723624 2011-03-28] (Synaptics Incorporated)
HKLM\...\Run: [Power Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [1831528 2011-05-10] (Acer Incorporated)
HKLM\...\Run: [OutpostMonitor] => C:\Program Files\Agnitum\Outpost Security Suite Free\op_mon.exe [4510072 2011-04-04] (Agnitum Ltd.)
HKLM\...\Run: [OutpostFeedBack] => C:\Program Files\Agnitum\Outpost Security Suite Free\feedback.exe [808064 2011-03-30] (Agnitum Ltd.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12921488 2000-01-01] (Realtek Semiconductor)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1103440 2011-07-01] (Dritek System Inc.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642656 2013-03-28] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [4085896 2014-08-10] (AVAST Software)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2011-03-24] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [191528 2014-06-04] (Geek Software GmbH)
HKLM-x32\...\Run: [THGuard] => C:\Program Files (x86)\TrojanHunter 5.6\THGuard.exe [1081808 2014-07-30] (Mischel Internet Security)
HKU\.DEFAULT\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-19\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-20\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-21-3429764466-1293764708-2967138861-1001\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
AppInit_DLLs: c:\progra~1\agnitum\outpos~1\wl_hoo~1.dll => c:\Program Files\Agnitum\Outpost Security Suite Free\wl_hook64.dll [983664 2011-03-30] (Agnitum Ltd.)
AppInit_DLLs-x32: c:\progra~1\agnitum\outpos~1\wl_hook.dll => c:\Program Files\Agnitum\Outpost Security Suite Free\wl_hook.dll [701456 2011-03-30] (Agnitum Ltd.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (No File)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\p6_19_erinnerung.lnk
ShortcutTarget: p6_19_erinnerung.lnk -> C:\Program Files (x86)\phase6\phase6_19\WinStart\WinStart.exe (phase6)
Startup: C:\Users\AlX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Officejet 6100 (Netzwerk).lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Officejet 6100 (Netzwerk).lnk -> C:\Program Files\HP\HP Officejet 6100\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)
ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: Outpost -> {33C9E362-3EDA-4930-8AFE-5DA39A8BB77A} => C:\Program Files\Agnitum\Outpost Security Suite Free\op_shell.dll (Agnitum Ltd.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
ProxyServer: 127.0.0.1:9666
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: No Name -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> No File
BHO-x32: Spybot-S&D IE Protection -> {53707962-6F74-2D53-2644-206D7942484F} -> C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
BHO-x32: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre8\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre8\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
Toolbar: HKLM-x32 - No Name - {ba696155-d96e-4281-b467-0367a0456474} - No File
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
FireFox:
========
FF ProfilePath: C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default
FF Homepage: https://startpage.com/do/search
FF NetworkProxy: "socks_version", 4
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=11.5.2 -> C:\Program Files (x86)\Java\jre8\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.5.2 -> C:\Program Files (x86)\Java\jre8\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @protectdisc.com/NPPDLicenseHelper -> C:\Program Files (x86)\ProtectDisc\License Helper\NPPDLicenseHelper.dll ()
FF Plugin-x32: @real.com/nppl3260;version=15.0.6.14 -> C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprjplug;version=15.0.6.14 -> C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpchromebrowserrecordext;version=15.0.6.14 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprphtml5videoshim;version=15.0.6.14 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=15.0.6.14 -> C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\searchplugins\ixquick-https---deutsch.xml
FF SearchPlugin: C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\searchplugins\nation-secure-search.xml
FF SearchPlugin: C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\searchplugins\startpage-https---deutsch.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: ProxTube - Unblock YouTube - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\ich@maltegoetz.de [2014-01-26]
FF Extension: YouTube Unblocker - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\youtubeunblocker@unblocker.yt [2014-06-06]
FF Extension: WOT - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2013-11-26]
FF Extension: Adblock Plus Pop-up Addon - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\adblockpopups@jessehakanen.net.xpi [2014-01-04]
FF Extension: Proxy-Listen.de - Proxyswitcher - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\admin@proxy-listen.de.xpi [2014-07-17]
FF Extension: Add-on Compatibility Reporter - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\compatibility@addons.mozilla.org.xpi [2013-07-12]
FF Extension: Hide My Ass Proxy Extension - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\extension@hidemyass.com.xpi [2014-01-04]
FF Extension: Ghostery - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\firefox@ghostery.com.xpi [2013-10-18]
FF Extension: One Click Proxy - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\jid0-zXo3XFGyiDalgkeEO4UYJTUwo2I@jetpack.xpi [2014-02-22]
FF Extension: Lightbeam - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\jid1-F9UJ2thwoAm5gQ@jetpack.xpi [2013-11-27]
FF Extension: Proxy Selector - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\proxyselector@mozilla.org.xpi [2014-07-17]
FF Extension: Proxy Tool - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\proxytool@proxylist.co.xpi [2014-07-17]
FF Extension: Speed DNS - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\speeddns@gmail.com.xpi [2014-01-18]
FF Extension: ProxTube - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\{2541D29A-DB9E-4c1e-949A-31EFB4AEF4E7}.xpi [2014-08-10]
FF Extension: Cookie Cutter - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\{4d14a68e-9a97-4358-8603-ed67b332cef1}.xpi [2014-07-17]
FF Extension: UltraSurf Firefox Tool - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\{5B52016C-D097-4aec-BE61-9F129D8FDDBA}.xpi [2014-07-17]
FF Extension: NoScript - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-02-21]
FF Extension: HideMyAss - Free Web Proxy - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\{9aba569a-d0cc-427d-bd2a-27bfd7ce544c}.xpi [2014-07-17]
FF Extension: BetterPrivacy - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi [2014-07-17]
FF Extension: Torbutton - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}.xpi [2014-07-17]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2014-08-10]
FF HKLM-x32\...\Firefox\Extensions: [{0153E448-190B-4987-BDE1-F256CADA672F}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF Extension: RealPlayer Browser Record Plugin - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012-09-15]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-12-16]
FF HKCU\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: No Name - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
Chrome:
=======
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-07-17]
CHR HKLM-x32\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Ext\rphtml5video.crx [2012-09-15]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 acssrv; C:\Program Files\Agnitum\Outpost Security Suite Free\acs.exe [3501696 2011-04-04] (Agnitum Ltd.)
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2013-03-28] (Advanced Micro Devices, Inc.) [File not signed]
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-07-17] (AVAST Software)
S3 CGVPNCliSrvc; C:\Program Files\CyberGhost VPN\CGVPNCliService.exe [2438696 2012-04-26] (mobile concepts GmbH)
R2 DirMngr; C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe [218112 2013-07-16] () [File not signed]
R2 GREGService; C:\Program Files (x86)\Acer\Registration\GREGsvc.exe [29696 2011-05-26] (Acer Incorporated) [File not signed]
R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [116104 2010-04-05] ()
S2 libusbd; C:\Windows\SysWOW64\libusbd-nt.exe [18944 2005-03-09] (hxxp://libusb-win32.sourceforge.net) [File not signed]
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [256832 2011-04-24] (NTI Corporation)
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
R2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
S2 McAfee SiteAdvisor Service; No ImagePath
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R1 afw; C:\Windows\System32\DRIVERS\afw.sys [39528 2010-04-20] (Agnitum Ltd.)
R3 afwcore; C:\Windows\System32\drivers\afwcore.sys [424040 2010-09-27] (Agnitum Ltd.)
R3 ASWFilt; C:\Windows\system32\Filt\ASWFilt64.dll [49168 2011-03-21] (Agnitum Ltd.)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-07-17] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-07-17] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-07-17] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-07-17] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1041168 2014-07-17] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427360 2014-07-17] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [92008 2014-07-17] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [224896 2014-07-17] ()
R3 L1C; C:\Windows\System32\DRIVERS\L1C60x64.sys [120520 2013-04-26] (Qualcomm Atheros Co., Ltd.)
S3 libusb0; C:\Windows\SysWOW64\drivers\libusb0.sys [33792 2005-03-09] () [File not signed]
R1 SandBox; C:\Windows\system32\drivers\SandBox64.sys [1097672 2011-03-21] (Agnitum Ltd.)
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [16152 2013-06-15] ()
R3 VBEngNT; C:\Windows\system32\drivers\VBEngNT.sys [293048 2011-02-02] (VirusBuster Kft.)
R3 VBFilt; C:\Windows\system32\Filt\VBFilt64.dll [42976 2011-03-21] (Agnitum Ltd.)
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-08-26 01:24 - 2014-08-26 01:25 - 00021007 _____ () C:\Users\AlX\Downloads\FRST.txt
2014-08-26 01:24 - 2014-08-26 01:24 - 00000000 ____D () C:\FRST
2014-08-26 01:23 - 2014-08-26 01:23 - 02103296 _____ (Farbar) C:\Users\AlX\Downloads\FRST64.exe
2014-08-26 01:22 - 2014-08-26 01:22 - 00000468 _____ () C:\Users\AlX\Downloads\defogger_disable.log
2014-08-26 01:22 - 2014-08-26 01:22 - 00000000 _____ () C:\Users\AlX\defogger_reenable
2014-08-26 01:21 - 2014-08-26 01:21 - 00050477 _____ () C:\Users\AlX\Downloads\Defogger.exe
2014-08-26 01:14 - 2014-08-26 01:14 - 00000021 _____ () C:\Windows\S.dirmngr
2014-08-26 00:20 - 2014-08-26 00:20 - 00000344 _____ () C:\Windows\PFRO.log
2014-08-26 00:18 - 2014-08-26 00:18 - 00000000 ____D () C:\Users\AlX\AppData\Roaming\TrojanHunter
2014-08-25 20:44 - 2014-08-26 01:14 - 00000224 _____ () C:\Windows\setupact.log
2014-08-25 20:44 - 2014-08-25 20:44 - 00000000 _____ () C:\Windows\setuperr.log
2014-08-25 20:20 - 2014-08-25 20:20 - 00078984 _____ () C:\Users\AlX\Documents\25.08.2014registry.reg
2014-08-25 20:10 - 2014-08-25 20:10 - 00000000 ____D () C:\Users\AlX\Downloads\tor
2014-08-25 17:06 - 2014-08-25 17:06 - 00000000 ____D () C:\Users\AlX\AppData\Roaming\KeePass
2014-08-25 15:57 - 2014-08-25 15:57 - 04334200 _____ (Bytelayer AB ) C:\Users\AlX\Downloads\TrojanHunterSetup.exe
2014-08-25 15:54 - 2014-08-25 15:54 - 00001071 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KeePass.lnk
2014-08-25 15:54 - 2014-08-25 15:54 - 00000000 ____D () C:\Program Files (x86)\KeePass Password Safe
2014-08-25 15:52 - 2014-08-25 15:59 - 00000000 ____D () C:\Program Files (x86)\TrojanHunter 5.6
2014-08-25 15:52 - 2014-08-25 15:58 - 00000000 ____D () C:\ProgramData\TrojanHunter
2014-08-25 15:52 - 2014-08-25 15:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TrojanHunter
2014-08-25 15:52 - 2014-08-25 15:52 - 00059392 ____R () C:\Windows\SysWOW64\streamhlp.dll
2014-08-25 15:51 - 2014-08-25 15:51 - 01101648 _____ () C:\Users\AlX\Downloads\TrojanHunter - CHIP-Installer.exe
2014-08-25 15:48 - 2014-08-26 01:17 - 00017701 _____ () C:\Windows\WindowsUpdate.log
2014-08-21 09:48 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-08-21 09:48 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-08-21 09:48 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-08-21 09:48 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-08-21 09:47 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-08-21 09:47 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-08-21 09:47 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-08-21 09:47 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2014-08-21 09:47 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-08-21 09:47 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-08-21 09:47 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-08-21 09:47 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-08-21 09:47 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-08-21 09:47 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2014-08-13 20:15 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-08-13 20:15 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll
2014-08-13 20:15 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-08-13 20:15 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-08-13 20:15 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe
2014-08-13 20:15 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll
2014-08-13 20:14 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-08-13 20:14 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-08-13 16:45 - 2014-08-01 01:16 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-08-13 16:45 - 2014-07-25 16:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-13 16:45 - 2014-07-25 16:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-08-13 16:45 - 2014-07-25 15:51 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-08-13 16:45 - 2014-07-25 15:28 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-08-13 16:45 - 2014-07-25 15:10 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-08-13 16:45 - 2014-07-25 14:34 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-08-13 16:45 - 2014-07-25 14:33 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-08-13 16:45 - 2014-07-25 14:28 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-08-13 16:45 - 2014-07-25 14:21 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-08-13 16:45 - 2014-07-25 14:17 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-08-13 16:45 - 2014-07-25 14:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-08-13 16:45 - 2014-07-25 13:52 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-08-13 16:45 - 2014-07-25 13:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-08-13 16:45 - 2014-07-25 13:42 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-08-13 16:45 - 2014-07-25 13:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-08-13 16:45 - 2014-07-25 13:13 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-08-13 16:45 - 2014-07-25 13:07 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-08-13 16:45 - 2014-07-25 12:26 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-13 16:45 - 2014-07-25 12:00 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-08-13 16:45 - 2014-07-16 05:25 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-13 16:45 - 2014-07-16 05:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-08-13 16:45 - 2014-07-16 04:46 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-13 16:45 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-08-13 16:45 - 2014-07-16 04:12 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-13 16:45 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
2014-08-13 16:45 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
2014-08-13 16:45 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
2014-08-13 16:45 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2014-08-13 16:45 - 2014-07-09 04:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
2014-08-13 16:45 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL
2014-08-13 16:45 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL
2014-08-13 16:45 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL
2014-08-13 16:45 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL
2014-08-13 16:45 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
2014-08-13 16:45 - 2014-07-09 00:38 - 00419992 _____ () C:\Windows\system32\locale.nls
2014-08-13 16:45 - 2014-07-09 00:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls
2014-08-13 16:45 - 2014-06-25 04:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-08-13 16:45 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-08-13 16:45 - 2014-06-16 04:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-08-13 16:45 - 2014-06-03 12:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-08-13 16:45 - 2014-06-03 12:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-08-13 16:45 - 2014-06-03 12:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-08-13 16:45 - 2014-06-03 12:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-08-13 16:45 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-08-13 16:45 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-08-13 16:45 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-08-13 16:44 - 2014-08-01 01:41 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-13 16:44 - 2014-07-25 16:52 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-13 16:44 - 2014-07-25 15:30 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-08-13 16:44 - 2014-07-25 15:28 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-08-13 16:44 - 2014-07-25 15:25 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-13 16:44 - 2014-07-25 15:25 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-08-13 16:44 - 2014-07-25 15:11 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-13 16:44 - 2014-07-25 15:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-08-13 16:44 - 2014-07-25 15:03 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-08-13 16:44 - 2014-07-25 15:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-08-13 16:44 - 2014-07-25 15:00 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-08-13 16:44 - 2014-07-25 14:59 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-08-13 16:44 - 2014-07-25 14:47 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-08-13 16:44 - 2014-07-25 14:40 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-13 16:44 - 2014-07-25 14:34 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-08-13 16:44 - 2014-07-25 14:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-08-13 16:44 - 2014-07-25 14:28 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-13 16:44 - 2014-07-25 14:19 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-08-13 16:44 - 2014-07-25 14:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-08-13 16:44 - 2014-07-25 14:17 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-13 16:44 - 2014-07-25 14:12 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-08-13 16:44 - 2014-07-25 14:10 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-13 16:44 - 2014-07-25 14:10 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-08-13 16:44 - 2014-07-25 14:06 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-08-13 16:44 - 2014-07-25 13:47 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-13 16:44 - 2014-07-25 13:39 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-13 16:44 - 2014-07-25 13:39 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-08-13 16:44 - 2014-07-25 13:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-08-13 16:44 - 2014-07-25 13:29 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-08-13 16:44 - 2014-07-25 13:23 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-13 16:44 - 2014-07-25 13:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-08-13 16:44 - 2014-07-25 13:03 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-08-13 16:44 - 2014-07-25 12:52 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-13 16:44 - 2014-07-25 12:17 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-08-13 16:44 - 2014-07-25 12:09 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-08-13 16:44 - 2014-07-25 12:05 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-08-13 16:43 - 2014-08-07 04:06 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-13 16:43 - 2014-08-07 04:01 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-13 16:43 - 2014-07-14 04:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-08-13 16:43 - 2014-07-14 03:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2014-08-10 16:35 - 2014-08-10 16:35 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-08-26 01:25 - 2014-08-26 01:24 - 00021007 _____ () C:\Users\AlX\Downloads\FRST.txt
2014-08-26 01:24 - 2014-08-26 01:24 - 00000000 ____D () C:\FRST
2014-08-26 01:24 - 2012-01-08 17:23 - 00156378 _____ () C:\Windows\system32\config\rules.rdb
2014-08-26 01:23 - 2014-08-26 01:23 - 02103296 _____ (Farbar) C:\Users\AlX\Downloads\FRST64.exe
2014-08-26 01:22 - 2014-08-26 01:22 - 00000468 _____ () C:\Users\AlX\Downloads\defogger_disable.log
2014-08-26 01:22 - 2014-08-26 01:22 - 00000000 _____ () C:\Users\AlX\defogger_reenable
2014-08-26 01:22 - 2011-12-10 00:48 - 00000000 ____D () C:\Users\AlX
2014-08-26 01:22 - 2009-07-14 06:45 - 00024400 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-26 01:22 - 2009-07-14 06:45 - 00024400 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-26 01:21 - 2014-08-26 01:21 - 00050477 _____ () C:\Users\AlX\Downloads\Defogger.exe
2014-08-26 01:17 - 2014-08-25 15:48 - 00017701 _____ () C:\Windows\WindowsUpdate.log
2014-08-26 01:17 - 2013-10-17 22:56 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-08-26 01:14 - 2014-08-26 01:14 - 00000021 _____ () C:\Windows\S.dirmngr
2014-08-26 01:14 - 2014-08-25 20:44 - 00000224 _____ () C:\Windows\setupact.log
2014-08-26 01:14 - 2014-07-14 13:42 - 00001100 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-08-26 01:14 - 2013-09-05 13:35 - 00000000 ____D () C:\Users\Public\Documents\phase6_19_Daten
2014-08-26 01:14 - 2013-07-13 14:37 - 00000322 _____ () C:\Windows\Tasks\GlaryInitialize.job
2014-08-26 01:14 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-26 01:12 - 2014-07-14 13:42 - 00001104 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-08-26 01:12 - 2011-12-10 03:09 - 00523928 _____ () C:\Windows\system32\config\afw_db.conf
2014-08-26 01:12 - 2011-12-10 03:09 - 00073924 _____ () C:\Windows\system32\config\afw_hm.conf
2014-08-26 00:20 - 2014-08-26 00:20 - 00000344 _____ () C:\Windows\PFRO.log
2014-08-26 00:20 - 2012-05-10 13:58 - 00068744 _____ () C:\Users\AlX\AppData\Local\GDIPFONTCACHEV1.DAT
2014-08-26 00:20 - 2009-07-14 06:45 - 00315656 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-26 00:18 - 2014-08-26 00:18 - 00000000 ____D () C:\Users\AlX\AppData\Roaming\TrojanHunter
2014-08-26 00:18 - 2012-05-26 01:56 - 00007767 _____ () C:\ProgramData\hpzinstall.log
2014-08-26 00:15 - 2014-07-08 15:26 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-25 20:44 - 2014-08-25 20:44 - 00000000 _____ () C:\Windows\setuperr.log
2014-08-25 20:30 - 2012-05-26 01:58 - 00000000 ____D () C:\Program Files (x86)\HP
2014-08-25 20:26 - 2012-02-13 19:25 - 00000000 ____D () C:\Program Files (x86)\Google
2014-08-25 20:23 - 2012-02-13 19:25 - 00000000 ____D () C:\Users\AlX\AppData\Local\Google
2014-08-25 20:20 - 2014-08-25 20:20 - 00078984 _____ () C:\Users\AlX\Documents\25.08.2014registry.reg
2014-08-25 20:18 - 2011-12-09 21:21 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-08-25 20:10 - 2014-08-25 20:10 - 00000000 ____D () C:\Users\AlX\Downloads\tor
2014-08-25 17:06 - 2014-08-25 17:06 - 00000000 ____D () C:\Users\AlX\AppData\Roaming\KeePass
2014-08-25 15:59 - 2014-08-25 15:52 - 00000000 ____D () C:\Program Files (x86)\TrojanHunter 5.6
2014-08-25 15:58 - 2014-08-25 15:52 - 00000000 ____D () C:\ProgramData\TrojanHunter
2014-08-25 15:57 - 2014-08-25 15:57 - 04334200 _____ (Bytelayer AB ) C:\Users\AlX\Downloads\TrojanHunterSetup.exe
2014-08-25 15:57 - 2014-08-25 15:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TrojanHunter
2014-08-25 15:54 - 2014-08-25 15:54 - 00001071 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KeePass.lnk
2014-08-25 15:54 - 2014-08-25 15:54 - 00000000 ____D () C:\Program Files (x86)\KeePass Password Safe
2014-08-25 15:52 - 2014-08-25 15:52 - 00059392 ____R () C:\Windows\SysWOW64\streamhlp.dll
2014-08-25 15:51 - 2014-08-25 15:51 - 01101648 _____ () C:\Users\AlX\Downloads\TrojanHunter - CHIP-Installer.exe
2014-08-25 15:48 - 2012-01-16 17:27 - 00000000 ____D () C:\Users\AlX\AppData\Roaming\uTorrent
2014-08-25 15:11 - 2012-04-18 22:24 - 00000000 ____D () C:\Program Files (x86)\Klett
2014-08-25 15:11 - 2012-01-29 03:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Klett
2014-08-25 13:11 - 2011-12-10 01:51 - 00000000 ____D () C:\Windows\system32\Filt
2014-08-24 14:02 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration
2014-08-24 13:05 - 2013-12-16 11:56 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-08-24 01:27 - 2011-09-26 10:53 - 00699666 _____ () C:\Windows\system32\perfh007.dat
2014-08-24 01:27 - 2011-09-26 10:53 - 00149774 _____ () C:\Windows\system32\perfc007.dat
2014-08-24 01:27 - 2009-07-14 07:13 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-20 14:56 - 2012-02-03 17:13 - 00000000 ____D () C:\ProgramData\CanonIJPLM
2014-08-19 00:54 - 2012-04-27 15:41 - 00000000 ____D () C:\Users\AlX\AppData\Local\Paint.NET
2014-08-16 14:59 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-08-13 23:42 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-08-13 20:26 - 2013-07-14 13:17 - 00000000 ____D () C:\Windows\system32\MRT
2014-08-13 20:22 - 2011-12-09 22:31 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-08-13 20:13 - 2014-05-07 11:35 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-08-12 17:49 - 2012-05-15 18:12 - 00000000 ____D () C:\Users\AlX\AppData\Roaming\Audacity
2014-08-11 00:47 - 2012-05-05 17:36 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-08-10 16:35 - 2014-08-10 16:35 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-08-07 04:06 - 2014-08-13 16:43 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-07 04:01 - 2014-08-13 16:43 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-01 01:41 - 2014-08-13 16:44 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-01 01:16 - 2014-08-13 16:45 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-08-17 19:18
==================== End Of Log ============================
FRST Additions Logfile: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 25-08-2014 01
Ran by AlX at 2014-08-26 01:26:33
Running from C:\Users\AlX\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AV: Outpost Security Suite (Enabled - Up to date) {ECEA6BCD-A007-0BC7-D5A5-0254DCBD816E}
AS: Outpost Security Suite (Enabled - Up to date) {578B8A29-863D-0449-EF15-3926A73ACBD3}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
FW: Outpost Security Suite (Enabled) {D4D1EAE8-EA68-0A9F-FEFA-AB61226EC615}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
µTorrent (HKLM-x32\...\uTorrent) (Version: 3.1.3 - )
64 Bit HP CIO Components Installer (Version: 7.2.8 - Hewlett-Packard) Hidden
Acer Backup Manager (HKLM-x32\...\InstallShield_{0B61BBD5-DA3C-409A-8730-0C3DC3B0F270}) (Version: 3.0.0.99 - NTI Corporation)
Acer ePower Management (HKLM-x32\...\{3DB0448D-AD82-4923-B305-D001E521A964}) (Version: 6.00.3007 - Acer Incorporated)
Acer eRecovery Management (HKLM-x32\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 5.00.3502 - Acer Incorporated)
Acer Registration (HKLM-x32\...\Acer Registration) (Version: 1.04.3502 - Acer Incorporated)
Acer ScreenSaver (HKLM-x32\...\Acer Screensaver) (Version: 1.1.0530.2011 - Acer Incorporated)
Acer Updater (HKLM-x32\...\{EE171732-BEB4-4576-887D-CB62727F01CA}) (Version: 1.02.3502 - Acer Incorporated)
Adobe Flash Player 14 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.08) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.08 - Adobe Systems Incorporated)
AFPL Ghostscript 8.54 (HKLM-x32\...\AFPL Ghostscript 8.54) (Version: - )
AFPL Ghostscript Fonts (HKLM-x32\...\AFPL Ghostscript Fonts) (Version: - )
AMD Accelerated Video Transcoding (Version: 12.10.100.30328 - Advanced Micro Devices, Inc.) Hidden
AMD APP SDK Runtime (Version: 10.0.1084.4 - Advanced Micro Devices Inc.) Hidden
AMD AVIVO64 Codecs (Version: 12.5.100.20704 - Advanced Micro Devices, Inc.) Hidden
AMD Catalyst Install Manager (HKLM\...\{9AB0D5B6-4779-8C4F-CA91-A1FEDB56D7EC}) (Version: 8.0.911.0 - Advanced Micro Devices, Inc.)
AMD Drag and Drop Transcoding (Version: 2.00.0000 - Advanced Micro Devices, Inc.) Hidden
AMD Fuel (Version: 2013.0328.2218.38225 - Ihr Firmenname) Hidden
AMD Media Foundation Decoders (Version: 1.0.80328.2204 - Advanced Micro Devices, Inc.) Hidden
AMD Steady Video Plug-In (Version: 2.06.0000 - AMD) Hidden
AMD VISION Engine Control Center (x32 Version: 2013.0328.2218.38225 - Ihr Firmenname) Hidden
A-PDF Restrictions Remover 1.6 (HKLM-x32\...\A-PDF Restrictions Remover_is1) (Version: - A-PDF Solution)
A-PDF Text Extractor 1.4 (HKLM-x32\...\A-PDF Text Extractor_is1) (Version: - A-PDF.com)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 1.0.2.43 - Atheros Communications Inc.)
Audacity 2.0 (HKLM-x32\...\Audacity_is1) (Version: - Audacity Team)
avast! Free Antivirus (HKLM-x32\...\Avast) (Version: 9.0.2021 - AVAST Software)
Backup Manager V3 (x32 Version: 3.0.0.99 - NTI Corporation) Hidden
Canon Inkjet Printer/Scanner/Fax Extended Survey Program (HKLM-x32\...\CANONIJPLM100) (Version: - )
Canon MP Navigator EX 4.0 (HKLM-x32\...\MP Navigator EX 4.0) (Version: - )
CanoScan LiDE 110 Scanner Driver (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_CNQ2414) (Version: - )
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2013.0328.2218.38225 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2013.0328.2218.38225 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2013.0328.2218.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2013.0328.2218.38225 - Advanced Micro Devices, Inc.) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 3.15 - Piriform)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.2.4214 - CDBurnerXP)
CheckDrive (HKLM-x32\...\{B83513EC-2E4D-4621-816D-4CCF397BE702}_is1) (Version: 4.0 - Abelssoft)
CyberGhost VPN (HKLM\...\CyberGhost VPN_is1) (Version: - CyberGhost S.R.L.)
DriverEasy 4.5.2 (HKLM\...\DriverEasy_is1) (Version: 4.5.2.0 - Easeware)
ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 15.2.20140326 - Landesfinanzdirektion Thüringen)
EVEREST Home Edition v2.20 (HKLM-x32\...\EVEREST Home Edition_is1) (Version: 2.20 - Lavalys Inc)
Foxit Reader 5.1 (HKLM-x32\...\Foxit Reader_is1) (Version: 5.1.4.104 - Foxit Corporation)
Free WMA to MP3 Converter 1.16 (HKLM-x32\...\Free WMA to MP3 Converter_is1) (Version: - Jodix Technologies Ltd.)
Free YouTube Download version 3.2.31.325 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.2.31.325 - DVDVideoSoft Ltd.)
Glary Utilities 2.56.0.1822 (HKLM-x32\...\Glary Utilities_is1) (Version: 2.56.0.1822 - Glarysoft Ltd)
Gpg4win (2.2.0-beta34) (HKLM-x32\...\GPG4Win) (Version: 2.2.0-beta34 - The Gpg4win Project)
GPL Ghostscript (HKLM\...\GPL Ghostscript 9.04) (Version: 9.04 - Artifex Software Inc.)
GPL Ghostscript (HKLM\...\GPL Ghostscript 9.06) (Version: 9.06 - Artifex Software Inc.)
Green Line 3 Sprachtrainer (HKLM-x32\...\{EE6F9172-D644-4C45-9892-2F22AF49F88C}) (Version: 1.00.000 - Klett)
GSview 5.0 (HKLM\...\GSview 5.0) (Version: 5.0 - Ghostgum Software Pty Ltd)
HP Officejet 6100 - Grundlegende Software für das Gerät (HKLM\...\{E30BC112-507C-4980-A00B-13C5CC9EDB03}) (Version: 25.0.617.0 - Hewlett-Packard Co.)
HP Officejet 6100 Hilfe (HKLM-x32\...\{2033DC31-6C96-4E5B-BF51-6BFFDB3E6564}) (Version: 140.0.2.2 - Hewlett Packard)
HP Update (HKLM-x32\...\{85DF2EED-08BC-46FB-90DA-28B0D0A8E8A8}) (Version: 5.003.000.004 - Hewlett-Packard)
ISO Workshop 3.4 (HKLM-x32\...\ISO Workshop_is1) (Version: - Glorylogic)
Java 7 Update 65 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F06417065FF}) (Version: 7.0.650 - Oracle)
Java 7 Update 65 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217065FF}) (Version: 7.0.650 - Oracle)
Java 8 Update 5 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218005FF}) (Version: 8.0.50 - Oracle Corporation)
Java Auto Updater (x32 Version: 2.8.05.13 - Oracle, Inc.) Hidden
Kastor - Stream Recorder V 1.0 (HKLM-x32\...\{CB84FEF6-C573-4328-B9A4-B29568A4E10E}_is1) (Version: 1.0.0.0 - KastorSoft)
KeePass Password Safe 1.27 (HKLM-x32\...\KeePass Password Safe_is1) (Version: 1.27 - Dominik Reichl)
Klett Lehrersoftware Green Line (Band 3) (HKLM-x32\...\Klett Lehrersoftware Green Line (Band 3)) (Version: - )
K-Lite Codec Pack 6.0.4 (Basic) (HKLM-x32\...\KLiteCodecPack_is1) (Version: 6.0.4 - )
LAME v3.99.3 (for Windows) (HKLM-x32\...\LAME_is1) (Version: - )
Launch Manager (HKLM-x32\...\LManager) (Version: 5.1.7 - Acer Inc.)
LibUSB-Win32-0.1.10.1 (HKLM-x32\...\LibUSB-Win32_is1) (Version: 0.1.10.1 - LibUSB-Win32)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 (HKLM-x32\...\{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}) (Version: 9.0.30411 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 31.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 31.0 (x86 de)) (Version: 31.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 31.0 - Mozilla)
Mozilla Thunderbird 31.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 31.0 (x86 de)) (Version: 31.0 - Mozilla)
NTI Media Maker 9 (HKLM-x32\...\InstallShield_{D3D5C4E8-040F-4C6F-8105-41D43CF94F44}) (Version: 9.0.2.8942 - NTI Corporation)
NTI Media Maker 9 (x32 Version: 9.0.2.8942 - NTI Corporation) Hidden
OpenOffice 4.0.0 (HKLM-x32\...\{B28DBCBA-60F8-40ED-B35B-F510C327946C}) (Version: 4.00.9702 - Apache Software Foundation)
Outpost Security Suite 7.1.1 (HKLM\...\Agnitum Outpost Security Suite Free_is1) (Version: 7.1.1 - Agnitum, Ltd.)
Paint.NET v3.5.10 (HKLM\...\{529125EF-E3AC-4B74-97E6-F688A7C0F1C0}) (Version: 3.60.0 - dotPDN LLC)
PDF Blender (HKLM-x32\...\PDF Blender) (Version: - )
PDF24 Creator 6.5.0 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org)
phase6_19 (HKLM-x32\...\{65D70656-D248-4C83-B594-E3029C43B37A}) (Version: 1.90.0000 - phase6)
PKR (HKLM-x32\...\PKR) (Version: - PKR Ltd)
Protect Disc License Helper 1.0.118 (HKLM-x32\...\Protect Disc License Helper) (Version: 1.0.118 - Protect Disc)
ProtectDisc Driver, Version 11 (HKLM-x32\...\ProtectDisc Driver 11) (Version: 11.0.0.11 - ProtectDisc Software GmbH)
RealNetworks - Microsoft Visual C++ 2008 Runtime (x32 Version: 9.0 - RealNetworks, Inc) Hidden
RealPlayer (HKLM-x32\...\RealPlayer 15.0) (Version: 15.0.6 - RealNetworks)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6680 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30127 - Realtek Semiconductor Corp.)
RealUpgrade 1.1 (x32 Version: 1.1.0 - RealNetworks, Inc.) Hidden
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
SlimDrivers (HKLM-x32\...\{7E052F74-10A7-42E7-84EB-01C172F5AB5D}) (Version: 2.2.28413 - SlimWare Utilities, Inc.)
Sprachtrainer Fonts (HKLM-x32\...\{FBCF2ED3-AFB5-475E-BF9A-30BEAD366FBC}) (Version: 1.00.01 - Ernst Klett Verlag GmbH)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1) (Version: 1.6.2 - Safer Networking Limited)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.2.17.5 - Synaptics Incorporated)
TopOCR 3.1 (HKLM-x32\...\TopOCR) (Version: 3.1 - TopSoft, Ltd)
TrojanHunter 5.6 (HKLM-x32\...\TrojanHunter_is1) (Version: 5.6 - Bytelayer AB)
USB Flachbettscanner (HKLM-x32\...\{D341C705-A763-4DC0-A3B6-EA13E34ADE9E}) (Version: - )
Visual Studio 2008 x64 Redistributables (HKLM-x32\...\{FCDBEA60-79F0-4FAE-BBA8-55A26C609A49}) (Version: 10.0.0.2 - AVG Technologies)
Visual Studio 2010 x64 Redistributables (HKLM\...\{21B133D6-5979-47F0-BE1C-F6A6B304693F}) (Version: 13.0.0.1 - AVG Technologies)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player 2.1.3 (HKLM\...\VLC media player) (Version: 2.1.3 - VideoLAN)
Welcome Center (HKLM-x32\...\Acer Welcome Center) (Version: 1.02.3503 - Acer Incorporated)
WinRAR 4.10 (32-Bit) (HKLM-x32\...\WinRAR archiver) (Version: 4.10.0 - win.rar GmbH)
Wipe 2013.55 (HKLM-x32\...\Wipe 2013) (Version: - )
Wise Registry Cleaner 7.88 (HKLM-x32\...\Wise Registry Cleaner_is1) (Version: 7.88 - WiseCleaner.com, Inc.)
Xleaner v4.06.616 (HKLM-x32\...\{72D84E46-E633-4729-8A77-2347C8CD4096}_is1) (Version: - More Than A Cleaner.de)
YouTube Song Downloader (HKLM-x32\...\{4281435C-AD1D-4C8A-B9C0-3961C11EF142}_is1) (Version: 8.2 - Abelssoft)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-3429764466-1293764708-2967138861-1001_Classes\CLSID\{7F943A42-14C6-0ADB-796B-A6520583F6C6}\InprocServer32 -> C:\Windows\system32\ole32.dll (Microsoft Corporation)
==================== Restore Points =========================
17-07-2014 20:18:30 avast! antivirus system restore point
25-07-2014 04:39:19 Windows Update
11-08-2014 21:40:01 Geplanter Prüfpunkt
13-08-2014 18:12:45 Windows Update
21-08-2014 07:46:21 Windows Update
25-08-2014 13:11:31 Klett Font Phonetik wird entfernt
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:34 - 2014-03-27 14:03 - 00000698 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {2F633BFB-ED06-4A61-940D-35CB18538E55} - System32\Tasks\{F70D7270-28A2-4FEB-A035-9C4A4C56976F} => C:\Users\AlX\Downloads\sca9693w9xp.exe
Task: {3084DA88-B1B1-4302-9C76-7E0F5DA7BA5F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: {4CD62BD1-33E1-4BBC-9640-82B0E2E594DF} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: {68702AB2-B9AB-47DD-AD79-CA887C32208A} - System32\Tasks\ROC_REG_JAN_DELETE => C:\ProgramData\AVG January 2013 Campaign\ROC.exe [2013-01-17] ()
Task: {6A20A5C0-1F79-4303-8AF9-3A4F19B3884F} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-08] (Adobe Systems Incorporated)
Task: {763044E8-7B71-4C18-941F-73F1A1B32C29} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-3429764466-1293764708-2967138861-1001 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2012-07-27] (RealNetworks, Inc.)
Task: {816175CE-D199-4ABC-BA6C-71AD8848CB8C} - System32\Tasks\Ad-Aware Update (Weekly) => C:\Program Files (x86)\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe
Task: {8B2A0DB6-A6AD-4DA4-80D4-1D09B2D9ACFE} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-3429764466-1293764708-2967138861-1001 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2012-07-27] (RealNetworks, Inc.)
Task: {9EB84B48-5049-4C9F-8697-0741CE1C4CF6} - System32\Tasks\Adobe Reader Speed Launcher => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe
Task: {BE0A8B47-02DE-4FFA-BB65-46BE1C22C980} - System32\Tasks\Adobe ARM => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-12-21] (Adobe Systems Incorporated)
Task: {BF47B4DE-CCF9-40DE-9888-AFB491C73EAD} - System32\Tasks\{AB8B422C-24D8-4940-B641-1540DA1CAC31} => C:\Users\AlX\Downloads\SetupPoker_a451c9(2).exe
Task: {CD23F21F-6D8D-4590-AF0F-5791B4FA60EB} - System32\Tasks\{4AF1DABB-5C26-444C-A5BA-D1C93289680E} => C:\Users\AlX\Desktop\Setup.exe
Task: {ECE74594-99A1-4D4A-9EA8-E189618CF648} - System32\Tasks\GlaryInitialize => C:\Program Files (x86)\Glary Utilities\initialize.exe [2013-05-27] (Glarysoft Ltd)
Task: {F0E1F30D-57AB-4FF5-B84E-3E8B66155C22} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-07-17] (AVAST Software)
Task: {F5E77754-9BEB-41DB-92D4-D1D566E0C426} - System32\Tasks\DriverEasy Scheduled Scan => C:\Program Files\Easeware\DriverEasy\DriverEasy.exe [2013-05-29] (Easeware)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\DriverEasy Scheduled Scan.job => C:\Program Files\Easeware\DriverEasy\DriverEasy.exe
Task: C:\Windows\Tasks\GlaryInitialize.job => C:\Program Files (x86)\Glary Utilities\initialize.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\ROC_REG_JAN_DELETE.job => C:\ProgramData\AVG January 2013 Campaign\ROC.exe
==================== Loaded Modules (whitelisted) =============
2011-12-10 01:52 - 2011-03-30 20:02 - 00264200 _____ () C:\Program Files\Agnitum\Outpost Security Suite Free\w7_gui.dll
2011-12-10 01:52 - 2009-12-03 09:28 - 00270336 _____ () C:\Program Files\Agnitum\Outpost Security Suite Free\unrar.dll
2011-12-10 01:52 - 2009-12-03 09:28 - 00243200 _____ () C:\Program Files\Agnitum\Outpost Security Suite Free\zlib.dll
2013-03-28 22:30 - 2013-03-28 22:30 - 00073728 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll
2013-07-16 15:53 - 2013-07-16 15:53 - 00218112 _____ () C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe
2013-03-28 22:30 - 2013-03-28 22:30 - 00103424 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2012-02-03 17:13 - 2010-04-05 21:55 - 00116104 _____ () C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE
2014-07-17 22:20 - 2014-07-17 22:20 - 00301152 _____ () C:\Program Files\AVAST Software\Avast\aswProperty.dll
2014-08-26 00:21 - 2014-08-26 00:21 - 02801152 _____ () C:\Program Files\AVAST Software\Avast\defs\14082501\algo.dll
2014-07-17 22:20 - 2014-07-17 22:20 - 19329904 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2013-07-16 15:49 - 2013-07-16 15:49 - 00221184 _____ () C:\Program Files (x86)\GNU\GnuPG\libksba-8.dll
2013-07-16 15:48 - 2013-07-16 15:48 - 00037888 _____ () C:\Program Files (x86)\GNU\GnuPG\libgpg-error-0.dll
2013-07-16 15:46 - 2013-07-16 15:46 - 00050176 _____ () C:\Program Files (x86)\GNU\GnuPG\libw32pth-0.dll
2013-07-16 15:49 - 2013-07-16 15:49 - 00069632 _____ () C:\Program Files (x86)\GNU\GnuPG\libassuan-0.dll
2013-07-16 15:50 - 2013-07-16 15:50 - 00627712 _____ () C:\Program Files (x86)\GNU\GnuPG\libgcrypt-11.dll
2014-08-10 16:35 - 2014-08-10 16:35 - 03800688 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2011-04-24 03:29 - 2011-04-24 03:29 - 00465640 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\sqlite3.dll
2011-04-24 03:29 - 2011-04-24 03:29 - 01081664 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\ACE.dll
2011-04-24 03:29 - 2011-04-24 03:29 - 00125760 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\MailConverter32.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\ProgramData\Temp:0B4227B4
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
MSCONFIG\startupreg: TkBellExe => "C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe" -osboot
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (08/26/2014 01:14:59 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/26/2014 00:21:23 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/25/2014 03:45:57 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/25/2014 03:20:01 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm chrome.exe, Version 36.0.1985.143 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 151c
Startzeit: 01cfc0672c17da2a
Endzeit: 141
Anwendungspfad: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Berichts-ID: 7ea35240-2c5a-11e4-9103-3860777a9ebe
Error: (08/25/2014 01:05:57 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/25/2014 07:56:50 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/24/2014 04:05:50 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/24/2014 02:19:46 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/24/2014 02:04:07 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/24/2014 01:05:29 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (08/26/2014 01:14:54 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%3
Error: (08/26/2014 01:14:54 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "LibUsb-Win32 - Daemon, Version 0.1.10.1" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (08/26/2014 01:13:57 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\drivers\libusb0.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
Error: (08/26/2014 00:21:15 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%3
Error: (08/26/2014 00:21:14 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "LibUsb-Win32 - Daemon, Version 0.1.10.1" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (08/26/2014 00:20:09 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\drivers\libusb0.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
Error: (08/25/2014 03:45:52 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%3
Error: (08/25/2014 03:45:50 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "LibUsb-Win32 - Daemon, Version 0.1.10.1" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (08/25/2014 03:44:49 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\drivers\libusb0.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
Error: (08/25/2014 01:05:49 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%3
Microsoft Office Sessions:
=========================
Error: (08/26/2014 01:14:59 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/26/2014 00:21:23 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/25/2014 03:45:57 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/25/2014 03:20:01 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: chrome.exe36.0.1985.143151c01cfc0672c17da2a141C:\Program Files (x86)\Google\Chrome\Application\chrome.exe7ea35240-2c5a-11e4-9103-3860777a9ebe
Error: (08/25/2014 01:05:57 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/25/2014 07:56:50 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/24/2014 04:05:50 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/24/2014 02:19:46 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/24/2014 02:04:07 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (08/24/2014 01:05:29 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
CodeIntegrity Errors:
===================================
Date: 2013-03-22 16:10:42.922
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Users\AlX\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-03-22 16:10:42.795
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Users\AlX\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-03-22 16:10:41.906
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-03-22 16:10:41.774
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Processor: AMD E-450 APU with Radeon(tm) HD Graphics
Percentage of memory in use: 26%
Total physical RAM: 7913.9 MB
Available physical RAM: 5845.23 MB
Total Pagefile: 15825.98 MB
Available Pagefile: 13592.83 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB
==================== Drives ================================
Drive c: (Acer) (Fixed) (Total:680.54 GB) (Free:601.82 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 698.6 GB) (Disk ID: 1F732B1D)
Partition 1: (Not Active) - (Size=18 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=680.5 GB) - (Type=07 NTFS)
==================== End Of Log ============================
defogger_disable by jpshortstuff (23.02.10.1) Log created at 01:22 on 26/08/2014 (AlX) Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers... -=E.O.F=- GMER Logfile: Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-08-26 02:00:58
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\00000070 ST975042 rev.0001 698,64GB
Running: qwfin87w.exe; Driver: C:\Users\AlX\AppData\Local\Temp\kfldrpow.sys
---- Kernel code sections - GMER 2.1 ----
.text C:\Windows\System32\win32k.sys!EngSetLastError + 152 fffff96000154e88 8 bytes [34, 26, 08, 04, 80, F8, FF, ...]
.text C:\Windows\System32\win32k.sys!EngSetLastError + 628 fffff96000155064 8 bytes [34, 16, 08, 04, 80, F8, FF, ...]
.text C:\Windows\System32\win32k.sys!W32pServiceTable fffff96000184200 7 bytes [00, A2, F3, FF, 01, B6, F0]
.text C:\Windows\System32\win32k.sys!W32pServiceTable + 8 fffff96000184208 3 bytes [C0, 06, 02]
.text ... * 106
.text C:\Windows\System32\win32k.sys!EngGetProcessHandle + 484 fffff960002432fc 6 bytes {JMP QWORD [RIP-0xba97a]}
.text C:\Windows\System32\win32k.sys!EngCTGetCurrentGamma + 32 fffff96000249780 14 bytes {JMP QWORD [RIP+0x0]}
.text C:\Windows\System32\win32k.sys!EngDeleteEvent + 32 fffff9600024d840 14 bytes {JMP QWORD [RIP+0x0]}
.text C:\Windows\System32\win32k.sys!FONTOBJ_pQueryGlyphAttrs + 720 fffff960002a5240 14 bytes {JMP QWORD [RIP+0x0]}
---- User code sections - GMER 2.1 ----
.text C:\Windows\system32\wininit.exe[600] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076bfef8d 1 byte [62]
.text C:\Windows\system32\wininit.exe[600] C:\Windows\system32\USER32.dll!UnregisterClassW + 212 0000000076ccd538 14 bytes {PUSH RAX; AND [RSI], ECX; ADD BYTE [RCX], 0x0; ADD [RAX], AL; JMP QWORD [RIP-0xe]}
.text C:\Windows\system32\wininit.exe[600] C:\Windows\system32\USER32.dll!SetWindowPos 0000000076cd3c50 6 bytes {JMP QWORD [RIP+0xa0]}
.text C:\Windows\system32\wininit.exe[600] C:\Windows\system32\USER32.dll!SetWindowPos + 166 0000000076cd3cf6 8 bytes [C0, 21, 0E, 80, 01, 00, 00, ...]
.text C:\Windows\system32\wininit.exe[600] C:\Windows\system32\USER32.dll!mouse_event + 212 0000000076ce3968 14 bytes [A0, 22, 0E, 80, 01, 00, 00, ...]
.text C:\Windows\system32\wininit.exe[600] C:\Windows\system32\USER32.dll!VkKeyScanW + 20 0000000076d106f8 14 bytes [10, 23, 0E, 80, 01, 00, 00, ...]
.text C:\Windows\system32\winlogon.exe[656] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076bfef8d 1 byte [62]
.text C:\Windows\system32\winlogon.exe[656] C:\Windows\system32\USER32.dll!UnregisterClassW + 212 0000000076ccd538 14 bytes {PUSH RAX; AND [RSI], ECX; ADD BYTE [RCX], 0x0; ADD [RAX], AL; JMP QWORD [RIP-0xe]}
.text C:\Windows\system32\winlogon.exe[656] C:\Windows\system32\USER32.dll!SetWindowPos 0000000076cd3c50 6 bytes {JMP QWORD [RIP+0xa0]}
.text C:\Windows\system32\winlogon.exe[656] C:\Windows\system32\USER32.dll!SetWindowPos + 166 0000000076cd3cf6 8 bytes [C0, 21, 0E, 80, 01, 00, 00, ...]
.text C:\Windows\system32\winlogon.exe[656] C:\Windows\system32\USER32.dll!mouse_event + 212 0000000076ce3968 14 bytes [A0, 22, 0E, 80, 01, 00, 00, ...]
.text C:\Windows\system32\winlogon.exe[656] C:\Windows\system32\USER32.dll!VkKeyScanW + 20 0000000076d106f8 14 bytes [10, 23, 0E, 80, 01, 00, 00, ...]
.text C:\Windows\system32\services.exe[680] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076bfef8d 1 byte [62]
.text C:\Windows\system32\services.exe[680] C:\Windows\system32\USER32.dll!UnregisterClassW + 212 0000000076ccd538 14 bytes {PUSH RAX; AND [RSI], ECX; ADD BYTE [RCX], 0x0; ADD [RAX], AL; JMP QWORD [RIP-0xe]}
.text C:\Windows\system32\services.exe[680] C:\Windows\system32\USER32.dll!SetWindowPos 0000000076cd3c50 6 bytes {JMP QWORD [RIP+0xa0]}
.text C:\Windows\system32\services.exe[680] C:\Windows\system32\USER32.dll!SetWindowPos + 166 0000000076cd3cf6 8 bytes [C0, 21, 0E, 80, 01, 00, 00, ...]
.text C:\Windows\system32\services.exe[680] C:\Windows\system32\USER32.dll!mouse_event + 212 0000000076ce3968 14 bytes [A0, 22, 0E, 80, 01, 00, 00, ...]
.text C:\Windows\system32\services.exe[680] C:\Windows\system32\USER32.dll!VkKeyScanW + 20 0000000076d106f8 14 bytes [10, 23, 0E, 80, 01, 00, 00, ...]
.text C:\Windows\system32\atiesrxx.exe[984] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076bfef8d 1 byte [62]
.text C:\Windows\System32\svchost.exe[356] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076bfef8d 1 byte [62]
.text C:\Windows\system32\svchost.exe[804] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076bfef8d 1 byte [62]
? C:\Windows\system32\tschannel.dll [804] entry point in ".rsrc" section 000007fefae86894
.text C:\Windows\system32\Dwm.exe[1444] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076bfef8d 1 byte [62]
.text C:\Windows\Explorer.EXE[1452] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076bfef8d 1 byte [62]
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[1764] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076bfef8d 1 byte [62]
.text C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[1784] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076bfef8d 1 byte [62]
.text C:\Windows\system32\taskhost.exe[1852] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076bfef8d 1 byte [62]
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1364] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076bfef8d 1 byte [62]
.text C:\Windows\system32\RunDll32.exe[1368] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076bfef8d 1 byte [62]
.text C:\Program Files (x86)\Launch Manager\LManager.exe[2212] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007623a2fd 1 byte [62]
.text C:\Program Files (x86)\Launch Manager\LManager.exe[2212] C:\Windows\syswow64\USER32.dll!SetWindowPos 00000000768b8e4e 5 bytes JMP 00000001005955a0
.text C:\Program Files (x86)\Launch Manager\LManager.exe[2212] C:\Windows\syswow64\USER32.dll!SetForegroundWindow 00000000768df170 1 byte JMP 0000000100595574
.text C:\Program Files (x86)\Launch Manager\LManager.exe[2212] C:\Windows\syswow64\USER32.dll!SetForegroundWindow + 2 00000000768df172 3 bytes {JMP QWORD [RBX-0x35]}
.text C:\Program Files (x86)\Launch Manager\LManager.exe[2212] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 00000000769007d7 5 bytes JMP 0000000100595624
.text C:\Program Files (x86)\Launch Manager\LManager.exe[2212] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExA 0000000076916da0 5 bytes JMP 00000001005955f8
.text C:\Program Files (x86)\Launch Manager\LManager.exe[2212] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000074a61465 2 bytes [A6, 74]
.text C:\Program Files (x86)\Launch Manager\LManager.exe[2212] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000074a614bb 2 bytes [A6, 74]
.text ... * 2
.text C:\Program Files\AVAST Software\Avast\avastui.exe[2244] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 0000000076218791 8 bytes [31, C0, C2, 04, 00, 90, 90, ...]
.text C:\Program Files\AVAST Software\Avast\avastui.exe[2244] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007623a2fd 1 byte [62]
.text C:\Program Files\AVAST Software\Avast\avastui.exe[2244] C:\Windows\syswow64\USER32.dll!SetWindowPos 00000000768b8e4e 5 bytes JMP 00000001100a55a0
.text C:\Program Files\AVAST Software\Avast\avastui.exe[2244] C:\Windows\syswow64\USER32.dll!SetForegroundWindow 00000000768df170 1 byte JMP 00000001100a5574
.text C:\Program Files\AVAST Software\Avast\avastui.exe[2244] C:\Windows\syswow64\USER32.dll!SetForegroundWindow + 2 00000000768df172 3 bytes {JMP QWORD [RBX+0x7c]}
.text C:\Program Files\AVAST Software\Avast\avastui.exe[2244] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 00000000769007d7 5 bytes JMP 00000001100a5624
.text C:\Program Files\AVAST Software\Avast\avastui.exe[2244] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExA 0000000076916da0 5 bytes JMP 00000001100a55f8
.text C:\Program Files\AVAST Software\Avast\avastui.exe[2244] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000074a61465 2 bytes [A6, 74]
.text C:\Program Files\AVAST Software\Avast\avastui.exe[2244] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000074a614bb 2 bytes [A6, 74]
.text ... * 2
.text C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe[2276] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007623a2fd 1 byte [62]
.text C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe[2276] C:\Windows\syswow64\USER32.dll!SetWindowPos 00000000768b8e4e 5 bytes JMP 00000001100a55a0
.text C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe[2276] C:\Windows\syswow64\USER32.dll!SetForegroundWindow 00000000768df170 1 byte JMP 00000001100a5574
.text C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe[2276] C:\Windows\syswow64\USER32.dll!SetForegroundWindow + 2 00000000768df172 3 bytes {JMP QWORD [RBX+0x7c]}
.text C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe[2276] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 00000000769007d7 5 bytes JMP 00000001100a5624
.text C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe[2276] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExA 0000000076916da0 5 bytes JMP 00000001100a55f8
.text C:\Program Files (x86)\PDF24\pdf24.exe[2332] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007623a2fd 1 byte [62]
.text C:\Program Files (x86)\PDF24\pdf24.exe[2332] C:\Windows\syswow64\USER32.dll!SetWindowPos 00000000768b8e4e 5 bytes JMP 00000001100a55a0
.text C:\Program Files (x86)\PDF24\pdf24.exe[2332] C:\Windows\syswow64\USER32.dll!SetForegroundWindow 00000000768df170 1 byte JMP 00000001100a5574
.text C:\Program Files (x86)\PDF24\pdf24.exe[2332] C:\Windows\syswow64\USER32.dll!SetForegroundWindow + 2 00000000768df172 3 bytes {JMP QWORD [RBX+0x7c]}
.text C:\Program Files (x86)\PDF24\pdf24.exe[2332] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 00000000769007d7 5 bytes JMP 00000001100a5624
.text C:\Program Files (x86)\PDF24\pdf24.exe[2332] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExA 0000000076916da0 5 bytes JMP 00000001100a55f8
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[2348] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007623a2fd 1 byte [62]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[2348] C:\Windows\syswow64\USER32.dll!SetWindowPos 00000000768b8e4e 5 bytes JMP 00000001100a55a0
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[2348] C:\Windows\syswow64\USER32.dll!SetForegroundWindow 00000000768df170 1 byte JMP 00000001100a5574
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[2348] C:\Windows\syswow64\USER32.dll!SetForegroundWindow + 2 00000000768df172 3 bytes {JMP QWORD [RBX+0x7c]}
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[2348] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 00000000769007d7 5 bytes JMP 00000001100a5624
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[2348] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExA 0000000076916da0 5 bytes JMP 00000001100a55f8
.text C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe[2572] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007623a2fd 1 byte [62]
.text C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe[2572] C:\Windows\syswow64\USER32.dll!SetWindowPos 00000000768b8e4e 5 bytes JMP 00000001100a55a0
.text C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe[2572] C:\Windows\syswow64\USER32.dll!SetForegroundWindow 00000000768df170 1 byte JMP 00000001100a5574
.text C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe[2572] C:\Windows\syswow64\USER32.dll!SetForegroundWindow + 2 00000000768df172 3 bytes {JMP QWORD [RBX+0x7c]}
.text C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe[2572] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 00000000769007d7 5 bytes JMP 00000001100a5624
.text C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe[2572] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExA 0000000076916da0 5 bytes JMP 00000001100a55f8
.text C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[2624] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076bfef8d 1 byte [62]
.text C:\Program Files (x86)\Launch Manager\dsiwmis.exe[3032] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007623a2fd 1 byte [62]
.text C:\Program Files (x86)\Launch Manager\dsiwmis.exe[3032] C:\Windows\syswow64\USER32.dll!SetWindowPos 00000000768b8e4e 5 bytes JMP 00000001100a55a0
.text C:\Program Files (x86)\Launch Manager\dsiwmis.exe[3032] C:\Windows\syswow64\USER32.dll!SetForegroundWindow 00000000768df170 1 byte JMP 00000001100a5574
.text C:\Program Files (x86)\Launch Manager\dsiwmis.exe[3032] C:\Windows\syswow64\USER32.dll!SetForegroundWindow + 2 00000000768df172 3 bytes {JMP QWORD [RBX+0x7c]}
.text C:\Program Files (x86)\Launch Manager\dsiwmis.exe[3032] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 00000000769007d7 5 bytes JMP 00000001100a5624
.text C:\Program Files (x86)\Launch Manager\dsiwmis.exe[3032] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExA 0000000076916da0 5 bytes JMP 00000001100a55f8
.text C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe[2196] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076bfef8d 1 byte [62]
.text C:\Program Files (x86)\Launch Manager\LMworker.exe[2148] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007623a2fd 1 byte [62]
.text C:\Program Files (x86)\Launch Manager\LMworker.exe[2148] C:\Windows\syswow64\USER32.dll!SetWindowPos 00000000768b8e4e 5 bytes JMP 00000001100a55a0
.text C:\Program Files (x86)\Launch Manager\LMworker.exe[2148] C:\Windows\syswow64\USER32.dll!SetForegroundWindow 00000000768df170 1 byte JMP 00000001100a5574
.text C:\Program Files (x86)\Launch Manager\LMworker.exe[2148] C:\Windows\syswow64\USER32.dll!SetForegroundWindow + 2 00000000768df172 3 bytes {JMP QWORD [RBX+0x7c]}
.text C:\Program Files (x86)\Launch Manager\LMworker.exe[2148] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 00000000769007d7 5 bytes JMP 00000001100a5624
.text C:\Program Files (x86)\Launch Manager\LMworker.exe[2148] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExA 0000000076916da0 5 bytes JMP 00000001100a55f8
.text C:\Program Files (x86)\Launch Manager\LMutilps32.exe[1344] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007623a2fd 1 byte [62]
.text C:\Program Files (x86)\Launch Manager\LMutilps32.exe[1344] C:\Windows\syswow64\USER32.dll!SetWindowPos 00000000768b8e4e 5 bytes JMP 00000001100a55a0
.text C:\Program Files (x86)\Launch Manager\LMutilps32.exe[1344] C:\Windows\syswow64\USER32.dll!SetForegroundWindow 00000000768df170 1 byte JMP 00000001100a5574
.text C:\Program Files (x86)\Launch Manager\LMutilps32.exe[1344] C:\Windows\syswow64\USER32.dll!SetForegroundWindow + 2 00000000768df172 3 bytes {JMP QWORD [RBX+0x7c]}
.text C:\Program Files (x86)\Launch Manager\LMutilps32.exe[1344] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 00000000769007d7 5 bytes JMP 00000001100a5624
.text C:\Program Files (x86)\Launch Manager\LMutilps32.exe[1344] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExA 0000000076916da0 5 bytes JMP 00000001100a55f8
.text C:\Program Files (x86)\Acer\Registration\GREGsvc.exe[2644] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007623a2fd 1 byte [62]
.text C:\Program Files (x86)\Acer\Registration\GREGsvc.exe[2644] C:\Windows\syswow64\USER32.dll!SetWindowPos 00000000768b8e4e 5 bytes JMP 00000001100a55a0
.text C:\Program Files (x86)\Acer\Registration\GREGsvc.exe[2644] C:\Windows\syswow64\USER32.dll!SetForegroundWindow 00000000768df170 1 byte JMP 00000001100a5574
.text C:\Program Files (x86)\Acer\Registration\GREGsvc.exe[2644] C:\Windows\syswow64\USER32.dll!SetForegroundWindow + 2 00000000768df172 3 bytes {JMP QWORD [RBX+0x7c]}
.text C:\Program Files (x86)\Acer\Registration\GREGsvc.exe[2644] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 00000000769007d7 5 bytes JMP 00000001100a5624
.text C:\Program Files (x86)\Acer\Registration\GREGsvc.exe[2644] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExA 0000000076916da0 5 bytes JMP 00000001100a55f8
.text C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[2240] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007623a2fd 1 byte [62]
.text C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[2240] C:\Windows\syswow64\USER32.dll!SetWindowPos 00000000768b8e4e 5 bytes JMP 00000001100a55a0
.text C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[2240] C:\Windows\syswow64\USER32.dll!SetForegroundWindow 00000000768df170 1 byte JMP 00000001100a5574
.text C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[2240] C:\Windows\syswow64\USER32.dll!SetForegroundWindow + 2 00000000768df172 3 bytes {JMP QWORD [RBX+0x7c]}
.text C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[2240] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 00000000769007d7 5 bytes JMP 00000001100a5624
.text C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[2240] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExA 0000000076916da0 5 bytes JMP 00000001100a55f8
.text C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[2240] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000074a61465 2 bytes [A6, 74]
.text C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE[2240] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000074a614bb 2 bytes [A6, 74]
.text ... * 2
.text C:\Program Files\Acer\Acer Updater\UpdaterService.exe[3212] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007623a2fd 1 byte [62]
.text C:\Program Files\Acer\Acer Updater\UpdaterService.exe[3212] C:\Windows\syswow64\USER32.dll!SetWindowPos 00000000768b8e4e 5 bytes JMP 00000001100a55a0
.text C:\Program Files\Acer\Acer Updater\UpdaterService.exe[3212] C:\Windows\syswow64\USER32.dll!SetForegroundWindow 00000000768df170 1 byte JMP 00000001100a5574
.text C:\Program Files\Acer\Acer Updater\UpdaterService.exe[3212] C:\Windows\syswow64\USER32.dll!SetForegroundWindow + 2 00000000768df172 3 bytes {JMP QWORD [RBX+0x7c]}
.text C:\Program Files\Acer\Acer Updater\UpdaterService.exe[3212] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 00000000769007d7 5 bytes JMP 00000001100a5624
.text C:\Program Files\Acer\Acer Updater\UpdaterService.exe[3212] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExA 0000000076916da0 5 bytes JMP 00000001100a55f8
.text C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe[3292] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007623a2fd 1 byte [62]
.text C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe[3292] C:\Windows\syswow64\USER32.dll!SetWindowPos 00000000768b8e4e 5 bytes JMP 00000001100a55a0
.text C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe[3292] C:\Windows\syswow64\USER32.dll!SetForegroundWindow 00000000768df170 1 byte JMP 00000001100a5574
.text C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe[3292] C:\Windows\syswow64\USER32.dll!SetForegroundWindow + 2 00000000768df172 3 bytes {JMP QWORD [RBX+0x7c]}
.text C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe[3292] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 00000000769007d7 5 bytes JMP 00000001100a5624
.text C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe[3292] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExA 0000000076916da0 5 bytes JMP 00000001100a55f8
.text C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe[3292] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000074a61465 2 bytes [A6, 74]
.text C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe[3292] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000074a614bb 2 bytes [A6, 74]
.text ... * 2
.text C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe[3488] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007623a2fd 1 byte [62]
.text C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe[3488] C:\Windows\syswow64\USER32.dll!SetWindowPos 00000000768b8e4e 5 bytes JMP 00000001100a55a0
.text C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe[3488] C:\Windows\syswow64\USER32.dll!SetForegroundWindow 00000000768df170 1 byte JMP 00000001100a5574
.text C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe[3488] C:\Windows\syswow64\USER32.dll!SetForegroundWindow + 2 00000000768df172 3 bytes {JMP QWORD [RBX+0x7c]}
.text C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe[3488] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 00000000769007d7 5 bytes JMP 00000001100a5624
.text C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe[3488] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExA 0000000076916da0 5 bytes JMP 00000001100a55f8
.text C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe[3488] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000074a61465 2 bytes [A6, 74]
.text C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe[3488] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 0000000074a614bb 2 bytes [A6, 74]
.text ... * 2
.text C:\Windows\system32\wbem\unsecapp.exe[3752] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076bfef8d 1 byte [62]
.text C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe[4148] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 0000000076bfef8d 1 byte [62]
.text C:\Users\AlX\Downloads\qwfin87w.exe[3012] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 000000007623a2fd 1 byte [62]
.text C:\Users\AlX\Downloads\qwfin87w.exe[3012] C:\Windows\syswow64\USER32.dll!SetWindowPos 00000000768b8e4e 5 bytes JMP 00000001100a55a0
.text C:\Users\AlX\Downloads\qwfin87w.exe[3012] C:\Windows\syswow64\USER32.dll!SetForegroundWindow 00000000768df170 1 byte JMP 00000001100a5574
.text C:\Users\AlX\Downloads\qwfin87w.exe[3012] C:\Windows\syswow64\USER32.dll!SetForegroundWindow + 2 00000000768df172 3 bytes {JMP QWORD [RBX+0x7c]}
.text C:\Users\AlX\Downloads\qwfin87w.exe[3012] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 00000000769007d7 5 bytes JMP 00000001100a5624
.text C:\Users\AlX\Downloads\qwfin87w.exe[3012] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExA 0000000076916da0 5 bytes JMP 00000001100a55f8
---- EOF - GMER 2.1 ----
Ich hoffe das ist alles soweit richtig. Noch einmal vielen Dank. Toll, dass es euch gibt. Gruß AlX |
|
26.08.2014, 06:08
| #2 |
| /// the machine /// TB-Ausbilder    | Trojan.Kazy!WvUyTGribrg (trojan) in AdobeARM.exe hi,
__________________Scan mit Combofix
__________________ |
|
26.08.2014, 13:52
| #3 |
| | Trojan.Kazy!WvUyTGribrg (trojan) in AdobeARM.exe Vielen Dank für die schnelle Antwort.
__________________Ich bin den Anweisungen gefolgt und füge nachstehend die Ergebnisse von combofix ein. Die Fehlermeldung bezüglich Regsitrierungsschlüssel erschien nicht. Verzeih mein Unwissen, aber ich weiß nicht, wie ich CODE-Tags verwende. Ich finde es aber bis zum nächsten Post heraus. Combofix Logfile: Code:
ATTFilter ComboFix 14-08-24.01 - AlX 26.08.2014 14:09:22.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.7914.5937 [GMT 2:00]
ausgeführt von:: c:\users\AlX\Downloads\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AV: Outpost Security Suite *Disabled/Updated* {ECEA6BCD-A007-0BC7-D5A5-0254DCBD816E}
FW: Outpost Security Suite *Disabled* {D4D1EAE8-EA68-0A9F-FEFA-AB61226EC615}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Outpost Security Suite *Disabled/Updated* {578B8A29-863D-0449-EF15-3926A73ACBD3}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\install.exe
c:\windows\wininit.ini
.
.
((((((((((((((((((((((((((((((((((((((( Treiber/Dienste )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_ACEDRV11
-------\Service_acedrv11
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-07-26 bis 2014-08-26 ))))))))))))))))))))))))))))))
.
.
2014-08-26 12:22 . 2014-08-26 12:22 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-08-25 23:24 . 2014-08-25 23:40 -------- d-----w- C:\FRST
2014-08-25 22:18 . 2014-08-25 22:18 -------- d-----w- c:\users\AlX\AppData\Roaming\TrojanHunter
2014-08-25 15:06 . 2014-08-25 15:06 -------- d-----w- c:\users\AlX\AppData\Roaming\KeePass
2014-08-25 13:54 . 2014-08-25 13:54 -------- d-----w- c:\program files (x86)\KeePass Password Safe
2014-08-25 13:52 . 2014-08-25 13:58 -------- d-----w- c:\programdata\TrojanHunter
2014-08-25 13:52 . 2014-08-25 13:59 -------- d-----w- c:\program files (x86)\TrojanHunter 5.6
2014-08-21 07:48 . 2014-05-14 16:23 44512 ----a-w- c:\windows\system32\wups2.dll
2014-08-21 07:48 . 2014-05-14 16:23 58336 ----a-w- c:\windows\system32\wuauclt.exe
2014-08-21 07:48 . 2014-05-14 16:23 2477536 ----a-w- c:\windows\system32\wuaueng.dll
2014-08-21 07:48 . 2014-05-14 16:21 2620928 ----a-w- c:\windows\system32\wucltux.dll
2014-08-21 07:47 . 2014-05-14 16:23 38880 ----a-w- c:\windows\system32\wups.dll
2014-08-21 07:47 . 2014-05-14 16:23 36320 ----a-w- c:\windows\SysWow64\wups.dll
2014-08-21 07:47 . 2014-05-14 16:23 700384 ----a-w- c:\windows\system32\wuapi.dll
2014-08-21 07:47 . 2014-05-14 16:23 581600 ----a-w- c:\windows\SysWow64\wuapi.dll
2014-08-21 07:47 . 2014-05-14 16:20 97792 ----a-w- c:\windows\system32\wudriver.dll
2014-08-21 07:47 . 2014-05-14 16:17 92672 ----a-w- c:\windows\SysWow64\wudriver.dll
2014-08-21 07:47 . 2014-05-14 07:23 179656 ----a-w- c:\windows\SysWow64\wuwebv.dll
2014-08-21 07:47 . 2014-05-14 07:23 198600 ----a-w- c:\windows\system32\wuwebv.dll
2014-08-21 07:47 . 2014-05-14 07:20 36864 ----a-w- c:\windows\system32\wuapp.exe
2014-08-21 07:47 . 2014-05-14 07:17 33792 ----a-w- c:\windows\SysWow64\wuapp.exe
2014-08-13 18:15 . 2014-03-09 21:48 171160 ----a-w- c:\windows\system32\infocardapi.dll
2014-08-13 18:15 . 2014-03-09 21:48 1389208 ----a-w- c:\windows\system32\icardagt.exe
2014-08-13 18:15 . 2014-03-09 21:47 99480 ----a-w- c:\windows\SysWow64\infocardapi.dll
2014-08-13 18:15 . 2014-03-09 21:47 619672 ----a-w- c:\windows\SysWow64\icardagt.exe
2014-08-13 18:15 . 2014-06-30 22:24 8856 ----a-w- c:\windows\system32\icardres.dll
2014-08-13 18:15 . 2014-06-30 22:14 8856 ----a-w- c:\windows\SysWow64\icardres.dll
2014-08-13 18:14 . 2014-06-06 06:16 35480 ----a-w- c:\windows\SysWow64\TsWpfWrp.exe
2014-08-13 18:14 . 2014-06-06 06:12 35480 ----a-w- c:\windows\system32\TsWpfWrp.exe
2014-08-13 14:44 . 2014-07-25 13:00 111616 ----a-w- c:\windows\system32\ieetwcollector.exe
2014-08-13 14:43 . 2014-07-14 02:02 1216000 ----a-w- c:\windows\system32\rpcrt4.dll
2014-08-13 14:43 . 2014-07-14 01:40 664064 ----a-w- c:\windows\SysWow64\rpcrt4.dll
2014-08-13 14:43 . 2014-08-07 02:06 529920 ----a-w- c:\windows\system32\aepdu.dll
2014-08-13 14:43 . 2014-08-07 02:01 424448 ----a-w- c:\windows\system32\aeinv.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-08-25 22:15 . 2014-07-08 13:26 122584 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-08-13 18:22 . 2011-12-09 20:31 99218768 ----a-w- c:\windows\system32\MRT.exe
2014-07-25 20:24 . 2014-07-25 20:24 111016 ----a-w- c:\windows\system32\WindowsAccessBridge-64.dll
2014-07-25 20:24 . 2014-07-25 20:25 319912 ----a-w- c:\windows\system32\javaws.exe
2014-07-25 20:24 . 2014-07-25 20:24 189352 ----a-w- c:\windows\system32\javaw.exe
2014-07-25 20:24 . 2014-07-25 20:24 189352 ----a-w- c:\windows\system32\java.exe
2014-07-17 20:21 . 2013-12-16 09:54 427360 ----a-w- c:\windows\system32\drivers\aswsp.sys
2014-07-17 20:20 . 2014-05-06 10:22 29208 ----a-w- c:\windows\system32\drivers\aswHwid.sys
2014-07-17 20:20 . 2014-01-04 19:07 92008 ----a-w- c:\windows\system32\drivers\aswstm.sys
2014-07-17 20:20 . 2013-12-16 09:56 224896 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2014-07-17 20:20 . 2013-12-16 09:55 65776 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2014-07-17 20:20 . 2013-12-16 09:55 1041168 ----a-w- c:\windows\system32\drivers\aswsnx.sys
2014-07-17 20:20 . 2013-12-16 09:54 79184 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2014-07-17 20:20 . 2013-12-16 09:54 93568 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2014-07-17 20:20 . 2013-12-16 09:54 307344 ----a-w- c:\windows\system32\aswBoot.exe
2014-07-17 20:20 . 2014-07-17 20:20 43152 ----a-w- c:\windows\avastSS.scr
2014-07-08 15:01 . 2012-05-10 05:56 699056 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-07-08 15:01 . 2011-07-26 13:30 71344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-06-18 02:18 . 2014-07-09 12:26 692736 ----a-w- c:\windows\system32\osk.exe
2014-06-18 01:51 . 2014-07-09 12:26 646144 ----a-w- c:\windows\SysWow64\osk.exe
2014-06-06 10:10 . 2014-07-09 12:25 624128 ----a-w- c:\windows\system32\qedit.dll
2014-06-06 09:44 . 2014-07-09 12:25 509440 ----a-w- c:\windows\SysWow64\qedit.dll
2014-06-05 14:45 . 2014-07-09 12:27 1460736 ----a-w- c:\windows\system32\lsasrv.dll
2014-06-05 14:26 . 2014-07-09 12:27 22016 ----a-w- c:\windows\SysWow64\secur32.dll
2014-06-05 14:25 . 2014-07-09 12:27 96768 ----a-w- c:\windows\SysWow64\sspicli.dll
2014-05-30 08:08 . 2014-07-09 12:25 210944 ----a-w- c:\windows\system32\wdigest.dll
2014-05-30 08:08 . 2014-07-09 12:25 86528 ----a-w- c:\windows\system32\TSpkg.dll
2014-05-30 08:08 . 2014-07-09 12:25 340992 ----a-w- c:\windows\system32\schannel.dll
2014-05-30 08:08 . 2014-07-09 12:25 314880 ----a-w- c:\windows\system32\msv1_0.dll
2014-05-30 08:08 . 2014-07-09 12:25 307200 ----a-w- c:\windows\system32\ncrypt.dll
2014-05-30 08:08 . 2014-07-09 12:25 728064 ----a-w- c:\windows\system32\kerberos.dll
2014-05-30 08:08 . 2014-07-09 12:25 22016 ----a-w- c:\windows\system32\credssp.dll
2014-05-30 07:52 . 2014-07-09 12:25 172032 ----a-w- c:\windows\SysWow64\wdigest.dll
2014-05-30 07:52 . 2014-07-09 12:25 65536 ----a-w- c:\windows\SysWow64\TSpkg.dll
2014-05-30 07:52 . 2014-07-09 12:25 247808 ----a-w- c:\windows\SysWow64\schannel.dll
2014-05-30 07:52 . 2014-07-09 12:25 220160 ----a-w- c:\windows\SysWow64\ncrypt.dll
2014-05-30 07:52 . 2014-07-09 12:25 259584 ----a-w- c:\windows\SysWow64\msv1_0.dll
2014-05-30 07:52 . 2014-07-09 12:25 550912 ----a-w- c:\windows\SysWow64\kerberos.dll
2014-05-30 07:52 . 2014-07-09 12:25 17408 ----a-w- c:\windows\SysWow64\credssp.dll
2014-05-30 06:45 . 2014-07-09 12:25 497152 ----a-w- c:\windows\system32\drivers\afd.sys
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2011-07-01 1103440]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2013-03-28 642656]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2014-08-10 4085896]
"HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2011-03-24 49208]
"PDFPrint"="c:\program files (x86)\PDF24\pdf24.exe" [2014-06-04 191528]
"THGuard"="c:\program files (x86)\TrojanHunter 5.6\THGuard.exe" [2014-07-30 1081808]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"IsMyWinLockerReboot"="msiexec.exe" [2010-11-21 73216]
.
c:\users\AlX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Tintenwarnungen überwachen - HP Officejet 6100 (Netzwerk).lnk - c:\windows\system32\RunDll32.exe "c:\program files\HP\HP Officejet 6100\bin\HPStatusBL.dll",RunDLLEntry SERIALNUMBER=CN29S3RM7105KR;CONNECTION=NW;MONITOR=1; [2009-7-14 45568]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
p6_19_erinnerung.lnk - c:\program files (x86)\phase6\phase6_19\WinStart\WinStart.exe [2007-2-11 49152]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"AppInit_DLLs"=c:\progra~1\Agnitum\OUTPOS~1\wl_hook.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-disabled]
"BackupManagerTray"="c:\program files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe" -h -k
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"HP Software Update"=c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 libusbd;LibUsb-Win32 - Daemon, Version 0.1.10.1;c:\windows\system32\libusbd-nt.exe;c:\windows\SYSNATIVE\libusbd-nt.exe [x]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service; [x]
R3 CGVPNCliSrvc;CyberGhost VPN Client;c:\program files\CyberGhost VPN\CGVPNCliService.exe;c:\program files\CyberGhost VPN\CGVPNCliService.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;c:\windows\system32\drivers\libusb0.sys;c:\windows\SYSNATIVE\drivers\libusb0.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 SWDUMon;SWDUMon;c:\windows\system32\DRIVERS\SWDUMon.sys;c:\windows\SYSNATIVE\DRIVERS\SWDUMon.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
S0 amd_sata;amd_sata;c:\windows\system32\DRIVERS\amd_sata.sys;c:\windows\SYSNATIVE\DRIVERS\amd_sata.sys [x]
S0 amd_xata;amd_xata;c:\windows\system32\DRIVERS\amd_xata.sys;c:\windows\SYSNATIVE\DRIVERS\amd_xata.sys [x]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S1 afw;Agnitum Firewall Driver;c:\windows\system32\DRIVERS\afw.sys;c:\windows\SYSNATIVE\DRIVERS\afw.sys [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]
S1 SandBox;SandBox;c:\windows\system32\drivers\SandBox64.sys;c:\windows\SYSNATIVE\drivers\SandBox64.sys [x]
S2 acssrv;Agnitum Client Security Service;c:\progra~1\Agnitum\OUTPOS~1\acs.exe;c:\progra~1\Agnitum\OUTPOS~1\acs.exe [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x]
S2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys;c:\windows\SYSNATIVE\drivers\aswHwid.sys [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x]
S2 DirMngr;DirMngr;c:\program files (x86)\GNU\GnuPG\dirmngr.exe;c:\program files (x86)\GNU\GnuPG\dirmngr.exe [x]
S2 DsiWMIService;Dritek WMI Service;c:\program files (x86)\Launch Manager\dsiwmis.exe;c:\program files (x86)\Launch Manager\dsiwmis.exe [x]
S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [x]
S2 GREGService;GREGService;c:\program files (x86)\Acer\Registration\GREGsvc.exe;c:\program files (x86)\Acer\Registration\GREGsvc.exe [x]
S2 Live Updater Service;Live Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe;c:\program files\Acer\Acer Updater\UpdaterService.exe [x]
S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe;c:\program files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [x]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [x]
S3 afwcore;afwcore;c:\windows\system32\drivers\afwcore.sys;c:\windows\SYSNATIVE\drivers\afwcore.sys [x]
S3 ASWFilt;ASWFilt;c:\windows\system32\Filt\ASWFilt64.dll;c:\windows\SYSNATIVE\Filt\ASWFilt64.dll [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
S3 L1C;NDIS Miniport Driver for Qualcomm Atheros AR81xx PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C60x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C60x64.sys [x]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\System32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys;c:\windows\SYSNATIVE\DRIVERS\usbfilter.sys [x]
S3 VBEngNT;VBEngNT;c:\windows\system32\drivers\VBEngNT.sys;c:\windows\SYSNATIVE\drivers\VBEngNT.sys [x]
S3 VBFilt;VBFilt;c:\windows\system32\Filt\VBFilt64.dll;c:\windows\SYSNATIVE\Filt\VBFilt64.dll [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
*Deregistered* - VBCoreNT.0
.
Inhalt des "geplante Tasks" Ordners
.
2014-08-26 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-10 15:01]
.
2013-07-01 c:\windows\Tasks\DriverEasy Scheduled Scan.job
- c:\program files\Easeware\DriverEasy\DriverEasy.exe [2013-06-30 10:39]
.
2014-08-26 c:\windows\Tasks\GlaryInitialize.job
- c:\program files (x86)\Glary Utilities\initialize.exe [2013-07-13 14:51]
.
2013-01-21 c:\windows\Tasks\ROC_REG_JAN_DELETE.job
- c:\programdata\AVG January 2013 Campaign\ROC.exe [2013-01-21 21:16]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2014-07-17 20:20 634872 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Outpost]
@="{33C9E362-3EDA-4930-8AFE-5DA39A8BB77A}"
[HKEY_CLASSES_ROOT\CLSID\{33C9E362-3EDA-4930-8AFE-5DA39A8BB77A}]
2011-03-30 18:02 601528 ----a-w- c:\program files\Agnitum\Outpost Security Suite Free\op_shell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Power Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2011-05-10 1831528]
"OutpostMonitor"="c:\progra~1\Agnitum\OUTPOS~1\op_mon.exe" [2011-04-04 4510072]
"OutpostFeedBack"="c:\program files\Agnitum\Outpost Security Suite Free\feedback.exe" [2011-03-30 808064]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2000-01-01 12921488]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\progra~1\Agnitum\OUTPOS~1\wl_hook64.dll
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = about:blank
uLocal Page = c:\windows\system32\blank.htm
uInternet Settings,ProxyServer = 127.0.0.1:9666
uInternet Settings,ProxyOverride = 127.0.0.1
IE: {{92808042-fb78-4fa0-bb4f-c9a95e0e9c10} - {ba696155-d96e-4281-b467-0367a0456474} -
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\
FF - prefs.js: browser.startup.homepage - hxxps://startpage.com/do/search
FF - prefs.js: network.proxy.type - 0
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Toolbar-{ba696155-d96e-4281-b467-0367a0456474} - (no file)
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.8.150\SSScheduler.exe
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_14_0_0_145_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_14_0_0_145_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_14_0_0_145_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_14_0_0_145_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.14"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Launch Manager\LMworker.exe
c:\program files (x86)\Launch Manager\LMutilps32.exe
c:\program files (x86)\Canon\IJPLM\IJPLMSVC.EXE
.
**************************************************************************
.
Zeit der Fertigstellung: 2014-08-26 14:39:35 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2014-08-26 12:39
.
Vor Suchlauf: 14 Verzeichnis(se), 645.907.591.168 Bytes frei
Nach Suchlauf: 20 Verzeichnis(se), 645.362.376.704 Bytes frei
.
- - End Of File - - BCCC9FA6871B576060F5AC00BE3513AF
A36C5E4F47E84449FF07ED3517B43A31 Vielen Dank. |
|
27.08.2014, 10:02
| #4 |
| /// the machine /// TB-Ausbilder | Trojan.Kazy!WvUyTGribrg (trojan) in AdobeARM.exe Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
27.08.2014, 17:54
| #5 |
| | Trojan.Kazy!WvUyTGribrg (trojan) in AdobeARM.exe Lieber Schrauber (ich hoffe das "du" ist in Ordnung), vielen Dank für die schnelle Antwort und den support. Ich habe deine Anleitungen abgearbeitet und füge im Folgenden die Ergebnisse ein. Ich bin mir lediglich in einem Punkt nicht sicher. Du hast bei den ersten Analyseschritten geschrieben, dass ich jegliche Sicherheitssoftware deaktivieren soll. Beim letzten Post stand das nicht mehr. Dementsprechend habe ich sie nicht mehr ausgeschaltet. Beim Durchlauf von JRT hat mein avast-Dateischutzsystem (während JRT "checking modules" ausgab) eine Datei blockiert (kf2I17qo.vbt im Ordner C:\windows\system32\Filt\TMP). Dieser Ordner enthält eine weitere Datei, die avast in Quarantäne verschoben hat (izlg8f37.vbt). Zudem sind noch sieben weitere Viren im Quarantäneordner, die allesamt aus dem Verzeichnis C:\Users\AlX\AppData\Local\Temp entnommen sind. Was soll ich damit machen und soll ich die Scans nocheinmal laufen lassen, weil Sicherheitssoftware aktiviert war? malwarebytes hat nichts gefunden. Nachfolgend das Log: Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 27.08.2014 Suchlauf-Zeit: 17:05:03 Logdatei: malwarebytes.txt Administrator: Ja Version: 2.00.2.1012 Malware Datenbank: v2014.08.27.04 Rootkit Datenbank: v2014.08.21.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Self-protection: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: AlX Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 318270 Verstrichene Zeit: 29 Min, 5 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Aktiviert Heuristics: Aktiviert PUP: Warnen PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 0 (No malicious items detected) Registrierungswerte: 0 (No malicious items detected) Registrierungsdaten: 0 (No malicious items detected) Ordner: 0 (No malicious items detected) Dateien: 0 (No malicious items detected) Physische Sektoren: 0 (No malicious items detected) (end) Der adwcleaner gab mir folgendes aus: AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v3.010 - Bericht erstellt am 02/11/2013 um 17:39:05
# Updated 20/10/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : AlX - ALX-PC
# Gestartet von : C:\Users\AlX\Downloads\adwcleaner-3.010.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\Program Files (x86)\Common Files\DVDVideoSoft\TB
Ordner Gelöscht : C:\Users\AlX\AppData\LocalLow\HomeTab
Ordner Gelöscht : C:\Users\AlX\AppData\LocalLow\SimplyTech
Ordner Gelöscht : C:\Users\AlX\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\AlX\AppData\Roaming\OpenCandy
Datei Gelöscht : C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\foxydeal.sqlite
Datei Gelöscht : C:\Windows\System32\Tasks\Browser Updater
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\fgibjgmnimooanbagcfpnkmngejcojaf
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\HomeTab_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\HomeTab_RASMANCS
[x] Nicht Gelöscht : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8DA8B89E-0C65-403B-8231-AB22ECFA0687}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A928E66C-F501-4E66-9953-855C712F93B2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B0E28FA0-DF07-44B6-95CE-48BE26DB9266}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E6B4EE8F-C38E-4994-BE28-229A3F92262C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FCA8936E-403A-4487-A966-70F80F1D5A6A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{BA696155-D96E-4281-B467-0367A0456474}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{8DA8B89E-0C65-403B-8231-AB22ECFA0687}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A928E66C-F501-4E66-9953-855C712F93B2}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B0E28FA0-DF07-44B6-95CE-48BE26DB9266}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E6B4EE8F-C38E-4994-BE28-229A3F92262C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{FCA8936E-403A-4487-A966-70F80F1D5A6A}
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\powerpack
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\simplytech
Schlüssel Gelöscht : HKLM\Software\AVG Secure Search
***** [ Browser ] *****
-\\ Internet Explorer v9.0.8112.16514
-\\ Mozilla Firefox v24.0 (de)
[ Datei : C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\prefs.js ]
*************************
AdwCleaner[R0].txt - [3705 octets] - [02/11/2013 17:35:47]
AdwCleaner[S0].txt - [3435 octets] - [02/11/2013 17:39:05]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [3495 octets] ##########
AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v3.308 - Bericht erstellt am 27/08/2014 um 17:39:53
# Aktualisiert 20/08/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : AlX - ALX-PC
# Gestartet von : C:\Users\AlX\Documents\Desktop\adwcleaner_3.308.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\Program Files (x86)\Common Files\DVDVideoSoft\TB
Datei Gelöscht : C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\foxydeal.sqlite
***** [ Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\bopakagnckmlgajfccecajhnimjiiedh
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\fgibjgmnimooanbagcfpnkmngejcojaf
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{74F475FA-6C75-43BD-AAB9-ECDA6184F600}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\avg-secure-search-installer_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\avg-secure-search-installer_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\HomeTab_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\HomeTab_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00B11DA2-75ED-4364-ABA5-9A95B1F5E946}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8DA8B89E-0C65-403B-8231-AB22ECFA0687}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A928E66C-F501-4E66-9953-855C712F93B2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B0E28FA0-DF07-44B6-95CE-48BE26DB9266}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E6B4EE8F-C38E-4994-BE28-229A3F92262C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FCA8936E-403A-4487-A966-70F80F1D5A6A}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{BA696155-D96E-4281-B467-0367A0456474}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{8DA8B89E-0C65-403B-8231-AB22ECFA0687}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A928E66C-F501-4E66-9953-855C712F93B2}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B0E28FA0-DF07-44B6-95CE-48BE26DB9266}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E6B4EE8F-C38E-4994-BE28-229A3F92262C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{FCA8936E-403A-4487-A966-70F80F1D5A6A}
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Uniblue
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17239
-\\ Mozilla Firefox v31.0 (x86 de)
[ Datei : C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\prefs.js ]
Zeile gelöscht : user_pref("extensions.proxytool.referers", "www.google.com,google.com,yahoo.com,bing.com,ask.com,currate.com,alwaysmath.com,facebook.com,twitter.com,craigslist.org");
Zeile gelöscht : user_pref("extensions.toolbar.mindspark.lastInstalled", "allin1convert@mindspark.com");
*************************
AdwCleaner[R0].txt - [7278 octets] - [02/11/2013 18:35:47]
AdwCleaner[S0].txt - [6971 octets] - [02/11/2013 18:39:05]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [7031 octets] ##########
[/code] Und hier das Log von JRT Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Home Premium x64
Ran by AlX on 27.08.2014 at 17:45:13,84
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\APNSetup1_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\APNSetup1_RASMANCS
~~~ Files
~~~ Folders
Successfully deleted: [Empty Folder] C:\Users\AlX\appdata\local\{2376BFA2-BF50-41A0-BB86-94B699E93328}
Successfully deleted: [Empty Folder] C:\Users\AlX\appdata\local\{4DC81CFE-09B3-4A7C-834F-BE86549CEF81}
Successfully deleted: [Empty Folder] C:\Users\AlX\appdata\local\{64999DAE-A70B-4204-B846-B5FDE239B5C7}
Successfully deleted: [Empty Folder] C:\Users\AlX\appdata\local\{7FDA7B72-DFFA-4859-9E0B-E85AC4C899E5}
Successfully deleted: [Empty Folder] C:\Users\AlX\appdata\local\{8EDDEC17-B974-4CA0-998F-3A09F9EAB114}
Successfully deleted: [Empty Folder] C:\Users\AlX\appdata\local\{96473F0F-C04F-4398-8650-67D79DC18C5E}
Successfully deleted: [Empty Folder] C:\Users\AlX\appdata\local\{AC5EC3E7-3866-424D-8AC3-B2B568B32D1E}
Successfully deleted: [Empty Folder] C:\Users\AlX\appdata\local\{B88E9DC0-AC13-4088-A3D8-939094355C76}
Successfully deleted: [Empty Folder] C:\Users\AlX\appdata\local\{C323AA71-E4FA-459D-9A6B-8700878A3922}
Successfully deleted: [Empty Folder] C:\Users\AlX\appdata\local\{EA2DD0F7-256A-4C69-AEEF-E71BE3C83E79}
Successfully deleted: [Empty Folder] C:\Users\AlX\appdata\local\{F7F1C4ED-F97B-4E13-8704-055F4682CF71}
~~~ FireFox
Emptied folder: C:\Users\AlX\AppData\Roaming\mozilla\firefox\profiles\ca5205je.default\minidumps [441 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 27.08.2014 at 18:39:21,46
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Und ein frisches FRST log: FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-08-2014 01
Ran by AlX (administrator) on ALX-PC on 27-08-2014 18:44:49
Running from C:\Users\AlX\Downloads
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(Agnitum Ltd.) C:\Program Files\Agnitum\Outpost Security Suite Free\op_mon.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Agnitum Ltd.) C:\Program Files\Agnitum\Outpost Security Suite Free\acs.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Mischel Internet Security) C:\Program Files (x86)\TrojanHunter 5.6\THGuard.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
() C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
() C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
(Safer Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2723624 2011-03-28] (Synaptics Incorporated)
HKLM\...\Run: [Power Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [1831528 2011-05-10] (Acer Incorporated)
HKLM\...\Run: [OutpostMonitor] => C:\Program Files\Agnitum\Outpost Security Suite Free\op_mon.exe [4510072 2011-04-04] (Agnitum Ltd.)
HKLM\...\Run: [OutpostFeedBack] => C:\Program Files\Agnitum\Outpost Security Suite Free\feedback.exe [808064 2011-03-30] (Agnitum Ltd.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12921488 2000-01-01] (Realtek Semiconductor)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1103440 2011-07-01] (Dritek System Inc.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642656 2013-03-28] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [4085896 2014-08-10] (AVAST Software)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2011-03-24] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [191528 2014-06-04] (Geek Software GmbH)
HKLM-x32\...\Run: [THGuard] => C:\Program Files (x86)\TrojanHunter 5.6\THGuard.exe [1081808 2014-07-30] (Mischel Internet Security)
HKU\.DEFAULT\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-21-3429764466-1293764708-2967138861-1001\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
AppInit_DLLs: c:\PROGRA~1\Agnitum\OUTPOS~1\wl_hook64.dll => c:\Program Files\Agnitum\Outpost Security Suite Free\wl_hook64.dll [983664 2011-03-30] (Agnitum Ltd.)
AppInit_DLLs-x32: c:\PROGRA~1\Agnitum\OUTPOS~1\wl_hook.dll => c:\Program Files\Agnitum\Outpost Security Suite Free\wl_hook.dll [701456 2011-03-30] (Agnitum Ltd.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\p6_19_erinnerung.lnk
ShortcutTarget: p6_19_erinnerung.lnk -> C:\Program Files (x86)\phase6\phase6_19\WinStart\WinStart.exe (phase6)
Startup: C:\Users\AlX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Officejet 6100 (Netzwerk).lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Officejet 6100 (Netzwerk).lnk -> C:\Program Files\HP\HP Officejet 6100\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)
ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: Outpost -> {33C9E362-3EDA-4930-8AFE-5DA39A8BB77A} => C:\Program Files\Agnitum\Outpost Security Suite Free\op_shell.dll (Agnitum Ltd.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
ProxyServer: 127.0.0.1:9666
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: No Name -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> No File
BHO-x32: Spybot-S&D IE Protection -> {53707962-6F74-2D53-2644-206D7942484F} -> C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
BHO-x32: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre8\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre8\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
FireFox:
========
FF ProfilePath: C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default
FF Homepage: https://startpage.com/do/search
FF NetworkProxy: "socks_version", 4
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=11.5.2 -> C:\Program Files (x86)\Java\jre8\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.5.2 -> C:\Program Files (x86)\Java\jre8\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @protectdisc.com/NPPDLicenseHelper -> C:\Program Files (x86)\ProtectDisc\License Helper\NPPDLicenseHelper.dll ()
FF Plugin-x32: @real.com/nppl3260;version=15.0.6.14 -> C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprjplug;version=15.0.6.14 -> C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpchromebrowserrecordext;version=15.0.6.14 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprphtml5videoshim;version=15.0.6.14 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=15.0.6.14 -> C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\searchplugins\ixquick-https---deutsch.xml
FF SearchPlugin: C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\searchplugins\nation-secure-search.xml
FF SearchPlugin: C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\searchplugins\startpage-https---deutsch.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: ProxTube - Unblock YouTube - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\ich@maltegoetz.de [2014-01-26]
FF Extension: YouTube Unblocker - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\youtubeunblocker@unblocker.yt [2014-06-06]
FF Extension: WOT - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2013-11-26]
FF Extension: Adblock Plus Pop-up Addon - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\adblockpopups@jessehakanen.net.xpi [2014-01-04]
FF Extension: Proxy-Listen.de - Proxyswitcher - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\admin@proxy-listen.de.xpi [2014-07-17]
FF Extension: Add-on Compatibility Reporter - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\compatibility@addons.mozilla.org.xpi [2013-07-12]
FF Extension: Hide My Ass Proxy Extension - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\extension@hidemyass.com.xpi [2014-01-04]
FF Extension: Ghostery - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\firefox@ghostery.com.xpi [2013-10-18]
FF Extension: One Click Proxy - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\jid0-zXo3XFGyiDalgkeEO4UYJTUwo2I@jetpack.xpi [2014-02-22]
FF Extension: Lightbeam - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\jid1-F9UJ2thwoAm5gQ@jetpack.xpi [2013-11-27]
FF Extension: Proxy Selector - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\proxyselector@mozilla.org.xpi [2014-07-17]
FF Extension: Proxy Tool - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\proxytool@proxylist.co.xpi [2014-07-17]
FF Extension: Speed DNS - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\speeddns@gmail.com.xpi [2014-01-18]
FF Extension: ProxTube - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\{2541D29A-DB9E-4c1e-949A-31EFB4AEF4E7}.xpi [2014-08-10]
FF Extension: Cookie Cutter - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\{4d14a68e-9a97-4358-8603-ed67b332cef1}.xpi [2014-07-17]
FF Extension: UltraSurf Firefox Tool - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\{5B52016C-D097-4aec-BE61-9F129D8FDDBA}.xpi [2014-07-17]
FF Extension: NoScript - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-02-21]
FF Extension: HideMyAss - Free Web Proxy - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\{9aba569a-d0cc-427d-bd2a-27bfd7ce544c}.xpi [2014-07-17]
FF Extension: BetterPrivacy - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi [2014-07-17]
FF Extension: Torbutton - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}.xpi [2014-07-17]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2014-08-10]
FF HKLM-x32\...\Firefox\Extensions: [{0153E448-190B-4987-BDE1-F256CADA672F}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF Extension: RealPlayer Browser Record Plugin - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012-09-15]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-12-16]
FF HKCU\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: No Name - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
Chrome:
=======
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-07-17]
CHR HKLM-x32\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Ext\rphtml5video.crx [2012-09-15]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 acssrv; C:\Program Files\Agnitum\Outpost Security Suite Free\acs.exe [3501696 2011-04-04] (Agnitum Ltd.)
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2013-03-28] (Advanced Micro Devices, Inc.) [File not signed]
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-07-17] (AVAST Software)
S3 CGVPNCliSrvc; C:\Program Files\CyberGhost VPN\CGVPNCliService.exe [2438696 2012-04-26] (mobile concepts GmbH)
R2 DirMngr; C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe [218112 2013-07-16] () [File not signed]
R2 GREGService; C:\Program Files (x86)\Acer\Registration\GREGsvc.exe [29696 2011-05-26] (Acer Incorporated) [File not signed]
R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [116104 2010-04-05] ()
S2 libusbd; C:\Windows\SysWOW64\libusbd-nt.exe [18944 2005-03-09] (hxxp://libusb-win32.sourceforge.net) [File not signed]
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [256832 2011-04-24] (NTI Corporation)
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
R2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
S2 McAfee SiteAdvisor Service; No ImagePath
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R1 afw; C:\Windows\System32\DRIVERS\afw.sys [39528 2010-04-20] (Agnitum Ltd.)
R3 afwcore; C:\Windows\System32\drivers\afwcore.sys [424040 2010-09-27] (Agnitum Ltd.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R3 ASWFilt; C:\Windows\system32\Filt\ASWFilt64.dll [49168 2011-03-21] (Agnitum Ltd.)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-07-17] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-07-17] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-07-17] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-07-17] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1041168 2014-07-17] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427360 2014-07-17] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [92008 2014-07-17] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [224896 2014-07-17] ()
R3 L1C; C:\Windows\System32\DRIVERS\L1C60x64.sys [120520 2013-04-26] (Qualcomm Atheros Co., Ltd.)
S3 libusb0; C:\Windows\SysWOW64\drivers\libusb0.sys [33792 2005-03-09] () [File not signed]
R1 SandBox; C:\Windows\system32\drivers\SandBox64.sys [1097672 2011-03-21] (Agnitum Ltd.)
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [16152 2013-06-15] ()
R3 VBEngNT; C:\Windows\system32\drivers\VBEngNT.sys [293048 2011-02-02] (VirusBuster Kft.)
R3 VBFilt; C:\Windows\system32\Filt\VBFilt64.dll [42976 2011-03-21] (Agnitum Ltd.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-08-27 18:39 - 2014-08-27 18:39 - 00002132 _____ () C:\Users\AlX\Desktop\JRT.txt
2014-08-27 17:42 - 2014-08-27 17:42 - 00000022 _____ () C:\Windows\S.dirmngr
2014-08-26 14:39 - 2014-08-26 14:39 - 00023933 _____ () C:\ComboFix.txt
2014-08-26 14:06 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-08-26 14:06 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-08-26 14:06 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-08-26 14:06 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-08-26 14:06 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-08-26 14:06 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-08-26 14:06 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-08-26 14:06 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-08-26 14:04 - 2014-08-26 14:40 - 00000000 ____D () C:\Qoobox
2014-08-26 14:02 - 2014-08-26 14:32 - 00000000 ____D () C:\Windows\erdnt
2014-08-26 14:01 - 2014-08-26 14:01 - 05572212 ____R (Swearware) C:\Users\AlX\Downloads\ComboFix.exe
2014-08-26 01:32 - 2014-08-26 01:32 - 00380416 _____ () C:\Users\AlX\Downloads\qwfin87w.exe
2014-08-26 01:26 - 2014-08-26 01:40 - 00034368 _____ () C:\Users\AlX\Downloads\Addition.txt
2014-08-26 01:24 - 2014-08-27 18:45 - 00000000 ____D () C:\FRST
2014-08-26 01:24 - 2014-08-27 18:44 - 00020758 _____ () C:\Users\AlX\Downloads\FRST.txt
2014-08-26 01:23 - 2014-08-26 01:23 - 02103296 _____ (Farbar) C:\Users\AlX\Downloads\FRST64.exe
2014-08-26 01:22 - 2014-08-26 01:22 - 00000000 _____ () C:\Users\AlX\defogger_reenable
2014-08-26 01:21 - 2014-08-26 01:21 - 00050477 _____ () C:\Users\AlX\Downloads\Defogger.exe
2014-08-26 00:20 - 2014-08-27 17:41 - 00001210 _____ () C:\Windows\PFRO.log
2014-08-26 00:18 - 2014-08-26 00:18 - 00000000 ____D () C:\Users\AlX\AppData\Roaming\TrojanHunter
2014-08-25 20:44 - 2014-08-27 17:42 - 00000504 _____ () C:\Windows\setupact.log
2014-08-25 20:44 - 2014-08-25 20:44 - 00000000 _____ () C:\Windows\setuperr.log
2014-08-25 20:20 - 2014-08-25 20:20 - 00078984 _____ () C:\Users\AlX\Documents\25.08.2014registry.reg
2014-08-25 20:10 - 2014-08-25 20:10 - 00000000 ____D () C:\Users\AlX\Downloads\tor
2014-08-25 17:06 - 2014-08-25 17:06 - 00000000 ____D () C:\Users\AlX\AppData\Roaming\KeePass
2014-08-25 15:57 - 2014-08-25 15:57 - 04334200 _____ (Bytelayer AB ) C:\Users\AlX\Downloads\TrojanHunterSetup.exe
2014-08-25 15:54 - 2014-08-25 15:54 - 00001071 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KeePass.lnk
2014-08-25 15:54 - 2014-08-25 15:54 - 00000000 ____D () C:\Program Files (x86)\KeePass Password Safe
2014-08-25 15:52 - 2014-08-25 15:59 - 00000000 ____D () C:\Program Files (x86)\TrojanHunter 5.6
2014-08-25 15:52 - 2014-08-25 15:58 - 00000000 ____D () C:\ProgramData\TrojanHunter
2014-08-25 15:52 - 2014-08-25 15:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TrojanHunter
2014-08-25 15:52 - 2014-08-25 15:52 - 00059392 ____R () C:\Windows\SysWOW64\streamhlp.dll
2014-08-25 15:51 - 2014-08-25 15:51 - 01101648 _____ () C:\Users\AlX\Downloads\TrojanHunter - CHIP-Installer.exe
2014-08-25 15:48 - 2014-08-27 17:40 - 00075744 _____ () C:\Windows\WindowsUpdate.log
2014-08-21 09:48 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-08-21 09:48 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-08-21 09:48 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-08-21 09:48 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-08-21 09:47 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-08-21 09:47 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-08-21 09:47 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-08-21 09:47 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2014-08-21 09:47 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-08-21 09:47 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-08-21 09:47 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-08-21 09:47 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-08-21 09:47 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-08-21 09:47 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2014-08-13 20:15 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-08-13 20:15 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll
2014-08-13 20:15 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-08-13 20:15 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-08-13 20:15 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe
2014-08-13 20:15 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll
2014-08-13 20:14 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-08-13 20:14 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-08-13 16:45 - 2014-08-01 01:16 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-08-13 16:45 - 2014-07-25 16:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-13 16:45 - 2014-07-25 16:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-08-13 16:45 - 2014-07-25 15:51 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-08-13 16:45 - 2014-07-25 15:28 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-08-13 16:45 - 2014-07-25 15:10 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-08-13 16:45 - 2014-07-25 14:34 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-08-13 16:45 - 2014-07-25 14:33 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-08-13 16:45 - 2014-07-25 14:28 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-08-13 16:45 - 2014-07-25 14:21 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-08-13 16:45 - 2014-07-25 14:17 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-08-13 16:45 - 2014-07-25 14:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-08-13 16:45 - 2014-07-25 13:52 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-08-13 16:45 - 2014-07-25 13:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-08-13 16:45 - 2014-07-25 13:42 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-08-13 16:45 - 2014-07-25 13:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-08-13 16:45 - 2014-07-25 13:13 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-08-13 16:45 - 2014-07-25 13:07 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-08-13 16:45 - 2014-07-25 12:26 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-13 16:45 - 2014-07-25 12:00 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-08-13 16:45 - 2014-07-16 05:25 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-13 16:45 - 2014-07-16 05:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-08-13 16:45 - 2014-07-16 04:46 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-13 16:45 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-08-13 16:45 - 2014-07-16 04:12 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-13 16:45 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
2014-08-13 16:45 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
2014-08-13 16:45 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
2014-08-13 16:45 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2014-08-13 16:45 - 2014-07-09 04:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
2014-08-13 16:45 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL
2014-08-13 16:45 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL
2014-08-13 16:45 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL
2014-08-13 16:45 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL
2014-08-13 16:45 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
2014-08-13 16:45 - 2014-07-09 00:38 - 00419992 _____ () C:\Windows\system32\locale.nls
2014-08-13 16:45 - 2014-07-09 00:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls
2014-08-13 16:45 - 2014-06-25 04:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-08-13 16:45 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-08-13 16:45 - 2014-06-16 04:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-08-13 16:45 - 2014-06-03 12:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-08-13 16:45 - 2014-06-03 12:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-08-13 16:45 - 2014-06-03 12:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-08-13 16:45 - 2014-06-03 12:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-08-13 16:45 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-08-13 16:45 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-08-13 16:45 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-08-13 16:44 - 2014-08-01 01:41 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-13 16:44 - 2014-07-25 16:52 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-13 16:44 - 2014-07-25 15:30 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-08-13 16:44 - 2014-07-25 15:28 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-08-13 16:44 - 2014-07-25 15:25 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-13 16:44 - 2014-07-25 15:25 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-08-13 16:44 - 2014-07-25 15:11 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-13 16:44 - 2014-07-25 15:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-08-13 16:44 - 2014-07-25 15:03 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-08-13 16:44 - 2014-07-25 15:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-08-13 16:44 - 2014-07-25 15:00 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-08-13 16:44 - 2014-07-25 14:59 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-08-13 16:44 - 2014-07-25 14:47 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-08-13 16:44 - 2014-07-25 14:40 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-13 16:44 - 2014-07-25 14:34 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-08-13 16:44 - 2014-07-25 14:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-08-13 16:44 - 2014-07-25 14:28 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-13 16:44 - 2014-07-25 14:19 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-08-13 16:44 - 2014-07-25 14:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-08-13 16:44 - 2014-07-25 14:17 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-13 16:44 - 2014-07-25 14:12 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-08-13 16:44 - 2014-07-25 14:10 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-13 16:44 - 2014-07-25 14:10 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-08-13 16:44 - 2014-07-25 14:06 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-08-13 16:44 - 2014-07-25 13:47 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-13 16:44 - 2014-07-25 13:39 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-13 16:44 - 2014-07-25 13:39 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-08-13 16:44 - 2014-07-25 13:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-08-13 16:44 - 2014-07-25 13:29 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-08-13 16:44 - 2014-07-25 13:23 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-13 16:44 - 2014-07-25 13:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-08-13 16:44 - 2014-07-25 13:03 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-08-13 16:44 - 2014-07-25 12:52 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-13 16:44 - 2014-07-25 12:17 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-08-13 16:44 - 2014-07-25 12:09 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-08-13 16:44 - 2014-07-25 12:05 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-08-13 16:43 - 2014-08-07 04:06 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-13 16:43 - 2014-08-07 04:01 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-13 16:43 - 2014-07-14 04:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-08-13 16:43 - 2014-07-14 03:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2014-08-10 16:35 - 2014-08-10 16:35 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-08-27 18:45 - 2014-08-26 01:24 - 00020758 _____ () C:\Users\AlX\Downloads\FRST.txt
2014-08-27 18:45 - 2014-08-26 01:24 - 00000000 ____D () C:\FRST
2014-08-27 18:43 - 2012-01-08 17:23 - 00157613 _____ () C:\Windows\system32\config\rules.rdb
2014-08-27 18:40 - 2014-08-25 15:48 - 00075744 _____ () C:\Windows\WindowsUpdate.log
2014-08-27 18:39 - 2014-08-27 18:39 - 00002132 _____ () C:\Users\AlX\Desktop\JRT.txt
2014-08-27 18:17 - 2013-10-17 22:56 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-08-27 17:50 - 2009-07-14 06:45 - 00024400 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-27 17:50 - 2009-07-14 06:45 - 00024400 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-27 17:42 - 2014-08-27 17:42 - 00000022 _____ () C:\Windows\S.dirmngr
2014-08-27 17:42 - 2014-08-25 20:44 - 00000504 _____ () C:\Windows\setupact.log
2014-08-27 17:42 - 2013-12-16 11:56 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-08-27 17:42 - 2013-09-05 13:35 - 00000000 ____D () C:\Users\Public\Documents\phase6_19_Daten
2014-08-27 17:42 - 2013-07-13 14:37 - 00000322 _____ () C:\Windows\Tasks\GlaryInitialize.job
2014-08-27 17:42 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-27 17:41 - 2014-08-26 00:20 - 00001210 _____ () C:\Windows\PFRO.log
2014-08-27 17:41 - 2009-07-14 06:45 - 00315656 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-27 17:40 - 2013-11-02 18:35 - 00000000 ____D () C:\AdwCleaner
2014-08-27 17:40 - 2011-12-10 03:09 - 00523928 _____ () C:\Windows\system32\config\afw_db.conf
2014-08-27 17:40 - 2011-12-10 03:09 - 00074188 _____ () C:\Windows\system32\config\afw_hm.conf
2014-08-27 17:08 - 2011-12-10 01:51 - 00000000 ____D () C:\Windows\system32\Filt
2014-08-27 17:04 - 2014-07-08 15:26 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-26 14:40 - 2014-08-26 14:04 - 00000000 ____D () C:\Qoobox
2014-08-26 14:39 - 2014-08-26 14:39 - 00023933 _____ () C:\ComboFix.txt
2014-08-26 14:39 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2014-08-26 14:32 - 2014-08-26 14:02 - 00000000 ____D () C:\Windows\erdnt
2014-08-26 14:27 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-08-26 14:23 - 2009-07-14 04:34 - 77070336 _____ () C:\Windows\system32\config\software.bak
2014-08-26 14:23 - 2009-07-14 04:34 - 22806528 _____ () C:\Windows\system32\config\system.bak
2014-08-26 14:23 - 2009-07-14 04:34 - 04980736 _____ () C:\Windows\system32\config\default.bak
2014-08-26 14:23 - 2009-07-14 04:34 - 00024576 _____ () C:\Windows\system32\config\security.bak
2014-08-26 14:23 - 2009-07-14 04:34 - 00024576 _____ () C:\Windows\system32\config\sam.bak
2014-08-26 14:01 - 2014-08-26 14:01 - 05572212 ____R (Swearware) C:\Users\AlX\Downloads\ComboFix.exe
2014-08-26 01:40 - 2014-08-26 01:26 - 00034368 _____ () C:\Users\AlX\Downloads\Addition.txt
2014-08-26 01:32 - 2014-08-26 01:32 - 00380416 _____ () C:\Users\AlX\Downloads\qwfin87w.exe
2014-08-26 01:23 - 2014-08-26 01:23 - 02103296 _____ (Farbar) C:\Users\AlX\Downloads\FRST64.exe
2014-08-26 01:22 - 2014-08-26 01:22 - 00000000 _____ () C:\Users\AlX\defogger_reenable
2014-08-26 01:22 - 2011-12-10 00:48 - 00000000 ____D () C:\Users\AlX
2014-08-26 01:21 - 2014-08-26 01:21 - 00050477 _____ () C:\Users\AlX\Downloads\Defogger.exe
2014-08-26 00:20 - 2012-05-10 13:58 - 00068744 _____ () C:\Users\AlX\AppData\Local\GDIPFONTCACHEV1.DAT
2014-08-26 00:18 - 2014-08-26 00:18 - 00000000 ____D () C:\Users\AlX\AppData\Roaming\TrojanHunter
2014-08-26 00:18 - 2012-05-26 01:56 - 00007767 _____ () C:\ProgramData\hpzinstall.log
2014-08-25 20:44 - 2014-08-25 20:44 - 00000000 _____ () C:\Windows\setuperr.log
2014-08-25 20:30 - 2012-05-26 01:58 - 00000000 ____D () C:\Program Files (x86)\HP
2014-08-25 20:26 - 2012-02-13 19:25 - 00000000 ____D () C:\Program Files (x86)\Google
2014-08-25 20:23 - 2012-02-13 19:25 - 00000000 ____D () C:\Users\AlX\AppData\Local\Google
2014-08-25 20:20 - 2014-08-25 20:20 - 00078984 _____ () C:\Users\AlX\Documents\25.08.2014registry.reg
2014-08-25 20:18 - 2011-12-09 21:21 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-08-25 20:10 - 2014-08-25 20:10 - 00000000 ____D () C:\Users\AlX\Downloads\tor
2014-08-25 17:06 - 2014-08-25 17:06 - 00000000 ____D () C:\Users\AlX\AppData\Roaming\KeePass
2014-08-25 15:59 - 2014-08-25 15:52 - 00000000 ____D () C:\Program Files (x86)\TrojanHunter 5.6
2014-08-25 15:58 - 2014-08-25 15:52 - 00000000 ____D () C:\ProgramData\TrojanHunter
2014-08-25 15:57 - 2014-08-25 15:57 - 04334200 _____ (Bytelayer AB ) C:\Users\AlX\Downloads\TrojanHunterSetup.exe
2014-08-25 15:57 - 2014-08-25 15:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TrojanHunter
2014-08-25 15:54 - 2014-08-25 15:54 - 00001071 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KeePass.lnk
2014-08-25 15:54 - 2014-08-25 15:54 - 00000000 ____D () C:\Program Files (x86)\KeePass Password Safe
2014-08-25 15:52 - 2014-08-25 15:52 - 00059392 ____R () C:\Windows\SysWOW64\streamhlp.dll
2014-08-25 15:51 - 2014-08-25 15:51 - 01101648 _____ () C:\Users\AlX\Downloads\TrojanHunter - CHIP-Installer.exe
2014-08-25 15:48 - 2012-01-16 17:27 - 00000000 ____D () C:\Users\AlX\AppData\Roaming\uTorrent
2014-08-25 15:11 - 2012-04-18 22:24 - 00000000 ____D () C:\Program Files (x86)\Klett
2014-08-25 15:11 - 2012-01-29 03:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Klett
2014-08-24 14:02 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration
2014-08-24 01:27 - 2011-09-26 10:53 - 00699666 _____ () C:\Windows\system32\perfh007.dat
2014-08-24 01:27 - 2011-09-26 10:53 - 00149774 _____ () C:\Windows\system32\perfc007.dat
2014-08-24 01:27 - 2009-07-14 07:13 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-20 14:56 - 2012-02-03 17:13 - 00000000 ____D () C:\ProgramData\CanonIJPLM
2014-08-19 00:54 - 2012-04-27 15:41 - 00000000 ____D () C:\Users\AlX\AppData\Local\Paint.NET
2014-08-16 14:59 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-08-13 23:42 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-08-13 20:26 - 2013-07-14 13:17 - 00000000 ____D () C:\Windows\system32\MRT
2014-08-13 20:22 - 2011-12-09 22:31 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-08-13 20:13 - 2014-05-07 11:35 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-08-12 17:49 - 2012-05-15 18:12 - 00000000 ____D () C:\Users\AlX\AppData\Roaming\Audacity
2014-08-11 00:47 - 2012-05-05 17:36 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-08-10 16:35 - 2014-08-10 16:35 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-08-07 04:06 - 2014-08-13 16:43 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-07 04:01 - 2014-08-13 16:43 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-01 01:41 - 2014-08-13 16:44 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-01 01:16 - 2014-08-13 16:45 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
Some content of TEMP:
====================
C:\Users\AlX\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-08-17 19:18
==================== End Of Log ============================
--- --- --- --- --- --- --- --- --- [/code] |
|
28.08.2014, 08:35
| #6 |
| /// the machine /// TB-Ausbilder | Trojan.Kazy!WvUyTGribrg (trojan) in AdobeARM.exeESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ --> Trojan.Kazy!WvUyTGribrg (trojan) in AdobeARM.exe |
|
28.08.2014, 18:58
| #7 |
| | Trojan.Kazy!WvUyTGribrg (trojan) in AdobeARM.exe Hallo Schrauber, anbei die Ergebnisse des Eset-Scans. (Übrigens unfassbar, dass der letzte Prozentpunkt ein Drittel der gesamten Scandauer benötigt.) Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=8bc3b84b76fb154d825ba85186df1627
# engine=19888
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-08-28 05:33:24
# local_time=2014-08-28 07:33:24 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='avast! Antivirus'
# compatibility_mode=783 16777213 100 92 640304 22063182 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 35586524 160877054 0 0
# scanned=162816
# found=4
# cleaned=0
# scan_time=9230
sh=8992F72873D09212597E582A16F8D9BC60E6A22A ft=1 fh=e21391a34e842ffc vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\DVDVideoSoft\TB\ConduitInstaller.exe.vir"
sh=899846A13D609B412C855F80FE086438DDFFEAFB ft=1 fh=aa9df1b2adff28cb vn="Win32/SpeedUpMyPC evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\AlX\AppData\Roaming\OpenCandy\CD43FBDCCB794A5BB3FFC654FC2E9DE6\speedupmypcROE.exe.vir"
sh=7336EEB27416A7F6A03F92979BCC619CF550EBBD ft=1 fh=32ad90c470794ca7 vn="Variante von MSIL/DownloadGuide.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\AlX\Downloads\free-system-utilities-DE.exe"
sh=B978084D79006292D0D189F6DC748BC76B526F61 ft=1 fh=220946d266bbccea vn="Win32/OpenCandy potenziell unsichere Anwendung" ac=I fn="C:\Users\AlX\Downloads\FreeYouTubeDownload_3.2.31.325.exe"
Code:
ATTFilter Results of screen317's Security Check version 0.99.87
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
avast! Antivirus
Outpost Security Suite
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
Spybot - Search & Destroy
Wise Registry Cleaner 7.88
Java 7 Update 65
Java 8 Update 5
Java version out of Date!
Adobe Flash Player 14.0.0.145
Adobe Reader XI
Mozilla Firefox (31.0)
Mozilla Thunderbird (31.0.)
````````Process Check: objlist.exe by Laurent````````
Spybot Teatimer.exe is disabled!
AVAST Software Avast AvastSvc.exe
AVAST Software Avast avastui.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
Und ein frisches FRST: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-08-2014 01
Ran by AlX (administrator) on ALX-PC on 28-08-2014 19:49:39
Running from C:\Users\AlX\Downloads
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Mischel Internet Security) C:\Program Files (x86)\TrojanHunter 5.6\THGuard.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
() C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
() C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
(Safer Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Agnitum Ltd.) C:\Program Files\Agnitum\Outpost Security Suite Free\op_mon.exe
(Agnitum Ltd.) C:\Program Files\Agnitum\Outpost Security Suite Free\acs.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 6100\Bin\HPNetworkCommunicator.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2723624 2011-03-28] (Synaptics Incorporated)
HKLM\...\Run: [Power Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [1831528 2011-05-10] (Acer Incorporated)
HKLM\...\Run: [OutpostMonitor] => C:\Program Files\Agnitum\Outpost Security Suite Free\op_mon.exe [4510072 2011-04-04] (Agnitum Ltd.)
HKLM\...\Run: [OutpostFeedBack] => C:\Program Files\Agnitum\Outpost Security Suite Free\feedback.exe [808064 2011-03-30] (Agnitum Ltd.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12921488 2000-01-01] (Realtek Semiconductor)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1103440 2011-07-01] (Dritek System Inc.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642656 2013-03-28] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [4085896 2014-08-10] (AVAST Software)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2011-03-24] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [191528 2014-06-04] (Geek Software GmbH)
HKLM-x32\...\Run: [THGuard] => C:\Program Files (x86)\TrojanHunter 5.6\THGuard.exe [1081808 2014-07-30] (Mischel Internet Security)
HKU\.DEFAULT\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-21-3429764466-1293764708-2967138861-1001\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
AppInit_DLLs: c:\PROGRA~1\Agnitum\OUTPOS~1\wl_hook64.dll => c:\Program Files\Agnitum\Outpost Security Suite Free\wl_hook64.dll [983664 2011-03-30] (Agnitum Ltd.)
AppInit_DLLs-x32: c:\PROGRA~1\Agnitum\OUTPOS~1\wl_hook.dll => c:\Program Files\Agnitum\Outpost Security Suite Free\wl_hook.dll [701456 2011-03-30] (Agnitum Ltd.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\p6_19_erinnerung.lnk
ShortcutTarget: p6_19_erinnerung.lnk -> C:\Program Files (x86)\phase6\phase6_19\WinStart\WinStart.exe (phase6)
Startup: C:\Users\AlX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Officejet 6100 (Netzwerk).lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Officejet 6100 (Netzwerk).lnk -> C:\Program Files\HP\HP Officejet 6100\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)
ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: Outpost -> {33C9E362-3EDA-4930-8AFE-5DA39A8BB77A} => C:\Program Files\Agnitum\Outpost Security Suite Free\op_shell.dll (Agnitum Ltd.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
ProxyServer: 127.0.0.1:9666
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: No Name -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> No File
BHO-x32: Spybot-S&D IE Protection -> {53707962-6F74-2D53-2644-206D7942484F} -> C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
BHO-x32: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre8\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre8\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
FireFox:
========
FF ProfilePath: C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default
FF Homepage: https://startpage.com/do/search
FF NetworkProxy: "socks_version", 4
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=11.5.2 -> C:\Program Files (x86)\Java\jre8\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.5.2 -> C:\Program Files (x86)\Java\jre8\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @protectdisc.com/NPPDLicenseHelper -> C:\Program Files (x86)\ProtectDisc\License Helper\NPPDLicenseHelper.dll ()
FF Plugin-x32: @real.com/nppl3260;version=15.0.6.14 -> C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprjplug;version=15.0.6.14 -> C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpchromebrowserrecordext;version=15.0.6.14 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprphtml5videoshim;version=15.0.6.14 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=15.0.6.14 -> C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\searchplugins\ixquick-https---deutsch.xml
FF SearchPlugin: C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\searchplugins\nation-secure-search.xml
FF SearchPlugin: C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\searchplugins\startpage-https---deutsch.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: ProxTube - Unblock YouTube - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\ich@maltegoetz.de [2014-01-26]
FF Extension: YouTube Unblocker - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\youtubeunblocker@unblocker.yt [2014-06-06]
FF Extension: WOT - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2013-11-26]
FF Extension: Adblock Plus Pop-up Addon - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\adblockpopups@jessehakanen.net.xpi [2014-01-04]
FF Extension: Proxy-Listen.de - Proxyswitcher - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\admin@proxy-listen.de.xpi [2014-07-17]
FF Extension: Add-on Compatibility Reporter - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\compatibility@addons.mozilla.org.xpi [2013-07-12]
FF Extension: Hide My Ass Proxy Extension - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\extension@hidemyass.com.xpi [2014-01-04]
FF Extension: Ghostery - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\firefox@ghostery.com.xpi [2013-10-18]
FF Extension: One Click Proxy - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\jid0-zXo3XFGyiDalgkeEO4UYJTUwo2I@jetpack.xpi [2014-02-22]
FF Extension: Lightbeam - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\jid1-F9UJ2thwoAm5gQ@jetpack.xpi [2013-11-27]
FF Extension: Proxy Selector - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\proxyselector@mozilla.org.xpi [2014-07-17]
FF Extension: Proxy Tool - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\proxytool@proxylist.co.xpi [2014-07-17]
FF Extension: Speed DNS - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\speeddns@gmail.com.xpi [2014-01-18]
FF Extension: ProxTube - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\{2541D29A-DB9E-4c1e-949A-31EFB4AEF4E7}.xpi [2014-08-10]
FF Extension: Cookie Cutter - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\{4d14a68e-9a97-4358-8603-ed67b332cef1}.xpi [2014-07-17]
FF Extension: UltraSurf Firefox Tool - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\{5B52016C-D097-4aec-BE61-9F129D8FDDBA}.xpi [2014-07-17]
FF Extension: NoScript - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-02-21]
FF Extension: HideMyAss - Free Web Proxy - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\{9aba569a-d0cc-427d-bd2a-27bfd7ce544c}.xpi [2014-07-17]
FF Extension: BetterPrivacy - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi [2014-07-17]
FF Extension: Torbutton - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}.xpi [2014-07-17]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2014-08-10]
FF HKLM-x32\...\Firefox\Extensions: [{0153E448-190B-4987-BDE1-F256CADA672F}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF Extension: RealPlayer Browser Record Plugin - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012-09-15]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-12-16]
FF HKCU\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: No Name - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
Chrome:
=======
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-07-17]
CHR HKLM-x32\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Ext\rphtml5video.crx [2012-09-15]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 acssrv; C:\Program Files\Agnitum\Outpost Security Suite Free\acs.exe [3501696 2011-04-04] (Agnitum Ltd.)
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2013-03-28] (Advanced Micro Devices, Inc.) [File not signed]
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-07-17] (AVAST Software)
S3 CGVPNCliSrvc; C:\Program Files\CyberGhost VPN\CGVPNCliService.exe [2438696 2012-04-26] (mobile concepts GmbH)
R2 DirMngr; C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe [218112 2013-07-16] () [File not signed]
R2 GREGService; C:\Program Files (x86)\Acer\Registration\GREGsvc.exe [29696 2011-05-26] (Acer Incorporated) [File not signed]
R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [116104 2010-04-05] ()
S2 libusbd; C:\Windows\SysWOW64\libusbd-nt.exe [18944 2005-03-09] (hxxp://libusb-win32.sourceforge.net) [File not signed]
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [256832 2011-04-24] (NTI Corporation)
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
R2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
S2 McAfee SiteAdvisor Service; No ImagePath
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R1 afw; C:\Windows\System32\DRIVERS\afw.sys [39528 2010-04-20] (Agnitum Ltd.)
R3 afwcore; C:\Windows\System32\drivers\afwcore.sys [424040 2010-09-27] (Agnitum Ltd.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R3 ASWFilt; C:\Windows\system32\Filt\ASWFilt64.dll [49168 2011-03-21] (Agnitum Ltd.)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-07-17] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-07-17] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-07-17] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-07-17] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1041168 2014-07-17] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427360 2014-07-17] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [92008 2014-07-17] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [224896 2014-07-17] ()
R3 L1C; C:\Windows\System32\DRIVERS\L1C60x64.sys [120520 2013-04-26] (Qualcomm Atheros Co., Ltd.)
S3 libusb0; C:\Windows\SysWOW64\drivers\libusb0.sys [33792 2005-03-09] () [File not signed]
R1 SandBox; C:\Windows\system32\drivers\SandBox64.sys [1097672 2011-03-21] (Agnitum Ltd.)
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [16152 2013-06-15] ()
R3 VBEngNT; C:\Windows\system32\drivers\VBEngNT.sys [293048 2011-02-02] (VirusBuster Kft.)
R3 VBFilt; C:\Windows\system32\Filt\VBFilt64.dll [42976 2011-03-21] (Agnitum Ltd.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-08-28 19:14 - 2014-08-28 19:14 - 00854417 _____ () C:\Users\AlX\Downloads\SecurityCheck.exe
2014-08-28 16:54 - 2014-08-28 16:54 - 02347384 _____ (ESET) C:\Users\AlX\Downloads\esetsmartinstaller_deu.exe
2014-08-28 16:54 - 2014-08-28 16:54 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-08-28 16:51 - 2014-08-28 16:51 - 00000022 _____ () C:\Windows\S.dirmngr
2014-08-27 22:23 - 2014-08-23 04:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-27 22:23 - 2014-08-23 03:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-27 22:23 - 2014-08-23 02:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-27 18:39 - 2014-08-27 18:39 - 00002132 _____ () C:\Users\AlX\Desktop\JRT.txt
2014-08-26 14:39 - 2014-08-26 14:39 - 00023933 _____ () C:\ComboFix.txt
2014-08-26 14:06 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-08-26 14:06 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-08-26 14:06 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-08-26 14:06 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-08-26 14:06 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-08-26 14:06 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-08-26 14:06 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-08-26 14:06 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-08-26 14:04 - 2014-08-26 14:40 - 00000000 ____D () C:\Qoobox
2014-08-26 14:02 - 2014-08-26 14:32 - 00000000 ____D () C:\Windows\erdnt
2014-08-26 14:01 - 2014-08-26 14:01 - 05572212 ____R (Swearware) C:\Users\AlX\Downloads\ComboFix.exe
2014-08-26 01:32 - 2014-08-26 01:32 - 00380416 _____ () C:\Users\AlX\Downloads\qwfin87w.exe
2014-08-26 01:26 - 2014-08-26 01:40 - 00034368 _____ () C:\Users\AlX\Downloads\Addition.txt
2014-08-26 01:24 - 2014-08-28 19:49 - 00020644 _____ () C:\Users\AlX\Downloads\FRST.txt
2014-08-26 01:24 - 2014-08-28 19:49 - 00000000 ____D () C:\FRST
2014-08-26 01:23 - 2014-08-26 01:23 - 02103296 _____ (Farbar) C:\Users\AlX\Downloads\FRST64.exe
2014-08-26 01:22 - 2014-08-26 01:22 - 00000000 _____ () C:\Users\AlX\defogger_reenable
2014-08-26 01:21 - 2014-08-26 01:21 - 00050477 _____ () C:\Users\AlX\Downloads\Defogger.exe
2014-08-26 00:20 - 2014-08-27 17:41 - 00001210 _____ () C:\Windows\PFRO.log
2014-08-26 00:18 - 2014-08-26 00:18 - 00000000 ____D () C:\Users\AlX\AppData\Roaming\TrojanHunter
2014-08-25 20:44 - 2014-08-28 16:50 - 00000672 _____ () C:\Windows\setupact.log
2014-08-25 20:44 - 2014-08-25 20:44 - 00000000 _____ () C:\Windows\setuperr.log
2014-08-25 20:20 - 2014-08-25 20:20 - 00078984 _____ () C:\Users\AlX\Documents\25.08.2014registry.reg
2014-08-25 20:10 - 2014-08-25 20:10 - 00000000 ____D () C:\Users\AlX\Downloads\tor
2014-08-25 17:06 - 2014-08-25 17:06 - 00000000 ____D () C:\Users\AlX\AppData\Roaming\KeePass
2014-08-25 15:57 - 2014-08-25 15:57 - 04334200 _____ (Bytelayer AB ) C:\Users\AlX\Downloads\TrojanHunterSetup.exe
2014-08-25 15:54 - 2014-08-25 15:54 - 00001071 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KeePass.lnk
2014-08-25 15:54 - 2014-08-25 15:54 - 00000000 ____D () C:\Program Files (x86)\KeePass Password Safe
2014-08-25 15:52 - 2014-08-28 17:57 - 00000000 ____D () C:\Program Files (x86)\TrojanHunter 5.6
2014-08-25 15:52 - 2014-08-25 15:58 - 00000000 ____D () C:\ProgramData\TrojanHunter
2014-08-25 15:52 - 2014-08-25 15:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TrojanHunter
2014-08-25 15:52 - 2014-08-25 15:52 - 00059392 ____R () C:\Windows\SysWOW64\streamhlp.dll
2014-08-25 15:51 - 2014-08-25 15:51 - 01101648 _____ () C:\Users\AlX\Downloads\TrojanHunter - CHIP-Installer.exe
2014-08-25 15:48 - 2014-08-28 18:29 - 00230134 _____ () C:\Windows\WindowsUpdate.log
2014-08-21 09:48 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-08-21 09:48 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-08-21 09:48 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-08-21 09:48 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-08-21 09:47 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-08-21 09:47 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-08-21 09:47 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-08-21 09:47 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2014-08-21 09:47 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-08-21 09:47 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-08-21 09:47 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-08-21 09:47 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-08-21 09:47 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-08-21 09:47 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2014-08-13 20:15 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-08-13 20:15 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll
2014-08-13 20:15 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-08-13 20:15 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-08-13 20:15 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe
2014-08-13 20:15 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll
2014-08-13 20:14 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-08-13 20:14 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-08-13 16:45 - 2014-08-01 01:16 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-08-13 16:45 - 2014-07-25 16:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-13 16:45 - 2014-07-25 16:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-08-13 16:45 - 2014-07-25 15:51 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-08-13 16:45 - 2014-07-25 15:28 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-08-13 16:45 - 2014-07-25 15:10 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-08-13 16:45 - 2014-07-25 14:34 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-08-13 16:45 - 2014-07-25 14:33 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-08-13 16:45 - 2014-07-25 14:28 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-08-13 16:45 - 2014-07-25 14:21 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-08-13 16:45 - 2014-07-25 14:17 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-08-13 16:45 - 2014-07-25 14:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-08-13 16:45 - 2014-07-25 13:52 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-08-13 16:45 - 2014-07-25 13:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-08-13 16:45 - 2014-07-25 13:42 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-08-13 16:45 - 2014-07-25 13:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-08-13 16:45 - 2014-07-25 13:13 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-08-13 16:45 - 2014-07-25 13:07 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-08-13 16:45 - 2014-07-25 12:26 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-13 16:45 - 2014-07-25 12:00 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-08-13 16:45 - 2014-07-16 05:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-08-13 16:45 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-08-13 16:45 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
2014-08-13 16:45 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
2014-08-13 16:45 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
2014-08-13 16:45 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2014-08-13 16:45 - 2014-07-09 04:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
2014-08-13 16:45 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL
2014-08-13 16:45 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL
2014-08-13 16:45 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL
2014-08-13 16:45 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL
2014-08-13 16:45 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
2014-08-13 16:45 - 2014-07-09 00:38 - 00419992 _____ () C:\Windows\system32\locale.nls
2014-08-13 16:45 - 2014-07-09 00:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls
2014-08-13 16:45 - 2014-06-25 04:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-08-13 16:45 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-08-13 16:45 - 2014-06-16 04:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-08-13 16:45 - 2014-06-03 12:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-08-13 16:45 - 2014-06-03 12:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-08-13 16:45 - 2014-06-03 12:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-08-13 16:45 - 2014-06-03 12:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-08-13 16:45 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-08-13 16:45 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-08-13 16:45 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-08-13 16:44 - 2014-08-01 01:41 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-13 16:44 - 2014-07-25 16:52 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-13 16:44 - 2014-07-25 15:30 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-08-13 16:44 - 2014-07-25 15:28 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-08-13 16:44 - 2014-07-25 15:25 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-13 16:44 - 2014-07-25 15:25 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-08-13 16:44 - 2014-07-25 15:11 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-13 16:44 - 2014-07-25 15:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-08-13 16:44 - 2014-07-25 15:03 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-08-13 16:44 - 2014-07-25 15:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-08-13 16:44 - 2014-07-25 15:00 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-08-13 16:44 - 2014-07-25 14:59 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-08-13 16:44 - 2014-07-25 14:47 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-08-13 16:44 - 2014-07-25 14:40 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-13 16:44 - 2014-07-25 14:34 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-08-13 16:44 - 2014-07-25 14:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-08-13 16:44 - 2014-07-25 14:28 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-13 16:44 - 2014-07-25 14:19 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-08-13 16:44 - 2014-07-25 14:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-08-13 16:44 - 2014-07-25 14:17 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-13 16:44 - 2014-07-25 14:12 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-08-13 16:44 - 2014-07-25 14:10 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-13 16:44 - 2014-07-25 14:10 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-08-13 16:44 - 2014-07-25 14:06 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-08-13 16:44 - 2014-07-25 13:47 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-13 16:44 - 2014-07-25 13:39 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-13 16:44 - 2014-07-25 13:39 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-08-13 16:44 - 2014-07-25 13:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-08-13 16:44 - 2014-07-25 13:29 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-08-13 16:44 - 2014-07-25 13:23 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-13 16:44 - 2014-07-25 13:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-08-13 16:44 - 2014-07-25 13:03 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-08-13 16:44 - 2014-07-25 12:52 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-13 16:44 - 2014-07-25 12:17 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-08-13 16:44 - 2014-07-25 12:09 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-08-13 16:44 - 2014-07-25 12:05 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-08-13 16:43 - 2014-08-07 04:06 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-13 16:43 - 2014-08-07 04:01 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-13 16:43 - 2014-07-14 04:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-08-13 16:43 - 2014-07-14 03:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2014-08-10 16:35 - 2014-08-10 16:35 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-08-28 19:50 - 2014-08-26 01:24 - 00020644 _____ () C:\Users\AlX\Downloads\FRST.txt
2014-08-28 19:49 - 2014-08-26 01:24 - 00000000 ____D () C:\FRST
2014-08-28 19:47 - 2012-01-08 17:23 - 00158046 _____ () C:\Windows\system32\config\rules.rdb
2014-08-28 19:17 - 2013-10-17 22:56 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-08-28 19:14 - 2014-08-28 19:14 - 00854417 _____ () C:\Users\AlX\Downloads\SecurityCheck.exe
2014-08-28 18:29 - 2014-08-25 15:48 - 00230134 _____ () C:\Windows\WindowsUpdate.log
2014-08-28 17:57 - 2014-08-25 15:52 - 00000000 ____D () C:\Program Files (x86)\TrojanHunter 5.6
2014-08-28 16:59 - 2009-07-14 06:45 - 00024400 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-28 16:59 - 2009-07-14 06:45 - 00024400 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-28 16:57 - 2011-12-10 03:09 - 00074452 _____ () C:\Windows\system32\config\afw_hm.conf
2014-08-28 16:57 - 2011-12-10 03:09 - 00000004 _____ () C:\Windows\system32\config\afw_db.conf
2014-08-28 16:54 - 2014-08-28 16:54 - 02347384 _____ (ESET) C:\Users\AlX\Downloads\esetsmartinstaller_deu.exe
2014-08-28 16:54 - 2014-08-28 16:54 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-08-28 16:51 - 2014-08-28 16:51 - 00000022 _____ () C:\Windows\S.dirmngr
2014-08-28 16:51 - 2013-09-05 13:35 - 00000000 ____D () C:\Users\Public\Documents\phase6_19_Daten
2014-08-28 16:51 - 2013-07-13 14:37 - 00000322 _____ () C:\Windows\Tasks\GlaryInitialize.job
2014-08-28 16:50 - 2014-08-25 20:44 - 00000672 _____ () C:\Windows\setupact.log
2014-08-28 16:50 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-28 12:12 - 2009-07-14 06:45 - 00297112 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-27 18:39 - 2014-08-27 18:39 - 00002132 _____ () C:\Users\AlX\Desktop\JRT.txt
2014-08-27 17:42 - 2013-12-16 11:56 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-08-27 17:41 - 2014-08-26 00:20 - 00001210 _____ () C:\Windows\PFRO.log
2014-08-27 17:40 - 2013-11-02 18:35 - 00000000 ____D () C:\AdwCleaner
2014-08-27 17:08 - 2011-12-10 01:51 - 00000000 ____D () C:\Windows\system32\Filt
2014-08-27 17:04 - 2014-07-08 15:26 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-26 14:40 - 2014-08-26 14:04 - 00000000 ____D () C:\Qoobox
2014-08-26 14:39 - 2014-08-26 14:39 - 00023933 _____ () C:\ComboFix.txt
2014-08-26 14:39 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2014-08-26 14:32 - 2014-08-26 14:02 - 00000000 ____D () C:\Windows\erdnt
2014-08-26 14:27 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-08-26 14:23 - 2009-07-14 04:34 - 77070336 _____ () C:\Windows\system32\config\software.bak
2014-08-26 14:23 - 2009-07-14 04:34 - 22806528 _____ () C:\Windows\system32\config\system.bak
2014-08-26 14:23 - 2009-07-14 04:34 - 04980736 _____ () C:\Windows\system32\config\default.bak
2014-08-26 14:23 - 2009-07-14 04:34 - 00024576 _____ () C:\Windows\system32\config\security.bak
2014-08-26 14:23 - 2009-07-14 04:34 - 00024576 _____ () C:\Windows\system32\config\sam.bak
2014-08-26 14:01 - 2014-08-26 14:01 - 05572212 ____R (Swearware) C:\Users\AlX\Downloads\ComboFix.exe
2014-08-26 01:40 - 2014-08-26 01:26 - 00034368 _____ () C:\Users\AlX\Downloads\Addition.txt
2014-08-26 01:32 - 2014-08-26 01:32 - 00380416 _____ () C:\Users\AlX\Downloads\qwfin87w.exe
2014-08-26 01:23 - 2014-08-26 01:23 - 02103296 _____ (Farbar) C:\Users\AlX\Downloads\FRST64.exe
2014-08-26 01:22 - 2014-08-26 01:22 - 00000000 _____ () C:\Users\AlX\defogger_reenable
2014-08-26 01:22 - 2011-12-10 00:48 - 00000000 ____D () C:\Users\AlX
2014-08-26 01:21 - 2014-08-26 01:21 - 00050477 _____ () C:\Users\AlX\Downloads\Defogger.exe
2014-08-26 00:20 - 2012-05-10 13:58 - 00068744 _____ () C:\Users\AlX\AppData\Local\GDIPFONTCACHEV1.DAT
2014-08-26 00:18 - 2014-08-26 00:18 - 00000000 ____D () C:\Users\AlX\AppData\Roaming\TrojanHunter
2014-08-26 00:18 - 2012-05-26 01:56 - 00007767 _____ () C:\ProgramData\hpzinstall.log
2014-08-25 20:44 - 2014-08-25 20:44 - 00000000 _____ () C:\Windows\setuperr.log
2014-08-25 20:30 - 2012-05-26 01:58 - 00000000 ____D () C:\Program Files (x86)\HP
2014-08-25 20:26 - 2012-02-13 19:25 - 00000000 ____D () C:\Program Files (x86)\Google
2014-08-25 20:23 - 2012-02-13 19:25 - 00000000 ____D () C:\Users\AlX\AppData\Local\Google
2014-08-25 20:20 - 2014-08-25 20:20 - 00078984 _____ () C:\Users\AlX\Documents\25.08.2014registry.reg
2014-08-25 20:18 - 2011-12-09 21:21 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-08-25 20:10 - 2014-08-25 20:10 - 00000000 ____D () C:\Users\AlX\Downloads\tor
2014-08-25 17:06 - 2014-08-25 17:06 - 00000000 ____D () C:\Users\AlX\AppData\Roaming\KeePass
2014-08-25 15:58 - 2014-08-25 15:52 - 00000000 ____D () C:\ProgramData\TrojanHunter
2014-08-25 15:57 - 2014-08-25 15:57 - 04334200 _____ (Bytelayer AB ) C:\Users\AlX\Downloads\TrojanHunterSetup.exe
2014-08-25 15:57 - 2014-08-25 15:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TrojanHunter
2014-08-25 15:54 - 2014-08-25 15:54 - 00001071 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KeePass.lnk
2014-08-25 15:54 - 2014-08-25 15:54 - 00000000 ____D () C:\Program Files (x86)\KeePass Password Safe
2014-08-25 15:52 - 2014-08-25 15:52 - 00059392 ____R () C:\Windows\SysWOW64\streamhlp.dll
2014-08-25 15:51 - 2014-08-25 15:51 - 01101648 _____ () C:\Users\AlX\Downloads\TrojanHunter - CHIP-Installer.exe
2014-08-25 15:48 - 2012-01-16 17:27 - 00000000 ____D () C:\Users\AlX\AppData\Roaming\uTorrent
2014-08-25 15:11 - 2012-04-18 22:24 - 00000000 ____D () C:\Program Files (x86)\Klett
2014-08-25 15:11 - 2012-01-29 03:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Klett
2014-08-24 14:02 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration
2014-08-24 01:27 - 2011-09-26 10:53 - 00699666 _____ () C:\Windows\system32\perfh007.dat
2014-08-24 01:27 - 2011-09-26 10:53 - 00149774 _____ () C:\Windows\system32\perfc007.dat
2014-08-24 01:27 - 2009-07-14 07:13 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-23 04:07 - 2014-08-27 22:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-23 03:45 - 2014-08-27 22:23 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-23 02:59 - 2014-08-27 22:23 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-20 14:56 - 2012-02-03 17:13 - 00000000 ____D () C:\ProgramData\CanonIJPLM
2014-08-19 00:54 - 2012-04-27 15:41 - 00000000 ____D () C:\Users\AlX\AppData\Local\Paint.NET
2014-08-16 14:59 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-08-13 23:42 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-08-13 20:26 - 2013-07-14 13:17 - 00000000 ____D () C:\Windows\system32\MRT
2014-08-13 20:22 - 2011-12-09 22:31 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-08-13 20:13 - 2014-05-07 11:35 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-08-12 17:49 - 2012-05-15 18:12 - 00000000 ____D () C:\Users\AlX\AppData\Roaming\Audacity
2014-08-11 00:47 - 2012-05-05 17:36 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-08-10 16:35 - 2014-08-10 16:35 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-08-07 04:06 - 2014-08-13 16:43 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-07 04:01 - 2014-08-13 16:43 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-01 01:41 - 2014-08-13 16:44 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-01 01:16 - 2014-08-13 16:45 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
Some content of TEMP:
====================
C:\Users\AlX\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-08-17 19:18
==================== End Of Log ============================
--- --- --- [/code] Soweit die Ergebnisse. Ich habe aber noch immer die Viren in dem Quarantäneverzeichnis von avast. Kann ich die löschen? Ansonsten läuft alles toll. Noch einmal vielen Dank. Gruß & Sympathie AlX |
|
29.08.2014, 10:46
| #8 |
| /// the machine /// TB-Ausbilder | Trojan.Kazy!WvUyTGribrg (trojan) in AdobeARM.exe Quarantäne kannste leeren. Java updaten. Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter HKU\.DEFAULT\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
ProxyServer: 127.0.0.1:9666
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Fertig Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
29.08.2014, 14:26
| #9 |
| | Trojan.Kazy!WvUyTGribrg (trojan) in AdobeARM.exe Lieber Schrauber, bevor ich alles wieder runter werfe: Gestern Nacht meldete mir Outpost die Blockierung des Trojaners BZub und des Backdoors BiFrost. Beide sind jetzt in Quarantäne. Heute morgen blockierte avast die Datei 54f4z8qx.vbt wieder in C:\windows\system32\Filt\Temp Ändert das etwas? Oder soll ich dennoch die Anweisungen abarbeiten? Ich warte noch mit dem Runterwerfen von der ganzen Software, bis ich ne Bestätigung von dir habe. Ansonsten noch einmal vielen Dank. Ich werd euch was spenden. Gruß AlX |
|
30.08.2014, 07:00
| #10 |
| /// the machine /// TB-Ausbilder | Trojan.Kazy!WvUyTGribrg (trojan) in AdobeARM.exe Da brauch ich mal bitte das Logfile mit den Funden.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
30.08.2014, 13:08
| #11 |
| | Trojan.Kazy!WvUyTGribrg (trojan) in AdobeARM.exe Lieber Schrauber, ich habe kein richtiges Log, weil ich ja keinen Scan gemacht habe. Zumindest habe ich keine Möglichkeit gefunden ein Log auszugeben. Diese drei Dateien hat Outpost blockiert: BZub in HKEY_LOCAL_MACHINE\software\Microsoft\windows\currentversion\Control Panel\load (29.08.2014) BiFrost in HKEY_USERS\S-1-5-21-3429764466-1293764708-2967138861-1001\software\Wget (29.08.2014) Trojan.Kazy!WvUyTGribrg in C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (26.08.2014) Brauchst du auch die Funde von avast? Soll ich die Progs scannen lassen und dann die Logs posten? Sorry, dass das so kompliziert ist. Gruß AlX |
|
30.08.2014, 15:42
| #12 |
| /// the machine /// TB-Ausbilder | Trojan.Kazy!WvUyTGribrg (trojan) in AdobeARM.exe Ja, scannen und posten, und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
31.08.2014, 20:30
| #13 |
| | Trojan.Kazy!WvUyTGribrg (trojan) in AdobeARM.exe Hallo Schrauber, ich war das Wochenende weg und kann die Scans erst morgen laufen lassen. Ich poste dann morgen abend die Resultate. Soll ich die Quarantäneverzeichnisse vorher löschen oder alles so lassen wie es ist und einfach scannen? Gruß AlX |
|
01.09.2014, 12:38
| #14 |
| /// the machine /// TB-Ausbilder | Trojan.Kazy!WvUyTGribrg (trojan) in AdobeARM.exe einfach scannen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
01.09.2014, 20:15
| #15 |
| | Trojan.Kazy!WvUyTGribrg (trojan) in AdobeARM.exe Hallo Schrauber, ich habe die Scans durchlaufen lassen, aber keine Funde. Das Log von Outpost ist zu groß, um es einzufügen. Ich habe es Anhang beigefügt. Der Scan mit avast brachte ebenfalls keine Funde. Ich habe keine Möglichkeit gefunden ein Log zu exportieren und könnte dir lediglich Screenshots schicken. Heute hatte ich keine Virenmeldung, aber gestern Nacht hat avast die Dateien jb8xnmkw.vbt und 6jkluqzl.vbt blockiert und gibt bei beiden dazu die Meldung Win32:Evo-gen [Susp] Und ein frisches FRST. FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-08-2014 01
Ran by AlX (administrator) on ALX-PC on 01-09-2014 21:02:08
Running from C:\Users\AlX\Downloads
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(Agnitum Ltd.) C:\Program Files\Agnitum\Outpost Security Suite Free\op_mon.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Agnitum Ltd.) C:\Program Files\Agnitum\Outpost Security Suite Free\acs.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
() C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
() C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
(Safer Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 6100\Bin\HPNetworkCommunicator.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2723624 2011-03-28] (Synaptics Incorporated)
HKLM\...\Run: [Power Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [1831528 2011-05-10] (Acer Incorporated)
HKLM\...\Run: [OutpostMonitor] => C:\Program Files\Agnitum\Outpost Security Suite Free\op_mon.exe [4510072 2011-04-04] (Agnitum Ltd.)
HKLM\...\Run: [OutpostFeedBack] => C:\Program Files\Agnitum\Outpost Security Suite Free\feedback.exe [808064 2011-03-30] (Agnitum Ltd.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12921488 2000-01-01] (Realtek Semiconductor)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1103440 2011-07-01] (Dritek System Inc.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642656 2013-03-28] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [4085896 2014-08-10] (AVAST Software)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2011-03-24] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [191528 2014-06-04] (Geek Software GmbH)
HKLM-x32\...\Run: [THGuard] => C:\Program Files (x86)\TrojanHunter 5.6\THGuard.exe [1081808 2014-07-30] (Mischel Internet Security)
HKU\.DEFAULT\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-21-3429764466-1293764708-2967138861-1001\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
AppInit_DLLs: c:\PROGRA~1\Agnitum\OUTPOS~1\wl_hook64.dll => c:\Program Files\Agnitum\Outpost Security Suite Free\wl_hook64.dll [983664 2011-03-30] (Agnitum Ltd.)
AppInit_DLLs-x32: c:\PROGRA~1\Agnitum\OUTPOS~1\wl_hook.dll => c:\Program Files\Agnitum\Outpost Security Suite Free\wl_hook.dll [701456 2011-03-30] (Agnitum Ltd.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\p6_19_erinnerung.lnk
ShortcutTarget: p6_19_erinnerung.lnk -> C:\Program Files (x86)\phase6\phase6_19\WinStart\WinStart.exe (phase6)
Startup: C:\Users\AlX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Officejet 6100 (Netzwerk).lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Officejet 6100 (Netzwerk).lnk -> C:\Program Files\HP\HP Officejet 6100\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)
ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: Outpost -> {33C9E362-3EDA-4930-8AFE-5DA39A8BB77A} => C:\Program Files\Agnitum\Outpost Security Suite Free\op_shell.dll (Agnitum Ltd.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
ProxyServer: 127.0.0.1:9666
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: No Name -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> No File
BHO-x32: Spybot-S&D IE Protection -> {53707962-6F74-2D53-2644-206D7942484F} -> C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
BHO-x32: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre8\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre8\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
FireFox:
========
FF ProfilePath: C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default
FF Homepage: https://startpage.com/do/search
FF NetworkProxy: "socks_version", 4
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=11.5.2 -> C:\Program Files (x86)\Java\jre8\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.5.2 -> C:\Program Files (x86)\Java\jre8\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @protectdisc.com/NPPDLicenseHelper -> C:\Program Files (x86)\ProtectDisc\License Helper\NPPDLicenseHelper.dll ()
FF Plugin-x32: @real.com/nppl3260;version=15.0.6.14 -> C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprjplug;version=15.0.6.14 -> C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpchromebrowserrecordext;version=15.0.6.14 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprphtml5videoshim;version=15.0.6.14 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=15.0.6.14 -> C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\searchplugins\ixquick-https---deutsch.xml
FF SearchPlugin: C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\searchplugins\nation-secure-search.xml
FF SearchPlugin: C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\searchplugins\startpage-https---deutsch.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: ProxTube - Unblock YouTube - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\ich@maltegoetz.de [2014-01-26]
FF Extension: YouTube Unblocker - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\youtubeunblocker@unblocker.yt [2014-06-06]
FF Extension: WOT - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2013-11-26]
FF Extension: Adblock Plus Pop-up Addon - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\adblockpopups@jessehakanen.net.xpi [2014-01-04]
FF Extension: Proxy-Listen.de - Proxyswitcher - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\admin@proxy-listen.de.xpi [2014-07-17]
FF Extension: Add-on Compatibility Reporter - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\compatibility@addons.mozilla.org.xpi [2013-07-12]
FF Extension: Hide My Ass Proxy Extension - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\extension@hidemyass.com.xpi [2014-01-04]
FF Extension: Ghostery - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\firefox@ghostery.com.xpi [2013-10-18]
FF Extension: One Click Proxy - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\jid0-zXo3XFGyiDalgkeEO4UYJTUwo2I@jetpack.xpi [2014-02-22]
FF Extension: Lightbeam - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\jid1-F9UJ2thwoAm5gQ@jetpack.xpi [2013-11-27]
FF Extension: Proxy Selector - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\proxyselector@mozilla.org.xpi [2014-07-17]
FF Extension: Proxy Tool - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\proxytool@proxylist.co.xpi [2014-07-17]
FF Extension: Speed DNS - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\speeddns@gmail.com.xpi [2014-01-18]
FF Extension: ProxTube - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\{2541D29A-DB9E-4c1e-949A-31EFB4AEF4E7}.xpi [2014-08-10]
FF Extension: Cookie Cutter - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\{4d14a68e-9a97-4358-8603-ed67b332cef1}.xpi [2014-07-17]
FF Extension: UltraSurf Firefox Tool - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\{5B52016C-D097-4aec-BE61-9F129D8FDDBA}.xpi [2014-07-17]
FF Extension: NoScript - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-02-21]
FF Extension: HideMyAss - Free Web Proxy - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\{9aba569a-d0cc-427d-bd2a-27bfd7ce544c}.xpi [2014-07-17]
FF Extension: BetterPrivacy - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi [2014-07-17]
FF Extension: Torbutton - C:\Users\AlX\AppData\Roaming\Mozilla\Firefox\Profiles\ca5205je.default\Extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}.xpi [2014-07-17]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2014-08-10]
FF HKLM-x32\...\Firefox\Extensions: [{0153E448-190B-4987-BDE1-F256CADA672F}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF Extension: RealPlayer Browser Record Plugin - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012-09-15]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-12-16]
FF HKCU\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: No Name - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
Chrome:
=======
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-07-17]
CHR HKLM-x32\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Ext\rphtml5video.crx [2012-09-15]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 acssrv; C:\Program Files\Agnitum\Outpost Security Suite Free\acs.exe [3501696 2011-04-04] (Agnitum Ltd.)
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2013-03-28] (Advanced Micro Devices, Inc.) [File not signed]
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-07-17] (AVAST Software)
S3 CGVPNCliSrvc; C:\Program Files\CyberGhost VPN\CGVPNCliService.exe [2438696 2012-04-26] (mobile concepts GmbH)
R2 DirMngr; C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe [218112 2013-07-16] () [File not signed]
R2 GREGService; C:\Program Files (x86)\Acer\Registration\GREGsvc.exe [29696 2011-05-26] (Acer Incorporated) [File not signed]
R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [116104 2010-04-05] ()
S2 libusbd; C:\Windows\SysWOW64\libusbd-nt.exe [18944 2005-03-09] (hxxp://libusb-win32.sourceforge.net) [File not signed]
S2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [256832 2011-04-24] (NTI Corporation)
S2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
R2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
S2 McAfee SiteAdvisor Service; No ImagePath
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R1 afw; C:\Windows\System32\DRIVERS\afw.sys [39528 2010-04-20] (Agnitum Ltd.)
R3 afwcore; C:\Windows\System32\drivers\afwcore.sys [424040 2010-09-27] (Agnitum Ltd.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R3 ASWFilt; C:\Windows\system32\Filt\ASWFilt64.dll [49168 2011-03-21] (Agnitum Ltd.)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-07-17] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-07-17] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-07-17] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-07-17] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1041168 2014-07-17] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427360 2014-07-17] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [92008 2014-07-17] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [224896 2014-07-17] ()
R3 L1C; C:\Windows\System32\DRIVERS\L1C60x64.sys [120520 2013-04-26] (Qualcomm Atheros Co., Ltd.)
S3 libusb0; C:\Windows\SysWOW64\drivers\libusb0.sys [33792 2005-03-09] () [File not signed]
R1 SandBox; C:\Windows\system32\drivers\SandBox64.sys [1097672 2011-03-21] (Agnitum Ltd.)
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [16152 2013-06-15] ()
R3 VBEngNT; C:\Windows\system32\drivers\VBEngNT.sys [293048 2011-02-02] (VirusBuster Kft.)
R3 VBFilt; C:\Windows\system32\Filt\VBFilt64.dll [42976 2011-03-21] (Agnitum Ltd.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-01 13:40 - 2014-09-01 13:40 - 00000022 _____ () C:\Windows\S.dirmngr
2014-08-28 20:37 - 2014-08-28 20:36 - 00319912 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-08-28 20:37 - 2014-08-28 20:36 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-08-28 20:37 - 2014-08-28 20:36 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-08-28 20:37 - 2014-08-28 20:36 - 00111016 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2014-08-28 20:36 - 2014-08-28 20:36 - 00000000 ____D () C:\Program Files\Java
2014-08-28 19:14 - 2014-08-28 19:14 - 00854417 _____ () C:\Users\AlX\Downloads\SecurityCheck.exe
2014-08-28 16:54 - 2014-08-28 16:54 - 02347384 _____ (ESET) C:\Users\AlX\Downloads\esetsmartinstaller_deu.exe
2014-08-27 22:23 - 2014-08-23 04:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-27 22:23 - 2014-08-23 03:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-27 22:23 - 2014-08-23 02:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-27 18:39 - 2014-08-27 18:39 - 00002132 _____ () C:\Users\AlX\Desktop\JRT.txt
2014-08-26 14:39 - 2014-08-26 14:39 - 00023933 _____ () C:\ComboFix.txt
2014-08-26 14:06 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-08-26 14:06 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-08-26 14:06 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-08-26 14:06 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-08-26 14:06 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-08-26 14:06 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-08-26 14:06 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-08-26 14:06 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-08-26 14:04 - 2014-08-26 14:40 - 00000000 ____D () C:\Qoobox
2014-08-26 14:02 - 2014-08-26 14:32 - 00000000 ____D () C:\Windows\erdnt
2014-08-26 14:01 - 2014-08-26 14:01 - 05572212 ____R (Swearware) C:\Users\AlX\Downloads\ComboFix.exe
2014-08-26 01:32 - 2014-08-26 01:32 - 00380416 _____ () C:\Users\AlX\Downloads\qwfin87w.exe
2014-08-26 01:26 - 2014-08-26 01:40 - 00034368 _____ () C:\Users\AlX\Downloads\Addition.txt
2014-08-26 01:24 - 2014-09-01 21:02 - 00020658 _____ () C:\Users\AlX\Downloads\FRST.txt
2014-08-26 01:24 - 2014-09-01 21:02 - 00000000 ____D () C:\FRST
2014-08-26 01:23 - 2014-08-26 01:23 - 02103296 _____ (Farbar) C:\Users\AlX\Downloads\FRST64.exe
2014-08-26 01:22 - 2014-08-26 01:22 - 00000000 _____ () C:\Users\AlX\defogger_reenable
2014-08-26 01:21 - 2014-08-26 01:21 - 00050477 _____ () C:\Users\AlX\Downloads\Defogger.exe
2014-08-26 00:20 - 2014-08-27 17:41 - 00001210 _____ () C:\Windows\PFRO.log
2014-08-26 00:18 - 2014-08-26 00:18 - 00000000 ____D () C:\Users\AlX\AppData\Roaming\TrojanHunter
2014-08-25 20:44 - 2014-09-01 13:43 - 00001512 _____ () C:\Windows\setupact.log
2014-08-25 20:44 - 2014-08-25 20:44 - 00000000 _____ () C:\Windows\setuperr.log
2014-08-25 20:20 - 2014-08-25 20:20 - 00078984 _____ () C:\Users\AlX\Documents\25.08.2014registry.reg
2014-08-25 20:10 - 2014-08-25 20:10 - 00000000 ____D () C:\Users\AlX\Downloads\tor
2014-08-25 17:06 - 2014-08-25 17:06 - 00000000 ____D () C:\Users\AlX\AppData\Roaming\KeePass
2014-08-25 15:57 - 2014-08-25 15:57 - 04334200 _____ (Bytelayer AB ) C:\Users\AlX\Downloads\TrojanHunterSetup.exe
2014-08-25 15:54 - 2014-08-25 15:54 - 00001071 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KeePass.lnk
2014-08-25 15:54 - 2014-08-25 15:54 - 00000000 ____D () C:\Program Files (x86)\KeePass Password Safe
2014-08-25 15:52 - 2014-08-28 17:57 - 00000000 ____D () C:\Program Files (x86)\TrojanHunter 5.6
2014-08-25 15:52 - 2014-08-25 15:58 - 00000000 ____D () C:\ProgramData\TrojanHunter
2014-08-25 15:52 - 2014-08-25 15:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TrojanHunter
2014-08-25 15:52 - 2014-08-25 15:52 - 00059392 ____R () C:\Windows\SysWOW64\streamhlp.dll
2014-08-25 15:51 - 2014-08-25 15:51 - 01101648 _____ () C:\Users\AlX\Downloads\TrojanHunter - CHIP-Installer.exe
2014-08-25 15:48 - 2014-09-01 20:50 - 00327758 _____ () C:\Windows\WindowsUpdate.log
2014-08-21 09:48 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-08-21 09:48 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-08-21 09:48 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-08-21 09:48 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-08-21 09:47 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-08-21 09:47 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-08-21 09:47 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-08-21 09:47 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2014-08-21 09:47 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-08-21 09:47 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-08-21 09:47 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-08-21 09:47 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-08-21 09:47 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-08-21 09:47 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2014-08-13 20:15 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-08-13 20:15 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll
2014-08-13 20:15 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-08-13 20:15 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-08-13 20:15 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe
2014-08-13 20:15 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll
2014-08-13 20:14 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-08-13 20:14 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-08-13 16:45 - 2014-08-01 01:16 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-08-13 16:45 - 2014-07-25 16:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-13 16:45 - 2014-07-25 16:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-08-13 16:45 - 2014-07-25 15:51 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-08-13 16:45 - 2014-07-25 15:28 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-08-13 16:45 - 2014-07-25 15:10 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-08-13 16:45 - 2014-07-25 14:34 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-08-13 16:45 - 2014-07-25 14:33 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-08-13 16:45 - 2014-07-25 14:28 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-08-13 16:45 - 2014-07-25 14:21 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-08-13 16:45 - 2014-07-25 14:17 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-08-13 16:45 - 2014-07-25 14:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-08-13 16:45 - 2014-07-25 13:52 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-08-13 16:45 - 2014-07-25 13:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-08-13 16:45 - 2014-07-25 13:42 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-08-13 16:45 - 2014-07-25 13:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-08-13 16:45 - 2014-07-25 13:13 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-08-13 16:45 - 2014-07-25 13:07 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-08-13 16:45 - 2014-07-25 12:26 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-13 16:45 - 2014-07-25 12:00 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-08-13 16:45 - 2014-07-16 05:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-08-13 16:45 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-08-13 16:45 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
2014-08-13 16:45 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
2014-08-13 16:45 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
2014-08-13 16:45 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2014-08-13 16:45 - 2014-07-09 04:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
2014-08-13 16:45 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL
2014-08-13 16:45 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL
2014-08-13 16:45 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL
2014-08-13 16:45 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL
2014-08-13 16:45 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
2014-08-13 16:45 - 2014-07-09 00:38 - 00419992 _____ () C:\Windows\system32\locale.nls
2014-08-13 16:45 - 2014-07-09 00:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls
2014-08-13 16:45 - 2014-06-25 04:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-08-13 16:45 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-08-13 16:45 - 2014-06-16 04:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-08-13 16:45 - 2014-06-03 12:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-08-13 16:45 - 2014-06-03 12:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-08-13 16:45 - 2014-06-03 12:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-08-13 16:45 - 2014-06-03 12:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-08-13 16:45 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-08-13 16:45 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-08-13 16:45 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-08-13 16:44 - 2014-08-01 01:41 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-13 16:44 - 2014-07-25 16:52 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-13 16:44 - 2014-07-25 15:30 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-08-13 16:44 - 2014-07-25 15:28 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-08-13 16:44 - 2014-07-25 15:25 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-13 16:44 - 2014-07-25 15:25 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-08-13 16:44 - 2014-07-25 15:11 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-13 16:44 - 2014-07-25 15:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-08-13 16:44 - 2014-07-25 15:03 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-08-13 16:44 - 2014-07-25 15:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-08-13 16:44 - 2014-07-25 15:00 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-08-13 16:44 - 2014-07-25 14:59 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-08-13 16:44 - 2014-07-25 14:47 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-08-13 16:44 - 2014-07-25 14:40 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-13 16:44 - 2014-07-25 14:34 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-08-13 16:44 - 2014-07-25 14:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-08-13 16:44 - 2014-07-25 14:28 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-13 16:44 - 2014-07-25 14:19 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-08-13 16:44 - 2014-07-25 14:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-08-13 16:44 - 2014-07-25 14:17 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-13 16:44 - 2014-07-25 14:12 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-08-13 16:44 - 2014-07-25 14:10 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-13 16:44 - 2014-07-25 14:10 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-08-13 16:44 - 2014-07-25 14:06 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-08-13 16:44 - 2014-07-25 13:47 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-13 16:44 - 2014-07-25 13:39 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-13 16:44 - 2014-07-25 13:39 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-08-13 16:44 - 2014-07-25 13:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-08-13 16:44 - 2014-07-25 13:29 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-08-13 16:44 - 2014-07-25 13:23 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-13 16:44 - 2014-07-25 13:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-08-13 16:44 - 2014-07-25 13:03 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-08-13 16:44 - 2014-07-25 12:52 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-13 16:44 - 2014-07-25 12:17 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-08-13 16:44 - 2014-07-25 12:09 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-08-13 16:44 - 2014-07-25 12:05 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-08-13 16:43 - 2014-08-07 04:06 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-13 16:43 - 2014-08-07 04:01 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-13 16:43 - 2014-07-14 04:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-08-13 16:43 - 2014-07-14 03:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2014-08-10 16:35 - 2014-08-10 16:35 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-01 21:03 - 2014-08-26 01:24 - 00020658 _____ () C:\Users\AlX\Downloads\FRST.txt
2014-09-01 21:02 - 2014-08-26 01:24 - 00000000 ____D () C:\FRST
2014-09-01 20:54 - 2009-07-14 06:45 - 00024400 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-01 20:54 - 2009-07-14 06:45 - 00024400 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-01 20:50 - 2014-08-25 15:48 - 00327758 _____ () C:\Windows\WindowsUpdate.log
2014-09-01 20:49 - 2012-01-08 17:23 - 00158053 _____ () C:\Windows\system32\config\rules.rdb
2014-09-01 20:17 - 2013-10-17 22:56 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-01 17:20 - 2011-12-20 00:51 - 00007606 _____ () C:\Users\AlX\AppData\Local\Resmon.ResmonCfg
2014-09-01 13:43 - 2014-08-25 20:44 - 00001512 _____ () C:\Windows\setupact.log
2014-09-01 13:42 - 2013-12-16 11:56 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-09-01 13:40 - 2014-09-01 13:40 - 00000022 _____ () C:\Windows\S.dirmngr
2014-09-01 13:40 - 2013-09-05 13:35 - 00000000 ____D () C:\Users\Public\Documents\phase6_19_Daten
2014-09-01 13:40 - 2013-07-13 14:37 - 00000322 _____ () C:\Windows\Tasks\GlaryInitialize.job
2014-09-01 13:40 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-31 23:37 - 2011-12-10 03:09 - 00523928 _____ () C:\Windows\system32\config\afw_db.conf
2014-08-31 23:37 - 2011-12-10 03:09 - 00074496 _____ () C:\Windows\system32\config\afw_hm.conf
2014-08-31 21:27 - 2011-12-10 01:51 - 00000000 ____D () C:\Windows\system32\Filt
2014-08-28 20:36 - 2014-08-28 20:37 - 00319912 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-08-28 20:36 - 2014-08-28 20:37 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-08-28 20:36 - 2014-08-28 20:37 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-08-28 20:36 - 2014-08-28 20:37 - 00111016 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2014-08-28 20:36 - 2014-08-28 20:36 - 00000000 ____D () C:\Program Files\Java
2014-08-28 19:14 - 2014-08-28 19:14 - 00854417 _____ () C:\Users\AlX\Downloads\SecurityCheck.exe
2014-08-28 17:57 - 2014-08-25 15:52 - 00000000 ____D () C:\Program Files (x86)\TrojanHunter 5.6
2014-08-28 16:54 - 2014-08-28 16:54 - 02347384 _____ (ESET) C:\Users\AlX\Downloads\esetsmartinstaller_deu.exe
2014-08-28 12:12 - 2009-07-14 06:45 - 00297112 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-27 18:39 - 2014-08-27 18:39 - 00002132 _____ () C:\Users\AlX\Desktop\JRT.txt
2014-08-27 17:41 - 2014-08-26 00:20 - 00001210 _____ () C:\Windows\PFRO.log
2014-08-27 17:40 - 2013-11-02 18:35 - 00000000 ____D () C:\AdwCleaner
2014-08-27 17:04 - 2014-07-08 15:26 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-26 14:40 - 2014-08-26 14:04 - 00000000 ____D () C:\Qoobox
2014-08-26 14:39 - 2014-08-26 14:39 - 00023933 _____ () C:\ComboFix.txt
2014-08-26 14:39 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2014-08-26 14:32 - 2014-08-26 14:02 - 00000000 ____D () C:\Windows\erdnt
2014-08-26 14:27 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-08-26 14:23 - 2009-07-14 04:34 - 77070336 _____ () C:\Windows\system32\config\software.bak
2014-08-26 14:23 - 2009-07-14 04:34 - 22806528 _____ () C:\Windows\system32\config\system.bak
2014-08-26 14:23 - 2009-07-14 04:34 - 04980736 _____ () C:\Windows\system32\config\default.bak
2014-08-26 14:23 - 2009-07-14 04:34 - 00024576 _____ () C:\Windows\system32\config\security.bak
2014-08-26 14:23 - 2009-07-14 04:34 - 00024576 _____ () C:\Windows\system32\config\sam.bak
2014-08-26 14:01 - 2014-08-26 14:01 - 05572212 ____R (Swearware) C:\Users\AlX\Downloads\ComboFix.exe
2014-08-26 01:40 - 2014-08-26 01:26 - 00034368 _____ () C:\Users\AlX\Downloads\Addition.txt
2014-08-26 01:32 - 2014-08-26 01:32 - 00380416 _____ () C:\Users\AlX\Downloads\qwfin87w.exe
2014-08-26 01:23 - 2014-08-26 01:23 - 02103296 _____ (Farbar) C:\Users\AlX\Downloads\FRST64.exe
2014-08-26 01:22 - 2014-08-26 01:22 - 00000000 _____ () C:\Users\AlX\defogger_reenable
2014-08-26 01:22 - 2011-12-10 00:48 - 00000000 ____D () C:\Users\AlX
2014-08-26 01:21 - 2014-08-26 01:21 - 00050477 _____ () C:\Users\AlX\Downloads\Defogger.exe
2014-08-26 00:20 - 2012-05-10 13:58 - 00068744 _____ () C:\Users\AlX\AppData\Local\GDIPFONTCACHEV1.DAT
2014-08-26 00:18 - 2014-08-26 00:18 - 00000000 ____D () C:\Users\AlX\AppData\Roaming\TrojanHunter
2014-08-26 00:18 - 2012-05-26 01:56 - 00007767 _____ () C:\ProgramData\hpzinstall.log
2014-08-25 20:44 - 2014-08-25 20:44 - 00000000 _____ () C:\Windows\setuperr.log
2014-08-25 20:30 - 2012-05-26 01:58 - 00000000 ____D () C:\Program Files (x86)\HP
2014-08-25 20:26 - 2012-02-13 19:25 - 00000000 ____D () C:\Program Files (x86)\Google
2014-08-25 20:23 - 2012-02-13 19:25 - 00000000 ____D () C:\Users\AlX\AppData\Local\Google
2014-08-25 20:20 - 2014-08-25 20:20 - 00078984 _____ () C:\Users\AlX\Documents\25.08.2014registry.reg
2014-08-25 20:18 - 2011-12-09 21:21 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-08-25 20:10 - 2014-08-25 20:10 - 00000000 ____D () C:\Users\AlX\Downloads\tor
2014-08-25 17:06 - 2014-08-25 17:06 - 00000000 ____D () C:\Users\AlX\AppData\Roaming\KeePass
2014-08-25 15:58 - 2014-08-25 15:52 - 00000000 ____D () C:\ProgramData\TrojanHunter
2014-08-25 15:57 - 2014-08-25 15:57 - 04334200 _____ (Bytelayer AB ) C:\Users\AlX\Downloads\TrojanHunterSetup.exe
2014-08-25 15:57 - 2014-08-25 15:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TrojanHunter
2014-08-25 15:54 - 2014-08-25 15:54 - 00001071 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KeePass.lnk
2014-08-25 15:54 - 2014-08-25 15:54 - 00000000 ____D () C:\Program Files (x86)\KeePass Password Safe
2014-08-25 15:52 - 2014-08-25 15:52 - 00059392 ____R () C:\Windows\SysWOW64\streamhlp.dll
2014-08-25 15:51 - 2014-08-25 15:51 - 01101648 _____ () C:\Users\AlX\Downloads\TrojanHunter - CHIP-Installer.exe
2014-08-25 15:48 - 2012-01-16 17:27 - 00000000 ____D () C:\Users\AlX\AppData\Roaming\uTorrent
2014-08-25 15:11 - 2012-04-18 22:24 - 00000000 ____D () C:\Program Files (x86)\Klett
2014-08-25 15:11 - 2012-01-29 03:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Klett
2014-08-24 14:02 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration
2014-08-24 01:27 - 2011-09-26 10:53 - 00699666 _____ () C:\Windows\system32\perfh007.dat
2014-08-24 01:27 - 2011-09-26 10:53 - 00149774 _____ () C:\Windows\system32\perfc007.dat
2014-08-24 01:27 - 2009-07-14 07:13 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-23 04:07 - 2014-08-27 22:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-23 03:45 - 2014-08-27 22:23 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-23 02:59 - 2014-08-27 22:23 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-20 14:56 - 2012-02-03 17:13 - 00000000 ____D () C:\ProgramData\CanonIJPLM
2014-08-19 00:54 - 2012-04-27 15:41 - 00000000 ____D () C:\Users\AlX\AppData\Local\Paint.NET
2014-08-16 14:59 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-08-13 23:42 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-08-13 20:26 - 2013-07-14 13:17 - 00000000 ____D () C:\Windows\system32\MRT
2014-08-13 20:22 - 2011-12-09 22:31 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-08-13 20:13 - 2014-05-07 11:35 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-08-12 17:49 - 2012-05-15 18:12 - 00000000 ____D () C:\Users\AlX\AppData\Roaming\Audacity
2014-08-11 00:47 - 2012-05-05 17:36 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-08-10 16:35 - 2014-08-10 16:35 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-08-07 04:06 - 2014-08-13 16:43 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-07 04:01 - 2014-08-13 16:43 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
Some content of TEMP:
====================
C:\Users\AlX\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-08-17 19:18
==================== End Of Log ============================
--- --- --- [/code] Tausend Dank! Gruß AlX |
|
| Themen zu Trojan.Kazy!WvUyTGribrg (trojan) in AdobeARM.exe |
| abelssoft, ad-aware, antivirus, branding, canon, converter, cyberghost, desktop, device driver, downloader, dvdvideosoft ltd., feedback, firefox, flash player, home, homepage, launch, mozilla, mp3, msiexec.exe, netzwerk, officejet, realtek, registry, safer networking, schannel.dll, security, siteadvisor, software, starten, svchost.exe, system, trojaner, viren, virus, windows, wma |
WARNUNG an die MITLESER: 
Linear-Darstellung
