| |
| |||||||
Log-Analyse und Auswertung: Laptop langsam, mbam zeigt Funde-log bleibt leer?Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
27.08.2014, 20:07
| #1 |
 |  Laptop langsam, mbam zeigt Funde-log bleibt leer? Hallo, der Laptop meiner Eltern ist auffällig langsam geworden. Ich hab heute mal Mb A-M installiert und scannen lassen. Das Programm zeigte 371 Funde! Ich hab alle in Quarantäne gestellt und eine logfile erstellt, doch die zeigte die Funde nicht an: Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 27.08.2014 Suchlauf-Zeit: 17:47:47 Logdatei: mbam.txt Administrator: Ja Version: 2.00.2.1012 Malware Datenbank: v2014.08.27.04 Rootkit Datenbank: v2014.08.21.01 Lizenz: Testversion Malware Schutz: Aktiviert Bösartiger Webseiten Schutz: Aktiviert Self-protection: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x86 Dateisystem: NTFS Benutzer: mikni Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 368756 Verstrichene Zeit: 39 Min, 27 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristics: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 0 (No malicious items detected) Registrierungswerte: 0 (No malicious items detected) Registrierungsdaten: 0 (No malicious items detected) Ordner: 0 (No malicious items detected) Dateien: 0 (No malicious items detected) Physische Sektoren: 0 (No malicious items detected) (end) frst: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:26-08-2014 Ran by mikni (administrator) on MIKNI-PC on 27-08-2014 18:52:17 Running from C:\Users\mikni\Downloads Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 Boot Mode: Normal The only official download link for FRST: Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9691412ff1876250\stacsv.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (Microsoft Corporation) C:\Windows\System32\wisptis.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe (SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EBAPI\eEBSvc.exe (ArcSoft Inc.) C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (Andrea Electronics Corporation) C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9691412ff1876250\AEstSrv.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe (BlueStack Systems, Inc.) C:\Program Files\BlueStacks\HD-LogRotatorService.exe (SEIKO EPSON CORPORATION) C:\Program Files\EPSON Projector\Epson USB Display V1.6\EMP_UDSA.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe (Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe (Lexmark International, Inc.) C:\Windows\System32\spool\drivers\w32x86\3\lxdxserv.exe ( ) C:\Windows\System32\lxdxcoms.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe () C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe () C:\Program Files\SMINST\BLService.exe () C:\Users\mikni\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe (TomTom) C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe (Microsoft Corporation) C:\Windows\System32\wisptis.exe (Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe (Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe ( Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe (CyberLink Corp.) C:\Program Files\HP\QuickPlay\QPService.exe (Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe (Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (ACD Systems International Inc.) C:\Program Files\Common Files\ACD Systems\DE\DevDetect.exe (IDT, Inc.) C:\Program Files\IDT\WDM\sttray.exe (Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe (RealNetworks, Inc.) C:\Program Files\Real\RealPlayer\Update\realsched.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE (Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe (Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe (X10) C:\Program Files\Common Files\X10\Common\X10nets.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe () C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe (Hewlett-Packard Development Company L.P.) C:\Program Files\Hewlett-Packard\Shared\hpCaslNotification.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe (Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe (Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [NvCplDaemon] => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup HKLM\...\Run: [NvMediaCenter] => RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1410344 2008-12-05] (Synaptics, Inc.) HKLM\...\Run: [QlbCtrl.exe] => C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [206128 2008-10-10] ( Hewlett-Packard Development Company, L.P.) HKLM\...\Run: [QPService] => C:\Program Files\HP\QuickPlay\QPService.exe [468264 2008-09-23] (CyberLink Corp.) HKLM\...\Run: [WirelessAssistant] => C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [432432 2008-12-08] (Hewlett-Packard) HKLM\...\Run: [Device Detector] => DevDetect.exe -autorun HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray.exe [495708 2010-03-23] (IDT, Inc.) HKLM\...\Run: [HP Software Update] => C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-05-10] (Hewlett-Packard) HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [751184 2014-08-27] (Avira Operations GmbH & Co. KG) HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKLM\...\Run: [Ocs_SM] => C:\Users\mikni\AppData\Roaming\OCS\SM\SearchAnonymizer.exe [106496 2011-08-14] (OCS) HKLM\...\Run: [TkBellExe] => C:\Program Files\Real\RealPlayer\update\realsched.exe [295512 2013-07-03] (RealNetworks, Inc.) HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM\...\Run: [Avira Systray] => C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe [161584 2014-08-04] (Avira Operations GmbH & Co. KG) HKU\S-1-5-21-2371883574-2620108736-2103921141-1000\...\Run: [swg] => C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2010-01-09] (Google Inc.) HKU\S-1-5-21-2371883574-2620108736-2103921141-1000\...\Run: [OfficeSyncProcess] => C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE [720064 2013-04-22] (Microsoft Corporation) HKU\S-1-5-21-2371883574-2620108736-2103921141-1000\...\Run: [Device Detector] => DevDetect.exe -autorun HKU\S-1-5-21-2371883574-2620108736-2103921141-1000\...\MountPoints2: {392e466b-d241-11e0-a9a5-00238bfba56f} - F:\Startme.exe HKU\S-1-5-21-2371883574-2620108736-2103921141-1000\...\MountPoints2: {b8b16f4c-dd59-11e2-aa9c-00238bfba56f} - F:\EMP_UDSe.exe /autorun AppInit_DLLs: c:\progra~2\browse~1\25986~1.67\{c16c1~1\browse~1.dll => c:\progra~2\browse~1\25986~1.67\{c16c1~1\browse~1.dll File Not Found Startup: C:\Users\mikni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation) ShellIconOverlayIdentifiers: GDriveBlacklistedOverlay -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google) ShellIconOverlayIdentifiers: GDriveSharedEditOverlay -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google) ShellIconOverlayIdentifiers: GDriveSharedOverlay -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google) ShellIconOverlayIdentifiers: GDriveSharedViewOverlay -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google) ShellIconOverlayIdentifiers: GDriveSyncedOverlay -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google) ShellIconOverlayIdentifiers: GDriveSyncingOverlay -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.t-online.de/cpm-redir/ie-9.html HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xB17278A577C7CB01 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm URLSearchHook: HKLM - Freeware.de Toolbar - {7e111a5c-3d11-4f56-9463-5310c3c69025} - C:\Program Files\Freeware.de\prxtbFre2.dll (Conduit Ltd.) URLSearchHook: HKCU - Freeware.de Toolbar - {7e111a5c-3d11-4f56-9463-5310c3c69025} - C:\Program Files\Freeware.de\prxtbFre2.dll (Conduit Ltd.) SearchScopes: HKLM - {82BD1D8A-D6EB-48F9-A5B2-6DDEB211E69D} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008 SearchScopes: HKLM - {9E4174C9-9BC1-42B3-A92D-8FEC8820C0B4} URL = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933 SearchScopes: HKLM - {EE97B51A-20F2-4B92-BE28-538D5E0DADA1} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcnnbie7-de-de SearchScopes: HKCU - DefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = SearchScopes: HKCU - {021081C2-02C9-424E-9873-6A797D4101B5} URL = hxxp://www.myvideo.de.anonymize-me.de/?to=6D79766964656F2E6465&st={searchTerms}&clid=86e5132c-e238-4158-8bf4-8cbe80bc2aa1&pid=freewarede&mode=bounce&k=0 SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com.anonymize-me.de/?anonymto=687474703A2F2F7777772E62696E672E636F6D2F7365617263683F464F524D3D4945464D3126713D7B7365617263685465726D737D267372633D7B72656665727265723A736F757263653F7D&st={searchTerms}&clid=86e5132c-e238-4158-8bf4-8cbe80bc2aa1&pid=freewarede&k=0 SearchScopes: HKCU - {14D7137A-B39B-4023-A6FA-1CB08201004B} URL = hxxp://rover.ebay.com.anonymize-me.de/?anonymto=687474703A2F2F726F7665722E656261792E636F6D2F726F7665722F312F3730372D313430332D3237363430322F343F6D7072653D687474703A2F2F7365617263682E656261792E64652F7365617263682F7365617263682E646C6C3F73686F72746375743D342671756572793D7B736561722063685465726D737D&st={searchTerms}&clid=86e5132c-e238-4158-8bf4-8cbe80bc2aa1&pid=freewarede&k=0 SearchScopes: HKCU - {1E32904B-FB1D-4414-9492-5907EEC63E00} URL = hxxp://www.otto.de.anonymize-me.de/?to=6F74746F2E6465&st={searchTerms}&clid=86e5132c-e238-4158-8bf4-8cbe80bc2aa1&pid=freewarede&mode=bounce&k=0 SearchScopes: HKCU - {29F8EFCB-6EB9-424C-AFF8-ACBCB1429B51} URL = hxxp://www.amazon.de.anonymize-me.de/?anonymto=687474703A2F2F7777772E616D617A6F6E2E64652F67702F7365617263683F69653D55544638266B6579776F7264733D7B7365617263685465726D737D267461673D20696E7465726163746976656D657375636865323126696E6465783D626C656E646564266C696E6B436F64653D7572322663616D703D313633382663726561746976653D36373432&st={searchTerms}&clid=86e5132c-e238-4158-8bf4-8cbe80bc2aa1&pid=freewarede&k=0 SearchScopes: HKCU - {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL = SearchScopes: HKCU - {53C9276A-631C-4A7F-9854-49DEEA585085} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=FF&o=14594&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=FV&apn_dtid=YYYYYYYYDE&apn_uid=3ec93ff4-a759-44e6-a05f-ba38adc9f199&apn_sauid=391BFD79-D282-4B88-AE3A-9CDB426ADF17& SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com.anonymize-me.de/?anonymto=687474703A2F2F7777772E676F6F676C652E636F6D2F7365617263683F713D7B7365617263685465726D737D26726C733D636F6D2E6D6963726F736F66743A7B6C616E67756167657D3A7B72656665727265723A736F757263653F7D2669653D7B696E707574456E636F64696E677D266F653D7B6F7574707574456E636F64696E677D26736F7572636569643D69653726726C7A3D31493753554E435F6465&st={searchTerms}&clid=86e5132c-e238-4158-8bf4-8cbe80bc2aa1&pid=freewarede&k=0 SearchScopes: HKCU - {82BD1D8A-D6EB-48F9-A5B2-6DDEB211E69D} URL = hxxp://de.search.yahoo.com/search?p={searchterms}&ei=UTF-8&fr=w3i&type=W3i_DS,136,0_0,Search,20120104,17131,0,18,0 SearchScopes: HKCU - {8740AE73-3D39-4C4D-A94B-A7841F7048A1} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3241949 SearchScopes: HKCU - {99957794-C23E-426C-BDA7-ACA655BFFF59} URL = hxxp://suche.t-online.de.anonymize-me.de/?anonymto=687474703A2F2F73756368652E742D6F6E6C696E652E64652F666173746367692F7473633F6D616E64616E743D746F69266465766963653D68746D6C26706F7274616C6C616E67756167653D646526757365726C616E67756167653D646526642069613D737563686526636F6E746578743D77696B692D746162267470633D696E7465726E65742670746C3D73746426636C617373696669636174696F6E3D77696B697461625F696E7465726E65745F73746426713D7B7365617263685465726D737D2662723D6965372D746F69&st={searchTerms}&clid=86e5132c-e238-4158-8bf4-8cbe80bc2aa1&pid=freewarede&k=0 SearchScopes: HKCU - {9E4174C9-9BC1-42B3-A92D-8FEC8820C0B4} URL = hxxp://de.kelkoopartners.net.anonymize-me.de/?anonymto=687474703A2F2F64652E6B656C6B6F6F706172746E6572732E6E65742F63746C2F646F2F7365617263683F7369746553656172636851756572793D7B7365617263685465726D737D2666726F6D666F726D3D7472756526783D7472756526793D7472756526706172746E65723D687026706172746E657249643D3936393133393333&st={searchTerms}&clid=86e5132c-e238-4158-8bf4-8cbe80bc2aa1&pid=freewarede&k=0 SearchScopes: HKCU - {C04B7D22-5AEC-4561-8F49-27F6269208F6} URL = hxxp://toolbar.inbox.com/search/dispatcher.aspx?tp=bs&qkw={searchTerms}&tbid=80772&lng=de SearchScopes: HKCU - {E32017CE-5FF5-4EFE-B30A-2DC420D03294} URL = hxxp://suche.t-online.de.anonymize-me.de/?anonymto=687474703A2F2F73756368652E742D6F6E6C696E652E64652F666173746367692F7473633F6D616E64616E743D746F69266465766963653D68746D6C26706F7274616C6C616E67756167653D69613D737563686526636F6E746578743D696E7465726E6574746162267470633D696E7465726E65742670746C3D73746426636C617373696669636174696F6E3D696E7465726E65747461625F696E7465726E65745F73746426713D7B7365617263685465726D737D2662723D&st={searchTerms}&clid=86e5132c-e238-4158-8bf4-8cbe80bc2aa1&pid=freewarede&k=0 SearchScopes: HKCU - {EE97B51A-20F2-4B92-BE28-538D5E0DADA1} URL = hxxp://slirsredirect.search.aol.com.anonymize-me.de/?anonymto=687474703A2F2F736C69727372656469726563742E7365617263682E616F6C2E636F6D2F736C6972735F687474702F7372656469723F7372656469723D313134352671756572793D7B7365617263685465726D737D26696E766F636174696F6E547970653D746235306870636E6E626965372D64652D6465&st={searchTerms}&clid=86e5132c-e238-4158-8bf4-8cbe80bc2aa1&pid=freewarede&k=0 SearchScopes: HKCU - {F965174A-6F0B-4A17-8910-B7FFCBF93C96} URL = hxxp://de.wikipedia.org.anonymize-me.de/?to=64652E77696B6970656469612E6F7267&st={searchTerms}&clid=86e5132c-e238-4158-8bf4-8cbe80bc2aa1&pid=freewarede&mode=bounce&k=0 BHO: Lexmark Symbolleiste -> {1017A80C-6F09-4548-A84D-EDD6AC9525F0} -> C:\Program Files\Lexmark Toolbar\toolband.dll () BHO: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader) BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Freeware.de Toolbar -> {7e111a5c-3d11-4f56-9463-5310c3c69025} -> C:\Program Files\Freeware.de\prxtbFre2.dll (Conduit Ltd.) BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Easy Photo Print -> {9421DD08-935F-4701-A9CA-22DF90AC4EA6} -> C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.) BHO: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files\Windows Live\Companion\companioncore.dll (Microsoft Corporation) BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - Lexmark Symbolleiste - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll () Toolbar: HKLM - Freeware.de Toolbar - {7e111a5c-3d11-4f56-9463-5310c3c69025} - C:\Program Files\Freeware.de\prxtbFre2.dll (Conduit Ltd.) Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.) Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File Toolbar: HKCU - Lexmark Symbolleiste - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll () Toolbar: HKCU - Freeware.de Toolbar - {7E111A5C-3D11-4F56-9463-5310C3C69025} - C:\Program Files\Freeware.de\prxtbFre2.dll (Conduit Ltd.) DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} hxxp://office.microsoft.com/_layouts/ClientBin/ieawsdc32.cab DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab DPF: {2EF98DE5-183F-11D4-83EC-EC6A1DB6E213} hxxp://www.dynageo.de/download/dynageoviewer.cab DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} hxxp://h20614.www2.hp.com/ediags/gmd/Install/Cab/hpdetect1263.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_37-windows-i586.cab Handler: inbox - {37540F19-DD4C-478B-B2DF-C19281BCAF27} - No File Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - No File Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation) Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - No File Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\mikni\AppData\Roaming\Mozilla\Firefox\Profiles\67bvyvn2.default FF NewTab: hxxp://www.sweetpacks-search.com/?barid=&src=97&&st=23 FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_14_0_0_145.dll () FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF Plugin: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin: @real.com/nppl3260;version=16.0.2.32 -> c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.) FF Plugin: @real.com/nprndlchromebrowserrecordext;version=1.3.2 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.) FF Plugin: @real.com/nprndlhtml5videoshim;version=1.3.2 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.) FF Plugin: @real.com/nprndlpepperflashvideoshim;version=1.3.2 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.) FF Plugin: @real.com/nprpchromebrowserrecordext;version=15.0.6.14 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.) FF Plugin: @real.com/nprphtml5videoshim;version=15.0.6.14 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.) FF Plugin: @real.com/nprpplugin;version=16.0.2.32 -> c:\program files\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer) FF Plugin: @realnetworks.com/npdlplugin;version=1 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader) FF Plugin: @sony.com/ReaderDesktop -> C:\Program Files\Sony\ReaderDesktop\npreaderdetectmoz.dll (Sony Corporation) FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files\WildTangent Games\App\BrowserIntegration\Registered\2\NP_wtapp.dll () FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\mikni\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF user.js: detected! => C:\Users\mikni\AppData\Roaming\Mozilla\Firefox\Profiles\67bvyvn2.default\user.js FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppl3260.dll (RealNetworks, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nprpplugin.dll (RealPlayer) FF SearchPlugin: C:\Users\mikni\AppData\Roaming\Mozilla\Firefox\Profiles\67bvyvn2.default\searchplugins\askcom.xml FF SearchPlugin: C:\Users\mikni\AppData\Roaming\Mozilla\Firefox\Profiles\67bvyvn2.default\searchplugins\ea853ebb-d4e6-46f9-94ec-cab6cc5818bf.xml FF SearchPlugin: C:\Users\mikni\AppData\Roaming\Mozilla\Firefox\Profiles\67bvyvn2.default\searchplugins\inbox-suchen.xml FF SearchPlugin: C:\Users\mikni\AppData\Roaming\Mozilla\Firefox\Profiles\67bvyvn2.default\searchplugins\MyStart.xml FF SearchPlugin: C:\Users\mikni\AppData\Roaming\Mozilla\Firefox\Profiles\67bvyvn2.default\searchplugins\{133A4484-92BF-4E83-A6CB-674692321D8C}.xml FF SearchPlugin: C:\Users\mikni\AppData\Roaming\Mozilla\Firefox\Profiles\67bvyvn2.default\searchplugins\{4BDCAF21-F57F-4509-88EF-6513F96569DB}.xml FF SearchPlugin: C:\Users\mikni\AppData\Roaming\Mozilla\Firefox\Profiles\67bvyvn2.default\searchplugins\{BF355EE7-06CC-42DE-8F96-C421909FAA92}.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: Avira Browser Safety - C:\Users\mikni\AppData\Roaming\Mozilla\Firefox\Profiles\67bvyvn2.default\Extensions\abs@avira.com [2014-08-27] FF Extension: Flash Video Resources Downloader - C:\Users\mikni\AppData\Roaming\Mozilla\Firefox\Profiles\67bvyvn2.default\Extensions\max@subfighter.com [2010-07-20] FF Extension: PDF Download - C:\Users\mikni\AppData\Roaming\Mozilla\Firefox\Profiles\67bvyvn2.default\Extensions\{37E4D8EA-8BDA-4831-8EA1-89053939A250} [2011-02-09] FF Extension: Download Statusbar - C:\Users\mikni\AppData\Roaming\Mozilla\Firefox\Profiles\67bvyvn2.default\Extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389} [2012-01-02] FF Extension: Download YouTube Videos as MP4 - C:\Users\mikni\AppData\Roaming\Mozilla\Firefox\Profiles\67bvyvn2.default\Extensions\{b9bfaf1c-a63f-47cd-8b9a-29526ced9060}.xpi [2013-10-25] FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2014-01-11] FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2014-01-11] FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} [2014-01-11] FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0039-ABCDEFFEDCBA} [2014-01-11] FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2013-07-03] FF HKLM\...\Firefox\Extensions: [{FCE04E1F-9378-4f39-96F6-5689A9159E45}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext Chrome: ======= CHR HomePage: Default -> https://www.google.de/ CHR StartupUrls: Default -> "https://www.google.de/" CHR NewTab: Default -> "chrome-extension://ogccgbmabaphcakpiclgcnmcnimhokcj/newtab.html" CHR CustomProfile: C:\Users\mikni\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Drive) - C:\Users\mikni\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-05-16] CHR Extension: (HeapNote Teacher) - C:\Users\mikni\AppData\Local\Google\Chrome\User Data\Default\Extensions\bllhchpefpppioobbgcpjffahfogcaid [2013-08-14] CHR Extension: (YouTube) - C:\Users\mikni\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-02-16] CHR Extension: (Google-Suche) - C:\Users\mikni\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-02-16] CHR Extension: (Avira Browser Safety) - C:\Users\mikni\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-08-27] CHR Extension: (Windows Media Player Extension for HTML5) - C:\Users\mikni\AppData\Local\Google\Chrome\User Data\Default\Extensions\hokdglbhghcebcopdbanieangmcamaak [2013-07-30] CHR Extension: (RealDownloader) - C:\Users\mikni\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji [2013-02-16] CHR Extension: (Google Wallet) - C:\Users\mikni\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-02] CHR Extension: (Google Mail) - C:\Users\mikni\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-02-16] CHR HKLM\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2013-04-16] CHR HKLM\...\Chrome\Extension: [ogccgbmabaphcakpiclgcnmcnimhokcj] - C:\Windows\System32\jmdp\SweetNT.crx [2013-04-16] CHR HKLM\...\Chrome\Extension: [pgafcinpmmpklohkojmllohdhomoefph] - C:\ProgramData\BrowserProtect\2.5.986.67\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.crx [2013-04-16] CHR HKCU\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\mikni\AppData\Local\Google\Drive\apdfllckaahabafndbhieahigkjlhalf_live.crx [2013-05-12] ========================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.) R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-08-27] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-27] (Avira Operations GmbH & Co. KG) R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [149296 2014-08-04] (Avira Operations GmbH & Co. KG) S2 BstHdAndroidSvc; C:\Program Files\BlueStacks\HD-Service.exe [393032 2013-06-10] (BlueStack Systems, Inc.) R2 BstHdLogRotatorSvc; C:\Program Files\BlueStacks\HD-LogRotatorService.exe [384840 2013-06-10] (BlueStack Systems, Inc.) R2 EMP_UDSA; C:\Program Files\EPSON Projector\Epson USB Display V1.6\EMP_UDSA.exe [157696 2011-11-17] (SEIKO EPSON CORPORATION) [File not signed] R2 EpsonBidirectionalService; C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe [94208 2006-12-19] (SEIKO EPSON CORPORATION) [File not signed] S2 ezSharedSvc; C:\Windows\System32\ezsvc7.dll [129992 2008-02-03] (EasyBits Sofware AS) [File not signed] S3 GamesAppIntegrationService; C:\Program Files\WildTangent Games\App\GamesAppIntegrationService.exe [240736 2013-10-07] (WildTangent) R2 LightScribeService; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [73728 2008-06-09] (Hewlett-Packard Company) [File not signed] R2 lxdxCATSCustConnectService; C:\Windows\system32\spool\DRIVERS\W32X86\3\\lxdxserv.exe [94208 2009-10-16] (Lexmark International, Inc.) R2 lxdx_device; C:\Windows\system32\lxdxcoms.exe [594600 2008-02-28] ( ) R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation) R2 RealNetworks Downloader Resolver Service; C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-04-16] () R2 Recovery Service for Windows; C:\Program Files\SMINST\BLService.exe [365952 2008-12-23] () R2 SearchAnonymizer; C:\Users\mikni\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe [40960 2011-08-14] () [File not signed] S3 Sony SCSI Helper Service; C:\Program Files\Common Files\Sony Shared\Fsk\SonySCSIHelperService.exe [73728 2013-05-23] (Sony Corporation) [File not signed] R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9691412ff1876250\STacSV.exe [229458 2010-03-23] (IDT, Inc.) R3 x10nets; C:\Program Files\Common Files\X10\Common\X10nets.exe [20480 2001-11-12] (X10) [File not signed] S2 Norton Internet Security; No ImagePath ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [97648 2014-07-24] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-07-24] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-27] (Avira Operations GmbH & Co. KG) R2 BstHdDrv; C:\Program Files\BlueStacks\HD-Hypervisor-x86.sys [63816 2013-06-10] (BlueStack Systems) R3 EMP_MIRRUD; C:\Windows\System32\DRIVERS\EMP_MirrUD.sys [3712 2011-11-17] (Windows (R) Codename Longhorn DDK provider) R3 eppvad_simple; C:\Windows\System32\drivers\EMP_UDAU.sys [17664 2011-11-17] (SEIKO EPSON CORPORATION) S3 FTDIBUS; C:\Windows\System32\drivers\ftdibus.sys [57800 2009-10-22] (FTDI Ltd.) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-08-27] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-05-12] (Malwarebytes Corporation) R3 pfc; C:\Windows\System32\drivers\pfc.sys [10368 2010-09-08] (Padus, Inc.) [File not signed] S3 s1039mdm; C:\Windows\System32\DRIVERS\s1039mdm.sys [124016 2009-11-19] (MCCI Corporation) R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH) S3 USB28xxBGA; C:\Windows\System32\DRIVERS\emBDA.sys [579712 2009-12-01] (eMPIA Technology, Inc.) S3 USB28xxOEM; C:\Windows\System32\DRIVERS\emOEM.sys [543744 2009-12-01] (eMPIA Technology, Inc.) R3 vhidmini; C:\Windows\System32\DRIVERS\vhidmini.sys [18816 2009-01-08] (Windows (R) Codename Longhorn DDK provider) [File not signed] U3 DfSdkS; No ImagePath S3 NAVENG; No ImagePath S3 NAVEX15; No ImagePath S1 SRTSP; No ImagePath S1 SRTSPX; No ImagePath S3 VAD_DEV; system32\drivers\vad.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-08-27 18:52 - 2014-08-27 18:52 - 00035598 _____ () C:\Users\mikni\Downloads\FRST.txt 2014-08-27 18:52 - 2014-08-27 18:52 - 00000000 ____D () C:\FRST 2014-08-27 18:51 - 2014-08-27 18:51 - 01095168 _____ (Farbar) C:\Users\mikni\Downloads\FRST.exe 2014-08-27 18:49 - 2014-08-27 18:50 - 00000472 _____ () C:\Users\mikni\Downloads\defogger_disable.log 2014-08-27 18:49 - 2014-08-27 18:49 - 00050477 _____ () C:\Users\mikni\Downloads\Defogger.exe 2014-08-27 18:49 - 2014-08-27 18:49 - 00000000 _____ () C:\Users\mikni\defogger_reenable 2014-08-27 18:30 - 2014-08-27 18:30 - 00001157 _____ () C:\Users\mikni\Desktop\mbam.txt 2014-08-27 17:44 - 2014-08-27 18:45 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-08-27 17:44 - 2014-08-27 17:44 - 00001064 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-08-27 17:44 - 2014-08-27 17:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-08-27 17:44 - 2014-08-27 17:44 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-08-27 17:44 - 2014-08-27 17:44 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2014-08-27 17:44 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-08-27 17:44 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-08-27 17:44 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-08-27 17:42 - 2014-08-27 17:43 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\mikni\Downloads\mbam-setup-2.0.2.1012.exe 2014-08-27 16:05 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll 2014-08-27 16:04 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll 2014-08-27 16:04 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe 2014-08-27 16:04 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe 2014-08-27 15:53 - 2014-08-27 15:53 - 00000000 ____D () C:\Windows\system32\mjcm 2014-08-27 15:53 - 2014-08-27 15:53 - 00000000 ____D () C:\Users\mikni\AppData\Local\SWDS 2014-08-27 15:09 - 2014-08-27 15:09 - 00001095 _____ () C:\Users\Public\Desktop\Avira.lnk 2014-08-27 15:08 - 2014-07-14 03:42 - 00654336 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll 2014-08-27 15:08 - 2014-06-16 03:44 - 00730048 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys 2014-08-27 15:08 - 2014-06-16 03:44 - 00219072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys 2014-08-27 15:08 - 2014-06-16 03:40 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll 2014-08-27 15:07 - 2014-08-01 01:16 - 00307384 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-08-27 15:07 - 2014-07-25 15:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-08-27 15:07 - 2014-07-25 14:33 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-08-27 15:07 - 2014-07-25 14:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-08-27 15:07 - 2014-07-25 14:17 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-08-27 15:07 - 2014-07-25 14:10 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-08-27 15:07 - 2014-07-25 14:10 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-08-27 15:07 - 2014-07-25 13:59 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-08-27 15:07 - 2014-07-25 13:52 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-08-27 15:07 - 2014-07-25 13:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-08-27 15:07 - 2014-07-25 13:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-08-27 15:07 - 2014-07-25 13:13 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-08-27 15:07 - 2014-07-25 13:09 - 00663040 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-08-27 15:07 - 2014-07-25 13:07 - 02001920 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-08-27 15:07 - 2014-07-25 12:00 - 01169920 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-08-27 15:06 - 2014-07-25 15:51 - 17524224 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-08-27 15:06 - 2014-07-25 15:03 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-08-27 15:06 - 2014-07-25 14:34 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-08-27 15:06 - 2014-07-25 14:34 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-08-27 15:06 - 2014-07-25 14:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-08-27 15:06 - 2014-07-25 14:21 - 02184704 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-08-27 15:06 - 2014-07-25 14:12 - 00438784 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-08-27 15:06 - 2014-07-25 14:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-08-27 15:06 - 2014-07-25 14:06 - 04204032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-08-27 15:06 - 2014-07-25 13:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-08-27 15:06 - 2014-07-25 13:29 - 00239616 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-08-27 15:06 - 2014-07-25 13:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2014-08-27 15:06 - 2014-07-25 13:03 - 11772928 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-08-27 15:06 - 2014-07-25 12:09 - 00704512 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-08-27 15:06 - 2014-07-25 12:05 - 01792512 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-08-27 15:04 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2014-08-27 15:03 - 2014-06-03 11:30 - 00101824 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe 2014-08-27 15:03 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll 2014-08-27 15:03 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll 2014-08-27 15:03 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll 2014-08-27 15:02 - 2014-08-07 03:43 - 00412160 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-08-27 15:02 - 2014-08-07 03:39 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-08-27 15:01 - 2014-08-27 15:09 - 00000000 ____D () C:\ProgramData\Package Cache 2014-08-27 14:57 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll 2014-08-27 14:29 - 2014-05-14 18:23 - 01973728 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll 2014-08-27 14:29 - 2014-05-14 18:23 - 00054240 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe 2014-08-27 14:29 - 2014-05-14 18:23 - 00045536 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll 2014-08-27 14:29 - 2014-05-14 18:17 - 02425856 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll 2014-08-27 14:28 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll 2014-08-27 14:28 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe 2014-08-27 14:17 - 2014-08-27 14:17 - 00000000 __SHD () C:\Users\mikni\AppData\Local\EmieUserList 2014-08-27 14:17 - 2014-08-27 14:17 - 00000000 __SHD () C:\Users\mikni\AppData\Local\EmieSiteList 2014-08-27 14:09 - 2014-08-27 18:42 - 00000376 _____ () C:\Windows\Tasks\RNUpgradeHelperLogonPrompt_mikni.job 2014-08-27 14:09 - 2014-08-27 15:40 - 00000370 _____ () C:\Windows\Tasks\ReclaimerUpdateFiles_mikni.job 2014-08-27 14:07 - 2014-08-27 15:40 - 00000366 _____ () C:\Windows\Tasks\ReclaimerUpdateXML_mikni.job 2014-08-27 13:58 - 2014-08-27 16:45 - 00000000 ___SD () C:\Windows\system32\CompatTel ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-08-27 18:52 - 2014-08-27 18:52 - 00035598 _____ () C:\Users\mikni\Downloads\FRST.txt 2014-08-27 18:52 - 2014-08-27 18:52 - 00000000 ____D () C:\FRST 2014-08-27 18:51 - 2014-08-27 18:51 - 01095168 _____ (Farbar) C:\Users\mikni\Downloads\FRST.exe 2014-08-27 18:51 - 2010-01-09 18:03 - 00011216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-08-27 18:51 - 2010-01-09 18:03 - 00011216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-08-27 18:50 - 2014-08-27 18:49 - 00000472 _____ () C:\Users\mikni\Downloads\defogger_disable.log 2014-08-27 18:49 - 2014-08-27 18:49 - 00050477 _____ () C:\Users\mikni\Downloads\Defogger.exe 2014-08-27 18:49 - 2014-08-27 18:49 - 00000000 _____ () C:\Users\mikni\defogger_reenable 2014-08-27 18:49 - 2010-01-09 18:06 - 00000000 ____D () C:\Users\mikni 2014-08-27 18:48 - 2010-01-09 18:36 - 01278009 _____ () C:\Windows\WindowsUpdate.log 2014-08-27 18:45 - 2014-08-27 17:44 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-08-27 18:45 - 2010-01-09 19:08 - 00000280 _____ () C:\ProgramData\hpqp.ini 2014-08-27 18:42 - 2014-08-27 14:09 - 00000376 _____ () C:\Windows\Tasks\RNUpgradeHelperLogonPrompt_mikni.job 2014-08-27 18:41 - 2013-10-25 15:04 - 00831100 _____ () C:\Windows\setupact.log 2014-08-27 18:41 - 2010-02-11 22:04 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-08-27 18:41 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-08-27 18:40 - 2013-11-03 20:15 - 00160784 _____ () C:\Windows\PFRO.log 2014-08-27 18:40 - 2013-06-02 09:56 - 00000000 ____D () C:\Windows\system32\WNLT 2014-08-27 18:40 - 2012-04-25 07:23 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-08-27 18:35 - 2013-05-19 13:18 - 00000000 ____D () C:\Users\mikni\AppData\Roaming\BabSolution 2014-08-27 18:34 - 2013-01-03 00:52 - 00000000 ____D () C:\Program Files\FileConverter_1.3 2014-08-27 18:34 - 2012-04-24 23:02 - 00000000 ____D () C:\Program Files\Inbox Toolbar 2014-08-27 18:34 - 2010-11-17 12:51 - 00000000 ____D () C:\Program Files\ConduitEngine 2014-08-27 18:30 - 2014-08-27 18:30 - 00001157 _____ () C:\Users\mikni\Desktop\mbam.txt 2014-08-27 18:29 - 2012-01-02 18:24 - 00000000 ____D () C:\Users\Martina 2014-08-27 18:02 - 2013-06-02 09:56 - 00000000 ____D () C:\Windows\system32\ARFC 2014-08-27 17:54 - 2010-02-11 22:04 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-08-27 17:44 - 2014-08-27 17:44 - 00001064 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-08-27 17:44 - 2014-08-27 17:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-08-27 17:44 - 2014-08-27 17:44 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-08-27 17:44 - 2014-08-27 17:44 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2014-08-27 17:43 - 2014-08-27 17:42 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\mikni\Downloads\mbam-setup-2.0.2.1012.exe 2014-08-27 17:31 - 2010-01-09 18:47 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-08-27 17:17 - 2012-06-05 23:41 - 00000000 ____D () C:\Users\mikni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Aml Pages 2014-08-27 17:17 - 2012-06-05 23:41 - 00000000 ____D () C:\Program Files\Aml Pages 2014-08-27 17:01 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET 2014-08-27 16:45 - 2014-08-27 13:58 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-08-27 16:45 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE 2014-08-27 16:17 - 2009-02-28 09:47 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-08-27 16:15 - 2013-08-03 18:32 - 00000000 ____D () C:\Windows\system32\MRT 2014-08-27 16:09 - 2010-02-13 11:26 - 96303304 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-08-27 15:53 - 2014-08-27 15:53 - 00000000 ____D () C:\Windows\system32\mjcm 2014-08-27 15:53 - 2014-08-27 15:53 - 00000000 ____D () C:\Users\mikni\AppData\Local\SWDS 2014-08-27 15:40 - 2014-08-27 14:09 - 00000370 _____ () C:\Windows\Tasks\ReclaimerUpdateFiles_mikni.job 2014-08-27 15:40 - 2014-08-27 14:07 - 00000366 _____ () C:\Windows\Tasks\ReclaimerUpdateXML_mikni.job 2014-08-27 15:23 - 2012-12-14 21:43 - 00000000 ____D () C:\Program Files\SweetIM 2014-08-27 15:09 - 2014-08-27 15:09 - 00001095 _____ () C:\Users\Public\Desktop\Avira.lnk 2014-08-27 15:09 - 2014-08-27 15:01 - 00000000 ____D () C:\ProgramData\Package Cache 2014-08-27 15:09 - 2012-10-17 22:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira 2014-08-27 15:09 - 2012-10-17 22:21 - 00000000 ____D () C:\Program Files\Avira 2014-08-27 15:01 - 2012-10-17 22:21 - 00000000 ____D () C:\ProgramData\Avira 2014-08-27 14:26 - 2013-04-14 12:03 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk 2014-08-27 14:17 - 2014-08-27 14:17 - 00000000 __SHD () C:\Users\mikni\AppData\Local\EmieUserList 2014-08-27 14:17 - 2014-08-27 14:17 - 00000000 __SHD () C:\Users\mikni\AppData\Local\EmieSiteList 2014-08-27 14:17 - 2013-04-04 22:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive 2014-08-27 14:14 - 2011-12-20 13:25 - 00000000 ____D () C:\Users\mikni\AppData\Roaming\HpUpdate 2014-08-27 14:13 - 2013-05-11 13:52 - 00035848 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys 2014-08-27 14:05 - 2009-07-14 06:33 - 00507672 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-08-27 14:00 - 2009-07-14 09:49 - 00000000 ____D () C:\Program Files\Windows Journal 2014-08-27 13:57 - 2010-07-20 19:00 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2014-08-21 11:47 - 2013-10-22 20:44 - 00027136 _____ (IncrediMail, Ltd.) C:\Windows\system32\ImHttpComm.dll 2014-08-07 03:43 - 2014-08-27 15:02 - 00412160 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-08-07 03:39 - 2014-08-27 15:02 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-08-05 09:20 - 2010-01-09 19:05 - 00231584 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe 2014-08-01 01:16 - 2014-08-27 15:07 - 00307384 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll Files to move or delete: ==================== C:\Users\mikni\kalass.exe Some content of TEMP: ==================== C:\Users\Martina\AppData\Local\Temp\AskSLib.dll C:\Users\Martina\AppData\Local\Temp\avgnt.exe C:\Users\mikni\AppData\Local\Temp\avgnt.exe C:\Users\mikni\AppData\Local\Temp\Checkupdate.exe C:\Users\mikni\AppData\Local\Temp\Foxit Reader Updater.exe C:\Users\mikni\AppData\Local\Temp\gcapi_dll.dll C:\Users\mikni\AppData\Local\Temp\gtapi_signed.dll C:\Users\mikni\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe C:\Users\mikni\AppData\Local\Temp\setup.exe C:\Users\mikni\AppData\Local\Temp\uninst1.exe C:\Users\mikni\AppData\Local\Temp\Update.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\explorer.exe => File is digitally signed C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-03-20 23:23 ==================== End Of Log ============================ Manu |
Baum-Darstellung