| |
| |||||||
Log-Analyse und Auswertung: Windows 7, seit 6 Wochen ständiger unerwünschter DownloadWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
| |
06.09.2014, 15:24
| #1 |
| |  Windows 7, seit 6 Wochen ständiger unerwünschter Download Sodele Als erstes muss ich mich dringend bedanken dass ihr euch so schnell um mein Problem gekümmert habt. Ich hab die Geschichte schon in einigen anderen Foren gepostet und wirkliche Hilfe blieb aus. War total überascht bei euch kompetente Leute gefunden zu haben die mich und mein Problem ernst nehmen, denn das war das Schlimmste für mich dass mich irgendwie niemand ernst genommen hat. Dickes Lob an euch  Vorhin hab ich mir meinen Traffic angeschaut und gedacht ich sehe nicht richtig: "350,5 MB von 3 GB verbraucht" - seit gestern morgen 8:00 Uhr, denn da wurde meine Flat wieder zurückgesetzt (jeden Monat am 5. ca. 8:00 Uhr). Und die Tools von euch haben ja nur ein paar MB. Wo ist mein Traffic hingegangen? Gestern ahbe ich mich ausschließlich diesem Problem gewidmet und heute morgen zusätzlich noch ca. 1 Stund World of Warcraft gespielt. Sonst hab ich im Internet nichts gemacht. Hier die gewünschten Logs: AdwCleaner R0: Code:
ATTFilter # AdwCleaner v3.309 - Bericht erstellt am 06/09/2014 um 15:27:45
# Aktualisiert 02/09/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (32 bits)
# Benutzername : Detlef Orthmann - POWER
# Gestartet von : C:\Users\Detlef Orthmann\Desktop\adwcleaner_3.309.exe
# Option : Suchen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Datei Gefunden : C:\Users\Detlef Orthmann\AppData\Roaming\Mozilla\Firefox\Profiles\j2017gti.default\searchplugins\Askcom.xml
Ordner Gefunden : C:\Program Files\DeviceVM
Ordner Gefunden : C:\Program Files\Gemeinsame Dateien
Ordner Gefunden : C:\ProgramData\DataMngr
Ordner Gefunden : C:\ProgramData\DeviceVM
Ordner Gefunden : C:\Users\Detlef Orthmann\AppData\Local\iLivid
Ordner Gefunden : C:\Users\Detlef Orthmann\AppData\Roaming\DeviceVM
***** [ Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
Schlüssel Gefunden : HKCU\Software\OCS
Schlüssel Gefunden : HKCU\Software\Softonic
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{0EEDB912-C5FA-486F-8334-57288578C627}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasapi32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasmancs
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17239
-\\ Mozilla Firefox v32.0 (x86 de)
[ Datei : C:\Users\Detlef Orthmann\AppData\Roaming\Mozilla\Firefox\Profiles\j2017gti.default\prefs.js ]
*************************
AdwCleaner[R0].txt - [2079 octets] - [06/09/2014 15:27:45]
########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [2139 octets] ##########
Code:
ATTFilter # AdwCleaner v3.309 - Bericht erstellt am 06/09/2014 um 15:32:14
# Aktualisiert 02/09/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (32 bits)
# Benutzername : Detlef Orthmann - POWER
# Gestartet von : C:\Users\Detlef Orthmann\Desktop\adwcleaner_3.309.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\DataMngr
Ordner Gelöscht : C:\ProgramData\DeviceVM
Ordner Gelöscht : C:\Program Files\DeviceVM
[/!\] Nicht Gelöscht ( Junction ) : C:\Program Files\Gemeinsame Dateien
Ordner Gelöscht : C:\Users\Detlef Orthmann\AppData\Local\iLivid
Ordner Gelöscht : C:\Users\Detlef Orthmann\AppData\Roaming\DeviceVM
Datei Gelöscht : C:\Users\Detlef Orthmann\AppData\Roaming\Mozilla\Firefox\Profiles\j2017gti.default\searchplugins\Askcom.xml
***** [ Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{0EEDB912-C5FA-486F-8334-57288578C627}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\Softonic
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17239
-\\ Mozilla Firefox v32.0 (x86 de)
[ Datei : C:\Users\Detlef Orthmann\AppData\Roaming\Mozilla\Firefox\Profiles\j2017gti.default\prefs.js ]
*************************
AdwCleaner[R0].txt - [2219 octets] - [06/09/2014 15:27:45]
AdwCleaner[S0].txt - [2158 octets] - [06/09/2014 15:32:14]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2218 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.3 (03.23.2014:1)
OS: Windows 7 Home Premium x86
Ran by Detlef Orthmann on 06.09.2014 at 15:44:39,26
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{CAC4824B-70E7-4E1C-A061-2CEB8F1CA43B}
~~~ Files
~~~ Folders
~~~ FireFox
Emptied folder: C:\Users\Detlef Orthmann\AppData\Roaming\mozilla\firefox\profiles\j2017gti.default\minidumps [165 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 06.09.2014 at 15:46:38,27
Computer was rebooted
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-09-2014
Ran by Detlef Orthmann (administrator) on POWER on 06-09-2014 15:58:12
Running from C:\Users\Detlef Orthmann\Desktop
Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AMD) C:\Windows\System32\atiesrxx.exe
(Creative Technology Ltd) C:\Program Files\Creative\Shared Files\CTAudSvc.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
() C:\ProgramData\MobileBrServ\mbbService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Creative Technology Ltd) C:\Program Files\InstallShield Installation Information\{F3D9AC82-30F4-4BB9-B9AB-8697637568C1}\AMBSPISyncService.exe
(Creative Technology Ltd) C:\Program Files\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe
(Nullsoft, Inc.) C:\Program Files\Winamp\winampa.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Mister Group) C:\Program Files\System Explorer\SystemExplorer.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe
(ZTE) C:\Program Files\congstar\Internet-Manager\Bin\mcserver.exe
(Mister Group) C:\Program Files\System Explorer\service\SystemExplorerService.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.bin
(Macrovision Europe Ltd.) C:\Users\Detlef Orthmann\AppData\Local\temp\Sound_Blaster_X-Fi_MB_Cleanup.0001
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Creative Labs) C:\Program Files\Common Files\Creative Labs Shared\Service\XMBLicensing.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
() C:\Program Files\congstar\Internet-Manager\Bin\dbus-daemon.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
() C:\Program Files\congstar\Internet-Manager\Bin\db_daemon.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVBg.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7711264 2009-08-18] (Realtek Semiconductor)
HKLM\...\Run: [CTSyncService] => C:\Program Files\InstallShield Installation Information\{F3D9AC82-30F4-4BB9-B9AB-8697637568C1}\AMBSPISyncService.exe [1233195 2009-07-08] (Creative Technology Ltd)
HKLM\...\Run: [VolPanel] => C:\Program Files\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe [241789 2009-05-04] (Creative Technology Ltd)
HKLM\...\Run: [UpdReg] => C:\Windows\UpdReg.EXE [90112 2000-05-11] (Creative Technology Ltd.)
HKLM\...\Run: [RunDLLEntry] => C:\Windows\system32\RunDLL32.exe C:\Windows\system32\AmbRunE.dll,RunDLLEntry
HKLM\...\Run: [WinampAgent] => C:\Program Files\Winamp\winampa.exe [74752 2012-06-20] (Nullsoft, Inc.)
HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\x86\CLIStart.exe [747264 2013-12-06] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2014-05-08] (Adobe Systems Incorporated)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
HKLM\...\Run: [SystemExplorerAutoStart] => C:\Program Files\System Explorer\SystemExplorer.exe [3385192 2014-08-21] (Mister Group)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [751184 2014-09-05] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Avira Systray] => C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe [161584 2014-08-04] (Avira Operations GmbH & Co. KG)
HKU\.DEFAULT\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [280576 2013-06-04] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\MCtlSvc.lnk
ShortcutTarget: MCtlSvc.lnk -> C:\Program Files\congstar\Internet-Manager\Bin\mcserver.exe (ZTE)
Startup: C:\Users\Detlef Orthmann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip ()
Startup: C:\Users\Detlef Orthmann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x3B26504DFD5ECE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
SearchScopes: HKCU - {CDE62C94-AC66-4a6d-8734-13AEE41FEBBD} URL = hxxp://www.google.com/custom?client=pub-3794288947762788&forid=1&channel=5480255188&ie=UTF-8&oe=UTF-8&safe=active&cof=GALT%3A%23008000%3BGL%3A1%3BDIV%3A%23336699%3BVLC%3A663399%3BAH%3Acenter%3BBGC%3AFFFFFF%3BLBGC%3A336699%3BALC%3A0000FF%3BLC%3A0000FF%3BT%3A000000%3BGFNT%3A0000FF%3BGIMP%3A0000FF%3BFORID%3A1&hl=de&q={searchTerms}
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1
FireFox:
========
FF ProfilePath: C:\Users\Detlef Orthmann\AppData\Roaming\Mozilla\Firefox\Profiles\j2017gti.default
FF DefaultSearchEngine: Ask.com
FF SearchEngineOrder.1: Ask.com
FF SelectedSearchEngine: Ask.com
FF Homepage: hxxp://www.google.de/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.8 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npwachk.dll (Nullsoft, Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Avira Browser Safety - C:\Users\Detlef Orthmann\AppData\Roaming\Mozilla\Firefox\Profiles\j2017gti.default\Extensions\abs@avira.com [2014-09-05]
FF Extension: Adblock Plus - C:\Users\Detlef Orthmann\AppData\Roaming\Mozilla\Firefox\Profiles\j2017gti.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-04-29]
FF HKLM\...\Firefox\Extensions: [ff-bmboc@bytemobile.com] - C:\Program Files\congstar\Internet-Manager\Bin\addon
FF Extension: Bytemobile Optimization Client - C:\Program Files\congstar\Internet-Manager\Bin\addon [2014-09-03]
Chrome:
=======
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-09-05] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [149296 2014-08-04] (Avira Operations GmbH & Co. KG)
S3 Creative ALchemy AL6 Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [79360 2013-06-01] (Creative Labs) [File not signed]
S3 Creative Audio Engine Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [79360 2013-06-01] (Creative Labs) [File not signed]
R2 CTAudSvcService; C:\Program Files\Creative\Shared Files\CTAudSvc.exe [307200 2009-02-23] (Creative Technology Ltd) [File not signed]
R2 Mobile Broadband HL Service; C:\ProgramData\MobileBrServ\mbbservice.exe [230240 2013-06-01] ()
R3 Sound Blaster X-Fi MB Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\XMBLicensing.exe [79360 2013-06-01] (Creative Labs) [File not signed]
R3 SystemExplorerHelpService; C:\Program Files\System Explorer\service\SystemExplorerService.exe [567144 2014-08-13] (Mister Group)
S3 rpcapd; "%ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini" [X]
S2 WCUService; C:\Program Files\DeviceVM\SmartView Software Updater\WCUService.exe [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [97648 2014-09-05] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-09-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2014-09-05] (Avira Operations GmbH & Co. KG)
R0 BMLoad; C:\Windows\System32\drivers\BMLoad.sys [13184 2009-12-15] (Bytemobile, Inc.) [File not signed]
S3 HSPADataCardusbmdm; C:\Windows\System32\DRIVERS\HSPADataCardusbmdm.sys [106880 2011-08-19] (HSPADataCard Incorporated)
S3 HSPADataCardusbnmea; C:\Windows\System32\DRIVERS\HSPADataCardusbnmea.sys [106880 2011-08-19] (HSPADataCard Incorporated)
S3 HSPADataCardusbser; C:\Windows\System32\DRIVERS\HSPADataCardusbser.sys [106880 2011-08-19] (HSPADataCard Incorporated)
R2 NPF; C:\Windows\System32\drivers\npf.sys [36600 2013-03-01] (Riverbed Technology, Inc.)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2014-09-05] (Avira GmbH)
R1 tcpipBM; C:\Windows\system32\drivers\tcpipBM.sys [24192 2009-12-15] (Bytemobile, Inc.) [File not signed]
U5 AppMgmt; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\Users\DETLEF~1\AppData\Local\Temp\catchme.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-06 15:58 - 2014-09-06 15:58 - 00012523 _____ () C:\Users\Detlef Orthmann\Desktop\FRST.txt
2014-09-06 15:46 - 2014-09-06 15:46 - 00000950 _____ () C:\Users\Detlef Orthmann\Desktop\JRT.txt
2014-09-06 15:42 - 2014-09-06 15:42 - 00000000 ____D () C:\Windows\ERUNT
2014-09-06 15:40 - 2014-09-06 15:40 - 01016261 _____ (Thisisu) C:\Users\Detlef Orthmann\Desktop\JRT.exe
2014-09-06 15:27 - 2014-09-06 15:32 - 00000000 ____D () C:\AdwCleaner
2014-09-06 15:12 - 2014-09-06 15:12 - 01370483 _____ () C:\Users\Detlef Orthmann\Desktop\adwcleaner_3.309.exe
2014-09-05 20:32 - 2014-09-05 20:31 - 00035848 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-09-05 15:51 - 2014-09-05 15:51 - 00014967 _____ () C:\ComboFix.txt
2014-09-05 15:43 - 2014-09-06 15:33 - 00177512 _____ () C:\Windows\PFRO.log
2014-09-05 15:37 - 2014-09-05 15:51 - 00000000 ____D () C:\ComboFix
2014-09-05 15:37 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-09-05 15:37 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-09-05 15:37 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-09-05 15:37 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-09-05 15:37 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-09-05 15:37 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-09-05 15:37 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-09-05 15:37 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-09-05 15:36 - 2014-09-05 15:51 - 00000000 ____D () C:\Qoobox
2014-09-05 15:36 - 2014-09-05 15:50 - 00000000 ____D () C:\Windows\erdnt
2014-09-05 15:34 - 2014-09-05 15:34 - 05576440 ____R (Swearware) C:\Users\Detlef Orthmann\Desktop\ComboFix.exe
2014-09-05 09:30 - 2014-09-05 09:30 - 00003759 _____ () C:\Users\Detlef Orthmann\Documents\Gmer 0509.log
2014-09-05 08:48 - 2014-09-05 08:48 - 00380416 _____ () C:\Users\Detlef Orthmann\Downloads\Gmer-19357.exe
2014-09-05 08:43 - 2014-09-06 15:58 - 00000000 ____D () C:\FRST
2014-09-05 08:43 - 2014-09-05 08:43 - 01096704 _____ (Farbar) C:\Users\Detlef Orthmann\Desktop\FRST.exe
2014-09-05 08:41 - 2014-09-05 08:41 - 00000000 _____ () C:\Users\Detlef Orthmann\defogger_reenable
2014-09-05 08:40 - 2014-09-05 08:40 - 00050477 _____ () C:\Users\Detlef Orthmann\Downloads\Defogger.exe
2014-09-05 08:28 - 2014-09-05 14:32 - 00000000 ____D () C:\AA Log
2014-09-05 07:02 - 2014-09-05 07:08 - 00001095 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-09-05 07:01 - 2014-09-05 07:01 - 00000000 ____D () C:\Users\Detlef Orthmann\AppData\Roaming\Avira
2014-09-05 07:00 - 2014-09-05 07:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-09-05 07:00 - 2014-09-05 07:00 - 00002016 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-09-05 06:59 - 2014-09-05 07:08 - 00000000 ____D () C:\Program Files\Avira
2014-09-05 06:59 - 2014-09-05 06:53 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-09-05 06:59 - 2014-09-05 06:53 - 00097648 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-09-05 06:59 - 2014-09-05 06:53 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2014-09-05 06:59 - 2014-09-05 06:53 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
2014-09-05 05:46 - 2014-09-05 20:32 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-05 05:45 - 2014-09-05 05:45 - 00001064 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-09-05 05:45 - 2014-09-05 05:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-09-05 05:45 - 2014-09-05 05:45 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-05 05:45 - 2014-09-05 05:45 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware
2014-09-05 05:45 - 2014-05-12 07:55 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-09-05 05:45 - 2014-05-12 07:54 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-09-05 05:45 - 2014-05-12 07:54 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-09-05 05:41 - 2014-09-06 15:43 - 00000448 _____ () C:\Windows\setupact.log
2014-09-05 05:41 - 2014-09-05 05:41 - 00000000 _____ () C:\Windows\setuperr.log
2014-09-05 05:39 - 2014-09-05 05:39 - 00007238 _____ () C:\Users\Detlef Orthmann\Documents\cc_20140905_053950.reg
2014-09-05 05:15 - 2014-09-05 05:15 - 00001194 _____ () C:\Users\Detlef Orthmann\Documents\majorgeeks.txt
2014-09-05 05:04 - 2014-09-05 05:06 - 17291728 _____ (Malwarebytes Corporation ) C:\Users\Detlef Orthmann\Downloads\mbam-setup-majorgeeks-2.0.2.1012.exe
2014-09-03 07:46 - 2014-09-03 07:46 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-09-03 07:15 - 2014-09-03 07:15 - 00000897 _____ () C:\Users\Detlef Orthmann\Desktop\Tcpview - Verknüpfung.lnk
2014-09-03 07:13 - 2014-09-03 07:13 - 00002181 _____ () C:\Users\Public\Desktop\congstar Internet-Manager.lnk
2014-09-03 07:13 - 2014-09-03 07:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\congstar Internet-Manager
2014-09-03 07:13 - 2011-08-19 12:25 - 00106880 _____ (HSPADataCard Incorporated) C:\Windows\system32\Drivers\HSPADataCardusbser.sys
2014-09-03 07:13 - 2011-08-19 12:25 - 00106880 _____ (HSPADataCard Incorporated) C:\Windows\system32\Drivers\HSPADataCardusbnmea.sys
2014-09-03 07:13 - 2011-08-19 12:25 - 00106880 _____ (HSPADataCard Incorporated) C:\Windows\system32\Drivers\HSPADataCardusbmdm.sys
2014-09-03 07:13 - 2011-08-19 12:25 - 00010240 _____ (ZTE Incorporated) C:\Windows\system32\Drivers\massfilter.sys
2014-09-03 07:13 - 2009-12-15 04:46 - 00724608 _____ (Microsoft Corporation) C:\Windows\system32\bmutil.dll
2014-09-03 07:13 - 2009-12-15 04:46 - 00480384 _____ (Bytemobile, Inc.) C:\Windows\system32\bmnet.dll
2014-09-03 07:13 - 2009-12-15 04:46 - 00308352 _____ (Bytemobile, Inc.) C:\Windows\system32\bminstall.dll
2014-09-03 07:13 - 2009-12-15 04:46 - 00132224 _____ (Bytemobile, Inc.) C:\Windows\system32\bmdumpd.bin
2014-09-03 07:13 - 2009-12-15 04:46 - 00024192 _____ (Bytemobile, Inc.) C:\Windows\system32\Drivers\tcpipBM.sys
2014-09-03 07:13 - 2009-12-15 04:46 - 00013712 _____ (Microsoft Corporation) C:\Windows\system32\sporder.dll
2014-09-03 07:13 - 2009-12-15 04:46 - 00013184 _____ (Bytemobile, Inc.) C:\Windows\system32\Drivers\BMLoad.sys
2014-09-03 07:12 - 2014-09-03 07:12 - 00000000 ____D () C:\Program Files\congstar
2014-09-03 07:02 - 2014-09-03 07:02 - 00009088 _____ () C:\Users\Detlef Orthmann\Documents\cc_20140903_070243.reg
2014-09-02 14:52 - 2014-09-05 07:18 - 00000000 ____D () C:\TCPView
2014-09-02 14:52 - 2014-09-02 14:52 - 00291606 _____ () C:\Users\Detlef Orthmann\Downloads\TCPView.zip
2014-09-02 12:14 - 2014-09-02 15:29 - 00000000 ____D () C:\Users\Detlef Orthmann\AppData\Roaming\Wireshark
2014-09-02 12:12 - 2014-09-02 12:12 - 00001987 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wireshark 2 Preview.lnk
2014-09-02 12:11 - 2014-09-02 12:12 - 00000000 ____D () C:\Program Files\Wireshark
2014-09-02 12:11 - 2014-09-02 12:11 - 00001720 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wireshark.lnk
2014-09-02 12:06 - 2014-09-02 12:06 - 01101648 _____ () C:\Users\Detlef Orthmann\Downloads\Wireshark 32 Bit - CHIP-Installer.exe
2014-09-02 12:05 - 2014-09-02 12:12 - 00000000 ____D () C:\Program Files\WinPcap
2014-09-02 12:05 - 2014-09-02 12:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinPcap
2014-09-02 12:04 - 2014-09-02 12:04 - 01101648 _____ () C:\Users\Detlef Orthmann\Downloads\WinPcap - CHIP-Installer.exe
2014-09-02 08:57 - 2014-09-02 08:59 - 00000000 ____D () C:\ProgramData\SystemExplorer
2014-09-02 08:57 - 2014-09-02 08:57 - 00001048 _____ () C:\Users\Public\Desktop\System Explorer.lnk
2014-09-02 08:57 - 2014-09-02 08:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Explorer
2014-09-02 08:57 - 2014-09-02 08:57 - 00000000 ____D () C:\Program Files\System Explorer
2014-09-02 08:56 - 2014-09-02 08:56 - 02097264 _____ (Mister Group ) C:\Users\Detlef Orthmann\Downloads\SystemExplorerSetup_593.exe
2014-08-28 08:01 - 2014-08-23 03:46 - 00305152 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-28 08:01 - 2014-08-23 02:42 - 02352640 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-27 06:39 - 2014-05-14 18:23 - 01973728 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-08-27 06:39 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-08-27 06:39 - 2014-05-14 18:23 - 00054240 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-08-27 06:39 - 2014-05-14 18:23 - 00045536 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-08-27 06:39 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-08-27 06:39 - 2014-05-14 18:17 - 02425856 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-08-27 06:39 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-08-27 06:39 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-08-27 06:39 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-08-26 07:52 - 2014-09-06 09:04 - 00000000 ____D () C:\Users\Detlef Orthmann\AppData\Local\Battle.net
2014-08-26 07:52 - 2014-08-26 07:55 - 00000000 ____D () C:\Users\Detlef Orthmann\AppData\Roaming\Battle.net
2014-08-26 07:52 - 2014-08-26 07:52 - 00001080 _____ () C:\Users\Public\Desktop\Battle.net.lnk
2014-08-26 07:52 - 2014-08-26 07:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle.net
2014-08-26 07:52 - 2014-08-26 07:52 - 00000000 ____D () C:\Program Files\Common Files\Blizzard Entertainment
2014-08-26 07:52 - 2014-08-26 07:52 - 00000000 ____D () C:\Program Files\Battle.net
2014-08-22 09:08 - 2014-08-22 09:08 - 05412944 _____ (Canneverbe Limited ) C:\Users\Detlef Orthmann\Downloads\cdbxp_setup_4.5.4.5000_minimal.exe
2014-08-13 08:52 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-08-13 08:51 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-08-13 08:51 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-08-13 08:51 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-08-13 07:15 - 2014-08-01 01:16 - 00307384 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-13 07:15 - 2014-07-25 15:51 - 17524224 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-13 07:15 - 2014-07-25 15:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-13 07:15 - 2014-07-25 15:03 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-08-13 07:15 - 2014-07-25 14:34 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-08-13 07:15 - 2014-07-25 14:34 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-08-13 07:15 - 2014-07-25 14:33 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-08-13 07:15 - 2014-07-25 14:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-08-13 07:15 - 2014-07-25 14:21 - 02184704 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-13 07:15 - 2014-07-25 14:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-13 07:15 - 2014-07-25 14:17 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-08-13 07:15 - 2014-07-25 14:12 - 00438784 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-08-13 07:15 - 2014-07-25 14:10 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-08-13 07:15 - 2014-07-25 14:10 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-08-13 07:15 - 2014-07-25 14:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-08-13 07:15 - 2014-07-25 14:06 - 04204032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-13 07:15 - 2014-07-25 13:59 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-08-13 07:15 - 2014-07-25 13:52 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-13 07:15 - 2014-07-25 13:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-08-13 07:15 - 2014-07-25 13:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-08-13 07:15 - 2014-07-25 13:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-13 07:15 - 2014-07-25 13:29 - 00239616 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-13 07:15 - 2014-07-25 13:13 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-13 07:15 - 2014-07-25 13:09 - 00663040 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-08-13 07:15 - 2014-07-25 13:07 - 02001920 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-13 07:15 - 2014-07-25 13:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-08-13 07:15 - 2014-07-25 13:03 - 11772928 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-13 07:15 - 2014-07-25 12:09 - 00704512 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-08-13 07:15 - 2014-07-25 12:05 - 01792512 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-13 07:15 - 2014-07-25 12:00 - 01169920 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-13 07:15 - 2014-07-14 03:42 - 00654336 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-08-13 07:15 - 2014-06-16 03:44 - 00730048 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-08-13 07:15 - 2014-06-16 03:44 - 00219072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys
2014-08-13 07:15 - 2014-06-16 03:40 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2014-08-13 07:14 - 2014-08-07 03:43 - 00412160 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-13 07:14 - 2014-08-07 03:39 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-13 07:14 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-08-13 07:14 - 2014-06-03 11:30 - 00101824 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-08-13 07:14 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-08-13 07:14 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-08-13 07:14 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-08-13 07:13 - 2014-07-09 03:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
2014-08-13 07:13 - 2014-07-09 03:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
2014-08-13 07:13 - 2014-07-09 03:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
2014-08-13 07:13 - 2014-07-09 03:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2014-08-13 07:13 - 2014-07-09 03:29 - 00005632 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
2014-08-13 07:13 - 2014-07-09 00:30 - 00419992 _____ () C:\Windows\system32\locale.nls
2014-08-13 07:13 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-08-08 08:45 - 2014-08-08 08:45 - 00798254 _____ ( ) C:\Users\Detlef Orthmann\Downloads\sudoku42n_setup.exe
2014-08-08 08:43 - 2014-08-08 08:43 - 03077808 _____ (Easeware ) C:\Users\Detlef Orthmann\Downloads\DriverEasy_Setup_v4.7.1.exe
2014-08-08 08:43 - 2014-08-08 08:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DriverEasy
2014-08-08 08:43 - 2014-08-08 08:43 - 00000000 ____D () C:\Program Files\Easeware
2014-08-08 08:41 - 2014-08-08 08:41 - 05408152 _____ (Canneverbe Limited ) C:\Users\Detlef Orthmann\Downloads\cdbxp_setup_4.5.4.4954_minimal.exe
2014-08-08 08:39 - 2014-08-08 08:39 - 03738080 _____ (Piriform Ltd) C:\Users\Detlef Orthmann\Downloads\ccsetup416_slim.exe
2014-08-07 06:31 - 2014-08-07 10:56 - 00000000 ____D () C:\Program Files\OnlineCounter
2014-08-07 06:26 - 2014-09-05 08:31 - 00000000 ____D () C:\Program Files\CHIP Updater
2014-08-07 06:26 - 2014-08-07 06:26 - 00000000 ____D () C:\Users\Detlef Orthmann\AppData\Roaming\Abelssoft
2014-08-07 06:26 - 2014-08-07 06:26 - 00000000 ____D () C:\Users\Detlef Orthmann\AppData\Local\Abelssoft
2014-08-07 06:26 - 2014-08-07 06:26 - 00000000 ____D () C:\ProgramData\XDMessagingv4
2014-08-07 06:24 - 2014-08-07 06:25 - 00826192 _____ (Chip Digital GmbH) C:\Users\Detlef Orthmann\Downloads\SWR3 OnlineCounter - CHIP-Installer.exe
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-06 15:58 - 2014-09-06 15:58 - 00012523 _____ () C:\Users\Detlef Orthmann\Desktop\FRST.txt
2014-09-06 15:58 - 2014-09-05 08:43 - 00000000 ____D () C:\FRST
2014-09-06 15:50 - 2009-07-14 06:34 - 00024192 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-06 15:50 - 2009-07-14 06:34 - 00024192 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-06 15:46 - 2014-09-06 15:46 - 00000950 _____ () C:\Users\Detlef Orthmann\Desktop\JRT.txt
2014-09-06 15:43 - 2014-09-05 05:41 - 00000448 _____ () C:\Windows\setupact.log
2014-09-06 15:43 - 2013-06-24 20:16 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-09-06 15:43 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-06 15:42 - 2014-09-06 15:42 - 00000000 ____D () C:\Windows\ERUNT
2014-09-06 15:42 - 2013-06-01 15:18 - 00073987 _____ () C:\Windows\WindowsUpdate.log
2014-09-06 15:40 - 2014-09-06 15:40 - 01016261 _____ (Thisisu) C:\Users\Detlef Orthmann\Desktop\JRT.exe
2014-09-06 15:33 - 2014-09-05 15:43 - 00177512 _____ () C:\Windows\PFRO.log
2014-09-06 15:32 - 2014-09-06 15:27 - 00000000 ____D () C:\AdwCleaner
2014-09-06 15:31 - 2013-06-06 06:17 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-06 15:12 - 2014-09-06 15:12 - 01370483 _____ () C:\Users\Detlef Orthmann\Desktop\adwcleaner_3.309.exe
2014-09-06 15:10 - 2013-06-24 20:16 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-09-06 11:02 - 2013-06-02 14:57 - 00000000 ____D () C:\Users\Detlef Orthmann\AppData\Roaming\vlc
2014-09-06 09:04 - 2014-08-26 07:52 - 00000000 ____D () C:\Users\Detlef Orthmann\AppData\Local\Battle.net
2014-09-05 22:37 - 2013-06-02 14:14 - 00000000 ____D () C:\Users\Detlef Orthmann\AppData\Roaming\Winamp
2014-09-05 20:32 - 2014-09-05 05:46 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-05 20:31 - 2014-09-05 20:32 - 00035848 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-09-05 15:51 - 2014-09-05 15:51 - 00014967 _____ () C:\ComboFix.txt
2014-09-05 15:51 - 2014-09-05 15:37 - 00000000 ____D () C:\ComboFix
2014-09-05 15:51 - 2014-09-05 15:36 - 00000000 ____D () C:\Qoobox
2014-09-05 15:51 - 2013-06-08 14:27 - 00000000 ____D () C:\Users\Detlef Orthmann\AppData\Local\Apps\2.0
2014-09-05 15:51 - 2009-07-14 04:37 - 00000000 __RHD () C:\Users\Default
2014-09-05 15:51 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public
2014-09-05 15:50 - 2014-09-05 15:36 - 00000000 ____D () C:\Windows\erdnt
2014-09-05 15:47 - 2009-07-14 04:04 - 00000215 _____ () C:\Windows\system.ini
2014-09-05 15:43 - 2009-07-14 10:57 - 00000000 ____D () C:\Windows\ShellNew
2014-09-05 15:34 - 2014-09-05 15:34 - 05576440 ____R (Swearware) C:\Users\Detlef Orthmann\Desktop\ComboFix.exe
2014-09-05 14:32 - 2014-09-05 08:28 - 00000000 ____D () C:\AA Log
2014-09-05 13:36 - 2013-06-22 17:14 - 00000000 ____D () C:\Users\Detlef Orthmann\AppData\Local\CrashDumps
2014-09-05 09:30 - 2014-09-05 09:30 - 00003759 _____ () C:\Users\Detlef Orthmann\Documents\Gmer 0509.log
2014-09-05 08:48 - 2014-09-05 08:48 - 00380416 _____ () C:\Users\Detlef Orthmann\Downloads\Gmer-19357.exe
2014-09-05 08:43 - 2014-09-05 08:43 - 01096704 _____ (Farbar) C:\Users\Detlef Orthmann\Desktop\FRST.exe
2014-09-05 08:41 - 2014-09-05 08:41 - 00000000 _____ () C:\Users\Detlef Orthmann\defogger_reenable
2014-09-05 08:41 - 2013-06-01 15:23 - 00000000 ____D () C:\Users\Detlef Orthmann
2014-09-05 08:40 - 2014-09-05 08:40 - 00050477 _____ () C:\Users\Detlef Orthmann\Downloads\Defogger.exe
2014-09-05 08:31 - 2014-08-07 06:26 - 00000000 ____D () C:\Program Files\CHIP Updater
2014-09-05 07:18 - 2014-09-02 14:52 - 00000000 ____D () C:\TCPView
2014-09-05 07:09 - 2014-03-02 16:13 - 00000000 ____D () C:\ProgramData\Package Cache
2014-09-05 07:08 - 2014-09-05 07:02 - 00001095 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-09-05 07:08 - 2014-09-05 07:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-09-05 07:08 - 2014-09-05 06:59 - 00000000 ____D () C:\Program Files\Avira
2014-09-05 07:02 - 2013-06-01 21:36 - 00000000 ____D () C:\ProgramData\Avira
2014-09-05 07:01 - 2014-09-05 07:01 - 00000000 ____D () C:\Users\Detlef Orthmann\AppData\Roaming\Avira
2014-09-05 07:00 - 2014-09-05 07:00 - 00002016 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-09-05 06:53 - 2014-09-05 06:59 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-09-05 06:53 - 2014-09-05 06:59 - 00097648 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-09-05 06:53 - 2014-09-05 06:59 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2014-09-05 06:53 - 2014-09-05 06:59 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
2014-09-05 05:45 - 2014-09-05 05:45 - 00001064 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-09-05 05:45 - 2014-09-05 05:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-09-05 05:45 - 2014-09-05 05:45 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-05 05:45 - 2014-09-05 05:45 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware
2014-09-05 05:42 - 2013-06-08 14:27 - 00000000 ____D () C:\Users\Detlef Orthmann\AppData\Local\Deployment
2014-09-05 05:41 - 2014-09-05 05:41 - 00000000 _____ () C:\Windows\setuperr.log
2014-09-05 05:39 - 2014-09-05 05:39 - 00007238 _____ () C:\Users\Detlef Orthmann\Documents\cc_20140905_053950.reg
2014-09-05 05:15 - 2014-09-05 05:15 - 00001194 _____ () C:\Users\Detlef Orthmann\Documents\majorgeeks.txt
2014-09-05 05:06 - 2014-09-05 05:04 - 17291728 _____ (Malwarebytes Corporation ) C:\Users\Detlef Orthmann\Downloads\mbam-setup-majorgeeks-2.0.2.1012.exe
2014-09-04 11:53 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-09-04 06:45 - 2013-06-01 15:24 - 01618320 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-04 06:36 - 2013-06-02 08:50 - 00067272 _____ () C:\Users\Detlef Orthmann\AppData\Local\GDIPFONTCACHEV1.DAT
2014-09-04 06:33 - 2013-06-01 21:25 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-09-04 06:33 - 2009-07-14 06:33 - 00291888 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-09-03 07:46 - 2014-09-03 07:46 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-09-03 07:15 - 2014-09-03 07:15 - 00000897 _____ () C:\Users\Detlef Orthmann\Desktop\Tcpview - Verknüpfung.lnk
2014-09-03 07:13 - 2014-09-03 07:13 - 00002181 _____ () C:\Users\Public\Desktop\congstar Internet-Manager.lnk
2014-09-03 07:13 - 2014-09-03 07:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\congstar Internet-Manager
2014-09-03 07:13 - 2013-12-27 13:07 - 00000000 ____D () C:\Windows\system32\SupportAppZXH
2014-09-03 07:12 - 2014-09-03 07:12 - 00000000 ____D () C:\Program Files\congstar
2014-09-03 07:12 - 2013-06-01 15:26 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information
2014-09-03 07:02 - 2014-09-03 07:02 - 00009088 _____ () C:\Users\Detlef Orthmann\Documents\cc_20140903_070243.reg
2014-09-02 15:51 - 2013-06-01 22:45 - 00000000 ____D () C:\Ebooks
2014-09-02 15:51 - 2013-06-01 21:02 - 00000000 ___RD () C:\Musik
2014-09-02 15:29 - 2014-09-02 12:14 - 00000000 ____D () C:\Users\Detlef Orthmann\AppData\Roaming\Wireshark
2014-09-02 14:52 - 2014-09-02 14:52 - 00291606 _____ () C:\Users\Detlef Orthmann\Downloads\TCPView.zip
2014-09-02 12:12 - 2014-09-02 12:12 - 00001987 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wireshark 2 Preview.lnk
2014-09-02 12:12 - 2014-09-02 12:11 - 00000000 ____D () C:\Program Files\Wireshark
2014-09-02 12:12 - 2014-09-02 12:05 - 00000000 ____D () C:\Program Files\WinPcap
2014-09-02 12:11 - 2014-09-02 12:11 - 00001720 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wireshark.lnk
2014-09-02 12:06 - 2014-09-02 12:06 - 01101648 _____ () C:\Users\Detlef Orthmann\Downloads\Wireshark 32 Bit - CHIP-Installer.exe
2014-09-02 12:05 - 2014-09-02 12:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinPcap
2014-09-02 12:04 - 2014-09-02 12:04 - 01101648 _____ () C:\Users\Detlef Orthmann\Downloads\WinPcap - CHIP-Installer.exe
2014-09-02 08:59 - 2014-09-02 08:57 - 00000000 ____D () C:\ProgramData\SystemExplorer
2014-09-02 08:57 - 2014-09-02 08:57 - 00001048 _____ () C:\Users\Public\Desktop\System Explorer.lnk
2014-09-02 08:57 - 2014-09-02 08:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Explorer
2014-09-02 08:57 - 2014-09-02 08:57 - 00000000 ____D () C:\Program Files\System Explorer
2014-09-02 08:56 - 2014-09-02 08:56 - 02097264 _____ (Mister Group ) C:\Users\Detlef Orthmann\Downloads\SystemExplorerSetup_593.exe
2014-08-27 10:18 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-08-26 07:55 - 2014-08-26 07:52 - 00000000 ____D () C:\Users\Detlef Orthmann\AppData\Roaming\Battle.net
2014-08-26 07:52 - 2014-08-26 07:52 - 00001080 _____ () C:\Users\Public\Desktop\Battle.net.lnk
2014-08-26 07:52 - 2014-08-26 07:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle.net
2014-08-26 07:52 - 2014-08-26 07:52 - 00000000 ____D () C:\Program Files\Common Files\Blizzard Entertainment
2014-08-26 07:52 - 2014-08-26 07:52 - 00000000 ____D () C:\Program Files\Battle.net
2014-08-23 03:46 - 2014-08-28 08:01 - 00305152 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-23 02:42 - 2014-08-28 08:01 - 02352640 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-22 09:09 - 2013-09-01 14:32 - 00001899 _____ () C:\Users\Public\Desktop\CDBurnerXP.lnk
2014-08-22 09:09 - 2013-09-01 14:32 - 00001849 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
2014-08-22 09:09 - 2013-09-01 14:32 - 00000000 ____D () C:\Program Files\CDBurnerXP
2014-08-22 09:08 - 2014-08-22 09:08 - 05412944 _____ (Canneverbe Limited ) C:\Users\Detlef Orthmann\Downloads\cdbxp_setup_4.5.4.5000_minimal.exe
2014-08-13 10:46 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-08-13 10:20 - 2014-05-06 20:55 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-08-13 08:54 - 2013-07-15 18:03 - 00000000 ____D () C:\Windows\system32\MRT
2014-08-13 08:53 - 2013-06-05 06:27 - 96303304 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-08-08 08:45 - 2014-08-08 08:45 - 00798254 _____ ( ) C:\Users\Detlef Orthmann\Downloads\sudoku42n_setup.exe
2014-08-08 08:43 - 2014-08-08 08:43 - 03077808 _____ (Easeware ) C:\Users\Detlef Orthmann\Downloads\DriverEasy_Setup_v4.7.1.exe
2014-08-08 08:43 - 2014-08-08 08:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DriverEasy
2014-08-08 08:43 - 2014-08-08 08:43 - 00000000 ____D () C:\Program Files\Easeware
2014-08-08 08:43 - 2014-03-02 08:14 - 00001124 _____ () C:\Users\Public\Desktop\DriverEasy.lnk
2014-08-08 08:41 - 2014-08-08 08:41 - 05408152 _____ (Canneverbe Limited ) C:\Users\Detlef Orthmann\Downloads\cdbxp_setup_4.5.4.4954_minimal.exe
2014-08-08 08:40 - 2013-09-18 09:35 - 00000969 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-08-08 08:40 - 2013-09-18 09:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2014-08-08 08:40 - 2013-09-18 09:35 - 00000000 ____D () C:\Program Files\CCleaner
2014-08-08 08:39 - 2014-08-08 08:39 - 03738080 _____ (Piriform Ltd) C:\Users\Detlef Orthmann\Downloads\ccsetup416_slim.exe
2014-08-07 10:56 - 2014-08-07 06:31 - 00000000 ____D () C:\Program Files\OnlineCounter
2014-08-07 06:26 - 2014-08-07 06:26 - 00000000 ____D () C:\Users\Detlef Orthmann\AppData\Roaming\Abelssoft
2014-08-07 06:26 - 2014-08-07 06:26 - 00000000 ____D () C:\Users\Detlef Orthmann\AppData\Local\Abelssoft
2014-08-07 06:26 - 2014-08-07 06:26 - 00000000 ____D () C:\ProgramData\XDMessagingv4
2014-08-07 06:25 - 2014-08-07 06:24 - 00826192 _____ (Chip Digital GmbH) C:\Users\Detlef Orthmann\Downloads\SWR3 OnlineCounter - CHIP-Installer.exe
2014-08-07 03:43 - 2014-08-13 07:14 - 00412160 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-07 03:39 - 2014-08-13 07:14 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
Some content of TEMP:
====================
C:\Users\Detlef Orthmann\AppData\Local\temp\avgnt.exe
C:\Users\Detlef Orthmann\AppData\Local\temp\Quarantine.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-09-06 09:26
==================== End Of Log ============================
--- --- --- |
|
| Themen zu Windows 7, seit 6 Wochen ständiger unerwünschter Download |
| antivir, antivirus, avira, branding, browser, ccsetup, desktop, dvdvideosoft ltd., firefox, flash player, funktioniert nicht mehr, gebraucht, hdd0(c:, hdd0(c:), helper, home, homepage, installation, logfile, mozilla, msiexec.exe, problem, prozessor, realtek, registry, scan, security, stick, svchost.exe, system, usb, windows |
Hybrid-Darstellung
