| |
| |||||||
Log-Analyse und Auswertung: Win7: SUPERAntiSpyware findet 80 ObjekteWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
19.10.2014, 16:55
| #1 |
 |  Win7: SUPERAntiSpyware findet 80 Objekte Hallo liebe Helfer, heute ist mir beim Surfen etwas Seltsames aufgefallen, nämlich unten rechts am Browser-Fenster, wo immer steht, welche Daten geladen werden: Da stand nur kurz, aber so lange, dass ich es erkennen konnte "Übertrage Daten von a.akamaihd.net" (oder so ähnlich). Dieses "a.akamaihd.net" kommt mir bekannt vor, und zwar daher, dass ich es ganz oft schon gelesen hatte, wie ich mir mal massenweise Adware & Co. eingefangen hatte. Äußerlich merke ich zwar keine Auffälligkeiten (wie ständige Popups oder so), aber da ich misstrauisch war, habe ich einmal Malwarebytes durchlaufen lassen. Dieses Programm fand nichts, um mir noch eine "Zweitmeinung" einzuholen, habe ich dann noch "SUPERAntiSpyware" aktiviert. (Ich weiß nicht mehr, woher ich das habe, ich glaube aber, es ist keins von den Programmen, auf die auf trojaner-board.de zum Scan verwiesen wird.) Und wie gesagt, dieses fand 80 Objekte, was mich jetzt natürlich misstrauisch macht. Ich habe die Anweisungen des Programms befolgt und die Funde entfernen lassen und gehe mal davon aus, dass mein Computer wieder bereinigt ist, zumindest in Bezug auf die Funde dieses Programms. Ganz sicher bin ich mir aber nicht und wollte euch bitten, dass vielleicht mal jemand kurz über das Logfile des Progamms schauen könnte und mir dann Entwarnung gibt oder ggf. beim weiteren Vorgehen helfen kann. Hier das Logfile: Code:
ATTFilter SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com
Generated 10/19/2014 at 05:37 PM
Application Version : 6.0.1158
Database Version : 11566
Scan type : Complete Scan
Total Scan Time : 00:28:39
Operating System Information
Windows 7 Professional 32-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Limited User
Memory items scanned : 642
Memory threats detected : 0
Registry items scanned : 32159
Registry threats detected : 0
File items scanned : 43909
File threats detected : 80
Adware.Tracking Cookie
C:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\55HQHGIW.txtC:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\55HQHGIW.txt [ /adtech.de ]
C:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\DB0R762K.txtC:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\DB0R762K.txt [ /ad.360yield.com ]
C:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\GDEUXM4W.txtC:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\GDEUXM4W.txt [ /ad2.adfarm1.adition.com ]
C:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\2LSHMDU8.txtC:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\2LSHMDU8.txt [ /smartadserver.com ]
C:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\WSYTRDOR.txtC:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\WSYTRDOR.txt [ /adform.net ]
C:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\A2SAT3FD.txtC:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\A2SAT3FD.txt [ /burstnet.com ]
C:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\8S4ZTNI0.txtC:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\8S4ZTNI0.txt [ /mediaplex.com ]
C:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\J0FHMQHK.txtC:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\J0FHMQHK.txt [ /atdmt.com ]
C:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\5OSU1RER.txtC:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\5OSU1RER.txt [ /c1.adform.net ]
C:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\71E7SLT3.txtC:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\71E7SLT3.txt [ /ad3.adfarm1.adition.com ]
C:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\5E2ZGRS5.txtC:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\5E2ZGRS5.txt [ /ad.mlnadvertising.com ]
C:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\3W1UAABY.txtC:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\3W1UAABY.txt [ /ads.yahoo.com ]
C:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\LWFK92KJ.txtC:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\LWFK92KJ.txt [ /casalemedia.com ]
C:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\B8CA3UOW.txtC:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\B8CA3UOW.txt [ /adformdsp.net ]
C:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\2DK2JK4Y.txtC:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\2DK2JK4Y.txt [ /adfarm1.adition.com ]
C:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\26G9TI34.txtC:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\26G9TI34.txt [ /at.atwola.com ]
C:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\W7M0XNUR.txtC:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\W7M0XNUR.txt [ /server.adformdsp.net ]
C:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\ROO0NTYQ.txtC:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\ROO0NTYQ.txt [ /track.adform.net ]
C:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\C5YL1NBV.txtC:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\C5YL1NBV.txt [ /doubleclick.net ]
C:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\5NZAZ2PF.txtC:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\5NZAZ2PF.txt [ /revsci.net ]
C:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\WZOIO9X0.txtC:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\WZOIO9X0.txt [ /ad.movad.net ]
C:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\Low\EL4R3EIQ.txtC:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\Low\EL4R3EIQ.txt [ /ad2.adfarm1.adition.com ]
C:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\Low\B2E797FY.txtC:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\Low\B2E797FY.txt [ /adform.net ]
C:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\Low\RLGWT22A.txtC:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\Low\RLGWT22A.txt [ /serving-sys.com ]
C:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\Low\FVODKBB9.txtC:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\Low\FVODKBB9.txt [ /adformdsp.net ]
C:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\Low\6ZL3KA74.txtC:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\Low\6ZL3KA74.txt [ /adfarm1.adition.com ]
C:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\Low\4D1AANLA.txtC:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\Low\4D1AANLA.txt [ /server.adformdsp.net ]
C:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\Low\F1RUCFZ1.txtC:\Users\****\AppData\Roaming\Microsoft\Windows\Cookies\Low\F1RUCFZ1.txt [ /track.adform.net ]
ad4.adfarm1.adition.com [ C:\USERS\****\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.adfarm1.adition.com [ C:\USERS\****\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.adfarm1.adition.com [ C:\USERS\****\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.adfarm1.adition.com [ C:\USERS\****\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.adfarm1.adition.com [ C:\USERS\****\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
ad2.adfarm1.adition.com [ C:\USERS\****\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.adfarm1.adition.com [ C:\USERS\****\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.serving-sys.com [ C:\USERS\****\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.serving-sys.com [ C:\USERS\****\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.adfarm1.adition.com [ C:\USERS\****\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
ad3.adfarm1.adition.com [ C:\USERS\****\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.adfarm1.adition.com [ C:\USERS\****\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.unister-adservices.com [ C:\USERS\****\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WN4XMAYE.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\****\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WN4XMAYE.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\****\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WN4XMAYE.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\****\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WN4XMAYE.DEFAULT\COOKIES.SQLITE ]
www.etracker.de [ C:\USERS\****\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WN4XMAYE.DEFAULT\COOKIES.SQLITE ]
www.etracker.de [ C:\USERS\****\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WN4XMAYE.DEFAULT\COOKIES.SQLITE ]
ad4.adfarm1.adition.com [ C:\USERS\****\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WN4XMAYE.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\****\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WN4XMAYE.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\****\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WN4XMAYE.DEFAULT\COOKIES.SQLITE ]
www.etracker.de [ C:\USERS\****\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WN4XMAYE.DEFAULT\COOKIES.SQLITE ]
.serving-sys.com [ C:\USERS\****\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WN4XMAYE.DEFAULT\COOKIES.SQLITE ]
.serving-sys.com [ C:\USERS\****\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WN4XMAYE.DEFAULT\COOKIES.SQLITE ]
.serving-sys.com [ C:\USERS\****\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WN4XMAYE.DEFAULT\COOKIES.SQLITE ]
.serving-sys.com [ C:\USERS\****\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WN4XMAYE.DEFAULT\COOKIES.SQLITE ]
ad1.adfarm1.adition.com [ C:\USERS\****\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WN4XMAYE.DEFAULT\COOKIES.SQLITE ]
.imrworldwide.com [ C:\USERS\****\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WN4XMAYE.DEFAULT\COOKIES.SQLITE ]
www.etracker.de [ C:\USERS\****\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WN4XMAYE.DEFAULT\COOKIES.SQLITE ]
tracking.tchibo.de [ C:\USERS\****\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WN4XMAYE.DEFAULT\COOKIES.SQLITE ]
.doubleclick.net [ C:\USERS\****\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WN4XMAYE.DEFAULT\COOKIES.SQLITE ]
de.sitestat.com [ C:\USERS\****\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WN4XMAYE.DEFAULT\COOKIES.SQLITE ]
de.sitestat.com [ C:\USERS\****\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WN4XMAYE.DEFAULT\COOKIES.SQLITE ]
de.sitestat.com [ C:\USERS\****\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WN4XMAYE.DEFAULT\COOKIES.SQLITE ]
de.sitestat.com [ C:\USERS\****\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WN4XMAYE.DEFAULT\COOKIES.SQLITE ]
adfarm1.adition.com [ C:\USERS\****\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WN4XMAYE.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\****\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WN4XMAYE.DEFAULT\COOKIES.SQLITE ]
www.etracker.de [ C:\USERS\****\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WN4XMAYE.DEFAULT\COOKIES.SQLITE ]
ad3.adfarm1.adition.com [ C:\USERS\****\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WN4XMAYE.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\****\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WN4XMAYE.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\****\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WN4XMAYE.DEFAULT\COOKIES.SQLITE ]
www.etracker.de [ C:\USERS\****\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WN4XMAYE.DEFAULT\COOKIES.SQLITE ]
www.etracker.de [ C:\USERS\****\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WN4XMAYE.DEFAULT\COOKIES.SQLITE ]
www.etracker.de [ C:\USERS\****\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WN4XMAYE.DEFAULT\COOKIES.SQLITE ]
ad2.adfarm1.adition.com [ C:\USERS\****\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WN4XMAYE.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\****\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WN4XMAYE.DEFAULT\COOKIES.SQLITE ]
.germanwings.112.2o7.net [ C:\USERS\****\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WN4XMAYE.DEFAULT\COOKIES.SQLITE ]
track.adform.net [ C:\USERS\****\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WN4XMAYE.DEFAULT\COOKIES.SQLITE ]
track.adform.net [ C:\USERS\****\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WN4XMAYE.DEFAULT\COOKIES.SQLITE ]
.adform.net [ C:\USERS\****\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WN4XMAYE.DEFAULT\COOKIES.SQLITE ]
.ltur.112.2o7.net [ C:\USERS\****\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WN4XMAYE.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\****\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WN4XMAYE.DEFAULT\COOKIES.SQLITE ]
============
End of Log
============
|
|
19.10.2014, 16:56
| #2 |
| /// the machine /// TB-Ausbilder    | Win7: SUPERAntiSpyware findet 80 Objekte hi,
__________________Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ |
|
19.10.2014, 17:06
| #3 |
| | Win7: SUPERAntiSpyware findet 80 Objekte Hallo Schrauber, vielen Dank für die ultraschnelle Antwort!
__________________ Hier die Logfiles:FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 18-10-2014 01
Ran by **** (administrator) on XY-PC on 19-10-2014 17:59:48
Running from C:\Users\****\Desktop
Loaded Profile: **** (Available profiles: **** & Gast)
Platform: Microsoft Windows 7 Professional Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware1\SASCORE.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(McAfee, Inc.) C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
(pdfforge GmbH) C:\Program Files\PDF Architect\HelperService.exe
(pdfforge GmbH) C:\Program Files\PDF Architect\ConversionService.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Google Inc.) C:\Program Files\Google\Update\1.3.24.15\GoogleCrashHandler.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
() C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
() C:\Windows\Samsung\PanelMgr\SSMMgr.exe
(ScanSoft, Inc.) C:\Program Files\ScanSoft\OmniPageSE4.0\OpWareSE4.exe
() C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe
(SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware1\SUPERANTISPYWARE.EXE
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
() C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(McAfee, Inc.) C:\Program Files\McAfee\SiteAdvisor\saUI.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [703736 2014-10-07] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [CDAServer] => C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe [350072 2012-03-09] ()
HKLM\...\Run: [Samsung PanelMgr] => C:\Windows\Samsung\PanelMgr\ssmmgr.exe [614400 2009-08-14] ()
HKLM\...\Run: [SSBkgdUpdate] => C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [185896 2006-09-28] (Nuance Communications, Inc.)
HKLM\...\Run: [OpwareSE4] => C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe [75304 2006-10-11] (ScanSoft, Inc.)
HKLM\...\Run: [WrtMon.exe] => C:\Windows\system32\spool\drivers\w32x86\3\WrtMon.exe [20480 2006-09-20] ()
HKLM\...\Run: [Avira Systray] => C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe [165168 2014-09-23] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-2617934896-1555523252-518225047-1000\...\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware1\SUPERAntiSpyware.exe [6692632 2014-10-19] (SUPERAntiSpyware)
HKU\S-1-5-21-2617934896-1555523252-518225047-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [22041192 2014-08-27] (Skype Technologies S.A.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - DefaultScope {5C746BA8-B2BA-4D72-83F1-138EC0C5FB3C} URL = https://de.search.yahoo.com/search?fr=mcafee&type=B010DE0D20140710&p={SearchTerms}
SearchScopes: HKCU - {5C746BA8-B2BA-4D72-83F1-138EC0C5FB3C} URL = https://de.search.yahoo.com/search?fr=mcafee&type=B010DE0D20140710&p={SearchTerms}
BHO: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO: PDF Architect Helper -> {3A2D5EBA-F86D-4BD3-A177-019765996711} -> C:\Program Files\PDF Architect\PDFIEHelper.dll (pdfforge GmbH)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: McAfee SiteAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 8.8.8.8 208.67.220.220
FireFox:
========
FF ProfilePath: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\wn4xmaye.default
FF NewTab: chrome://unitedtb/content/newtab/newtab-page.xhtml
FF DefaultSearchEngine: Sichere Suche
FF SearchEngineOrder.1: Sichere Suche
FF SelectedSearchEngine: Sichere Suche
FF Keyword.URL: https://de.search.yahoo.com/search?fr=mcafee&type=B110DE0D20140710&p=
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_189.dll ()
FF Plugin: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\McSiteAdvisor.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Avira Browser Safety - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\wn4xmaye.default\Extensions\abs@avira.com [2014-10-01]
FF Extension: GMX MailCheck - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\wn4xmaye.default\Extensions\toolbar@gmx.net [2014-09-18]
FF Extension: WOT - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\wn4xmaye.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2014-03-25]
FF Extension: Adblock Edge - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\wn4xmaye.default\Extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi [2014-03-25]
FF HKLM\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files\PDF Architect\FFPDFArchitectExt [2014-01-24]
FF HKLM\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files\McAfee\SiteAdvisor
FF Extension: McAfee SiteAdvisor - C:\Program Files\McAfee\SiteAdvisor [2014-05-17]
FF HKCU\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
Chrome:
=======
CHR DefaultSearchKeyword: Default -> mcafee
CHR DefaultSearchURL: Default -> https://de.search.yahoo.com/search?fr=mcafee&type=A210DE0&p={searchTerms}
CHR DefaultSuggestURL: Default ->
CHR Profile: C:\Users\****\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\****\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-14]
CHR Extension: (Avira Browser Safety) - C:\Users\****\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-09-14]
CHR Extension: (Google Wallet) - C:\Users\****\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-03-09]
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 !SASCORE; C:\Program Files\SUPERAntiSpyware1\SASCORE.EXE [142648 2014-10-19] (SUPERAntiSpyware.com)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [431920 2014-10-07] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [431920 2014-10-07] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [160560 2014-09-23] (Avira Operations GmbH & Co. KG)
R2 McAfee SiteAdvisor Service; c:\Program Files\McAfee\SiteAdvisor\McSACore.exe [133696 2014-09-23] (McAfee, Inc.)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [235696 2014-04-09] (McAfee, Inc.)
R2 PDF Architect Helper Service; C:\Program Files\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
R2 PDF Architect Service; C:\Program Files\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98160 2014-10-07] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-10-07] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware1\SASDIFSV.SYS [12880 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware1\SASKUTIL.SYS [67664 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-12-18] (Avira GmbH)
R2 SSPORT; C:\Windows\system32\Drivers\SSPORT.sys [5120 2013-04-10] (Samsung Electronics) [File not signed]
R0 TPkd; C:\Windows\system32\Drivers\TPkd.sys [93336 2012-11-17] (PACE Anti-Piracy, Inc.)
S3 catchme; \??\C:\Users\NIKLAS~1\AppData\Local\Temp\catchme.sys [X]
S2 DgiVecp; \??\C:\Windows\system32\Drivers\DgiVecp.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-19 17:59 - 2014-10-19 18:00 - 00012662 _____ () C:\Users\****\Desktop\FRST.txt
2014-10-19 17:59 - 2014-10-19 17:59 - 00000000 ____D () C:\FRST
2014-10-19 17:58 - 2014-10-19 17:58 - 01103360 _____ (Farbar) C:\Users\****\Desktop\FRST.exe
2014-10-19 17:04 - 2014-10-19 17:07 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware1
2014-10-19 17:04 - 2014-10-19 17:04 - 00001970 _____ () C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
2014-10-19 17:04 - 2014-10-19 17:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
2014-10-15 23:16 - 2014-10-10 03:44 - 00396288 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-10-15 23:16 - 2014-10-10 03:44 - 00230912 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-10-15 23:16 - 2014-10-10 03:39 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-10-15 23:16 - 2014-09-29 02:41 - 02379264 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-10-15 23:15 - 2014-10-07 04:04 - 00331448 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-10-15 23:15 - 2014-09-26 00:46 - 00365056 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-10-15 23:15 - 2014-09-26 00:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-10-15 23:15 - 2014-09-26 00:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-10-15 23:15 - 2014-09-26 00:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-10-15 23:15 - 2014-09-26 00:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-10-15 23:15 - 2014-09-19 03:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-10-15 23:15 - 2014-09-19 03:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-10-15 23:15 - 2014-09-19 03:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-10-15 23:15 - 2014-09-19 03:14 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-10-15 23:15 - 2014-09-19 03:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-10-15 23:15 - 2014-09-19 03:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-10-15 23:15 - 2014-09-19 03:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-10-15 23:15 - 2014-09-19 02:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-10-15 23:15 - 2014-09-19 02:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-10-15 23:15 - 2014-09-19 02:54 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-10-15 23:15 - 2014-09-19 02:53 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-10-15 23:15 - 2014-09-19 02:51 - 00440320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-10-15 23:15 - 2014-09-19 02:50 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-10-15 23:15 - 2014-09-19 02:50 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-10-15 23:15 - 2014-09-19 02:49 - 00597504 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-10-15 23:15 - 2014-09-19 02:44 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-10-15 23:15 - 2014-09-19 02:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-10-15 23:15 - 2014-09-19 02:32 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-10-15 23:15 - 2014-09-19 02:20 - 00677888 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-10-15 23:15 - 2014-09-19 02:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-10-15 23:15 - 2014-09-19 02:18 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-10-15 23:15 - 2014-09-19 01:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-10-15 23:15 - 2014-09-19 01:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-10-15 23:15 - 2014-09-19 01:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-10-15 23:15 - 2014-09-18 03:32 - 02363904 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-10-15 23:15 - 2014-09-13 03:40 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-10-15 23:15 - 2014-09-04 07:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2014-10-15 23:15 - 2014-07-17 03:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll
2014-10-15 23:15 - 2014-07-17 03:39 - 03221504 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-10-15 23:15 - 2014-07-17 03:39 - 01051136 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2014-10-15 23:15 - 2014-07-17 03:39 - 00523264 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-10-15 23:15 - 2014-07-17 03:39 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-10-15 23:15 - 2014-07-17 03:39 - 00131584 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll
2014-10-15 23:15 - 2014-07-17 03:39 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll
2014-10-15 23:15 - 2014-07-17 03:39 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-10-15 23:15 - 2014-07-17 03:39 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-10-15 23:15 - 2014-07-17 03:03 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2014-10-15 23:15 - 2014-07-17 03:02 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2014-10-15 23:15 - 2014-06-19 00:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2014-10-15 23:15 - 2014-06-19 00:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2014-10-15 23:15 - 2014-06-19 00:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2014-10-13 23:46 - 2014-10-13 23:46 - 00007575 _____ () C:\Users\****\Downloads\Synthese.zip
2014-10-13 23:45 - 2014-10-13 23:45 - 01956125 _____ () C:\Users\****\Downloads\01-Additive_Synthese.zip
2014-10-13 23:43 - 2014-10-13 23:43 - 00000000 ____D () C:\Users\****\Documents\Max
2014-10-13 23:43 - 2014-10-13 23:43 - 00000000 ____D () C:\Users\****\AppData\Roaming\PACE Anti-Piracy
2014-10-13 23:43 - 2014-10-13 23:43 - 00000000 ____D () C:\Users\****\AppData\Roaming\Cycling '74
2014-10-13 23:43 - 2014-10-13 23:43 - 00000000 ____D () C:\Users\****\AppData\Local\PACE Anti-Piracy
2014-10-13 23:43 - 2014-10-13 23:43 - 00000000 ____D () C:\ProgramData\PACE Anti-Piracy
2014-10-13 23:36 - 2014-10-13 23:36 - 00001951 _____ () C:\Users\Public\Desktop\Max Runtime 6.1.lnk
2014-10-13 23:36 - 2014-10-13 23:36 - 00001935 _____ () C:\Users\Public\Desktop\Max 6.1.lnk
2014-10-13 23:36 - 2014-10-13 23:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cycling '74
2014-10-13 23:36 - 2014-10-13 23:36 - 00000000 ____D () C:\Program Files\Cycling '74
2014-10-12 19:18 - 2014-10-12 19:18 - 00004255 _____ () C:\Users\****\Documents\Es geht ein' dunkle Wolk' herein.aup
2014-10-12 19:18 - 2014-10-12 19:18 - 00000000 ____D () C:\Users\****\Documents\Es geht ein' dunkle Wolk' herein_data
2014-10-10 02:56 - 2014-10-17 19:02 - 00000000 ____D () C:\Program Files\Convar
2014-10-10 02:55 - 2014-10-10 02:55 - 03462033 _____ () C:\Users\****\Downloads\pci_filerecovery.exe
2014-10-10 02:18 - 2014-10-10 02:19 - 02679080 _____ (SharpNight Co,Ltd ) C:\Users\****\Downloads\7data-softonic.exe
2014-10-10 01:42 - 2014-10-10 01:43 - 04210920 _____ (Piriform Ltd) C:\Users\****\Downloads\rcsetup_28329.exe
2014-10-03 15:11 - 2014-10-03 15:26 - 00000000 ____D () C:\Users\****\Documents\Litauen_2014
2014-10-01 17:41 - 2014-10-01 17:41 - 00000000 ____D () C:\Users\****\AppData\Roaming\pdfforge
2014-10-01 17:41 - 2014-10-01 17:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator
2014-10-01 17:41 - 2014-09-23 09:43 - 01070152 _____ (Microsoft Corporation) C:\Windows\system32\MSCOMCTL.OCX
2014-10-01 17:41 - 2014-09-23 09:43 - 00662288 _____ (Microsoft Corporation) C:\Windows\system32\MSCOMCT2.OCX
2014-10-01 17:41 - 2014-09-23 09:43 - 00137000 _____ (Microsoft Corporation) C:\Windows\system32\MSMAPI32.OCX
2014-10-01 17:40 - 2014-10-01 17:41 - 00000000 ____D () C:\Program Files\PDFCreator
2014-10-01 17:40 - 2014-09-23 09:43 - 00095416 _____ (pdfforge GmbH) C:\Windows\system32\pdfcmon.dll
2014-10-01 17:40 - 2014-09-23 09:43 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\MSMPIDE.DLL
2014-10-01 17:40 - 1998-07-06 18:56 - 00125712 _____ (Microsoft Corporation) C:\Windows\system32\VB6DE.DLL
2014-10-01 17:40 - 1998-07-06 18:55 - 00158208 _____ (Microsoft Corporation) C:\Windows\system32\MSCMCDE.DLL
2014-10-01 17:40 - 1998-07-06 18:55 - 00064512 _____ (Microsoft Corporation) C:\Windows\system32\MSCC2DE.DLL
2014-10-01 14:52 - 2014-10-01 14:52 - 27855352 _____ (pdfforge ) C:\Users\****\Downloads\PDFCreator-1_7_3_setup.exe
2014-09-30 23:59 - 2014-09-25 03:40 - 00519680 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2014-09-30 17:02 - 2014-09-30 17:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice 4.2
2014-09-30 16:57 - 2014-09-30 16:57 - 07421952 _____ () C:\Users\****\Downloads\LibreOffice_4.2.6-secfix_Win_x86_helppack_de.msi
2014-09-30 16:55 - 2014-09-30 16:56 - 220827648 _____ () C:\Users\****\Downloads\LibreOffice_4.2.6-secfix_Win_x86.msi
2014-09-26 23:10 - 2014-09-26 23:10 - 00015472 _____ () C:\Users\Gast\Desktop\interviu matti carlos.xml
2014-09-26 21:56 - 2014-09-26 16:35 - 33400954 ____N () C:\Users\Gast\Desktop\Balsas 040.m4a
2014-09-26 16:43 - 2014-09-26 16:43 - 00000653 _____ () C:\Users\Gast\Desktop\ežys.choras.sąrašas.txt
2014-09-26 13:56 - 2014-09-26 13:56 - 00000000 ____D () C:\Users\Gast\AppData\Roaming\LibreOffice
2014-09-25 01:15 - 2014-09-25 01:15 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-09-24 13:25 - 2014-09-24 13:25 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2014-09-24 13:04 - 2014-09-09 23:47 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-09-23 14:20 - 2014-09-23 14:20 - 00000000 ____D () C:\Users\Gast\AppData\Local\Scansoft
2014-09-23 12:37 - 2014-09-23 12:37 - 00040805 _____ () C:\Users\****\Documents\Viola Köster Gedichte.odt
2014-09-22 22:31 - 2014-09-22 22:39 - 00000000 ____D () C:\Users\****\Desktop\Mysteriöse SD-Card
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-19 17:39 - 2014-01-14 20:40 - 01205471 _____ () C:\Windows\WindowsUpdate.log
2014-10-19 17:35 - 2014-03-09 23:12 - 00001122 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-19 17:15 - 2009-07-14 06:34 - 00031872 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-19 17:15 - 2009-07-14 06:34 - 00031872 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-19 17:14 - 2014-01-27 02:41 - 00000000 ____D () C:\Users\****\AppData\Roaming\Skype
2014-10-19 17:07 - 2014-03-09 23:12 - 00001118 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-19 17:07 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-19 17:07 - 2009-07-14 06:39 - 00128123 _____ () C:\Windows\setupact.log
2014-10-19 16:30 - 2014-04-14 01:58 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-10-18 00:46 - 2010-11-20 23:48 - 00713858 _____ () C:\Windows\PFRO.log
2014-10-17 19:08 - 2014-02-07 03:10 - 00000000 ____D () C:\Users\****\Desktop\web_of_trust_wot-20131118-fx
2014-10-17 15:44 - 2014-01-14 20:48 - 00000000 ____D () C:\Users\****
2014-10-17 12:01 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-10-16 20:54 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-10-16 04:04 - 2009-07-14 06:53 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-10-16 04:04 - 2009-07-14 06:33 - 00348800 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-10-16 04:03 - 2014-05-06 02:53 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-10-16 04:03 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-10-16 03:07 - 2014-01-16 02:40 - 00000000 ____D () C:\Windows\system32\MRT
2014-10-16 03:03 - 2014-01-16 02:40 - 100290944 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-10-15 19:45 - 2014-08-20 23:37 - 00000000 ____D () C:\Users\****\AppData\Local\Adobe
2014-10-15 19:45 - 2014-01-14 21:21 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-10-15 19:45 - 2014-01-14 21:21 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-10-13 23:43 - 2012-10-26 22:12 - 00000000 ___HD () C:\Users\****\AppData\Local\oeevpRqo9D
2014-10-13 23:17 - 2014-08-08 15:33 - 00000000 ____D () C:\ProgramData\Package Cache
2014-10-13 23:17 - 2014-01-16 01:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-10-13 23:17 - 2014-01-16 01:34 - 00000000 ____D () C:\Program Files\Avira
2014-10-10 02:31 - 2010-11-20 23:01 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-10-10 02:21 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public
2014-10-07 13:43 - 2014-02-18 19:58 - 00037384 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-10-07 13:43 - 2014-01-16 01:34 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-10-07 13:43 - 2014-01-16 01:34 - 00098160 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-10-01 14:13 - 2014-05-17 18:01 - 00000000 ____D () C:\Program Files\McAfee
2014-09-30 17:02 - 2014-01-24 21:30 - 00000000 ____D () C:\Program Files\LibreOffice 4
2014-09-30 03:11 - 2014-09-04 00:22 - 00085999 _____ () C:\Users\****\Documents\Unbenannt 2.odt
2014-09-26 22:03 - 2009-07-14 04:37 - 00000000 __RHD () C:\Users\Public\Libraries
2014-09-25 12:19 - 2014-03-10 23:03 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-09-23 14:20 - 2014-04-19 14:23 - 00083456 _____ () C:\Users\Gast\AppData\Local\GDIPFONTCACHEV1.DAT
2014-09-23 12:31 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\NDF
2014-09-20 14:44 - 2014-01-15 01:03 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
Some content of TEMP:
====================
C:\Users\Gast\AppData\Local\Temp\avgnt.exe
C:\Users\****\AppData\Local\Temp\avgnt.exe
C:\Users\****\AppData\Local\Temp\Quarantine.exe
C:\Users\****\AppData\Local\Temp\SAS6_Update.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-10-17 11:50
==================== End Of Log ============================
Addition: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 18-10-2014 01
Ran by **** at 2014-10-19 18:00:28
Running from C:\Users\****\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Flash Player 10 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 10.0.12.36 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 15.0.0.189 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.09) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)
Amazon 1Button App (HKLM\...\{54AA7C11-54B7-4BD8-84B2-85873B5C7A04}) (Version: 1.0.4 - Amazon)
ArcSoft PhotoStudio 5.5 (HKLM\...\{85309D89-7BE9-4094-BB17-24999C6118FC}) (Version: - ArcSoft)
ARIA Engine v1.5.0.4 (HKLM\...\ARIA Engine_is1) (Version: v1.5.0.4 - Plogue Art et Technologie, Inc)
Avira (HKLM\...\{9bd9b85e-7792-483b-a318-cc51ff0877ed}) (Version: 1.1.22.50000 - Avira Operations GmbH & Co. KG)
Avira (Version: 1.1.22.50000 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.7.306 - Avira)
Canon CanoScan Toolbox 5.0 (HKLM\...\CanoScan Toolbox 5.0) (Version: - )
CanoScan 4400F (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_CNQ4803) (Version: - )
Common Desktop Agent (Version: 1.62.0 - OEM) Hidden
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
Extended Asian Language font pack for Adobe Reader XI (HKLM\...\{AC76BA86-7AD7-2530-0000-A00000000004}) (Version: 11.0.0 - Adobe Systems Incorporated)
Finale 2012 (HKLM\...\Finale 2012) (Version: 2012.c.r15.0 - MakeMusic)
Fotogalerie (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Garritan ARIA Player vAppVersion=v1.504 (HKLM\...\__ARIA_1012___is1) (Version: v1.5.0.4 - Garritan)
Garritan Instruments for Finale (HKLM\...\__ARIA_1013___is1) (Version: v1.1.2.3 - Garritan)
Google Chrome (HKLM\...\Google Chrome) (Version: 38.0.2125.104 - Google Inc.)
Google Update Helper (Version: 1.3.24.15 - Google Inc.) Hidden
Junk Mail filter update (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
LibreOffice 4.2 Help Pack (German) (HKLM\...\{2EC623B7-3559-4058-B4AC-14DC018FC0B7}) (Version: 4.2.6.3 - The Document Foundation)
LibreOffice 4.2.6.3 (HKLM\...\{14DB1822-00B5-4820-86B5-EF893CA46B53}) (Version: 4.2.6.3 - The Document Foundation)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Max 6.1.8 (HKLM\...\{2A85C70C-660F-4CBA-AA71-03E6110CBA8F}) (Version: 136.1.8 - Cycling '74)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)
McAfee SiteAdvisor (HKLM\...\{35ED3F83-4BDC-4c44-8EC6-6A8301C7413A}) (Version: 3.7.143 - McAfee, Inc.)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft SkyDrive (HKCU\...\SkyDriveSetup.exe) (Version: 16.4.6013.0910 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Movie Maker (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Mozilla Firefox 32.0.3 (x86 de) (HKLM\...\Mozilla Firefox 32.0.3 (x86 de)) (Version: 32.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 32.0 - Mozilla)
MSVCRT (Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (Version: 16.4.1108.0727 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
PDF Architect (HKLM\...\{064A929A-4DE8-40CF-A901-BD40C14E4D25}) (Version: 1.1.83.9982 - pdfforge GmbH)
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.7.3 - pdfforge)
Photo Common (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Photo Gallery (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Presto! PageManager 7.15.14 (HKLM\...\{D2D6B9EB-C6DC-4DAA-B4DE-BB7D9735E7DA}) (Version: 7.15.14G - NewSoft)
Samsung Easy Printer Manager (HKLM\...\Samsung Easy Printer Manager) (Version: 1.03.72.00(20.09.2013) - Samsung Electronics Co., Ltd.)
Samsung ML-2160 Series (HKLM\...\Samsung ML-2160 Series) (Version: 1.10 (22.11.2012) - Samsung Electronics Co., Ltd.)
Samsung Printer Live Update (HKLM\...\Samsung Printer Live Update) (Version: 1.01.00.04 - Samsung Electronics Co., Ltd.)
ScanSoft OmniPage SE 4.0 (HKLM\...\{C1E693A4-B1D5-4DCD-B68D-2087835B7184}) (Version: 15.00.0020 - Nuance Communications, Inc.)
Skype™ 6.20 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.20.104 - Skype Technologies S.A.)
Stellarium 0.10.2 (HKLM\...\Stellarium_is1) (Version: - )
SUPERAntiSpyware (HKLM\...\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 5.7.1018 - SUPERAntiSpyware.com)
Wartung Samsung ML-191x 252x Series (HKLM\...\Samsung ML-191x 252x Series) (Version: - Samsung Electronics CO.,LTD)
Windows Live Communications Platform (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation)
Windows Live Essentials (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4311.0 - Microsoft Corporation) Hidden
Windows Live Installer (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Mail (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Messenger (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Photo Common (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live SOXE (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live UX Platform (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Writer (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Writer Resources (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-2617934896-1555523252-518225047-1000_Classes\CLSID\{6d05bf60-3eaf-4a97-87c5-10cce505435b}\localserver32 -> C:\Users\****\AppData\Local\Temp\{9c0ba3c1-2b67-45eb-bf69-bed9658d28d2}\IDriver.NonElevated.exe (InstallShield Software Corporation)
CustomCLSID: HKU\S-1-5-21-2617934896-1555523252-518225047-1000_Classes\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC}\localserver32 -> C:\Users\****\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2617934896-1555523252-518225047-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\****\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2617934896-1555523252-518225047-1000_Classes\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B}\localserver32 -> C:\Users\****\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2617934896-1555523252-518225047-1000_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\****\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2617934896-1555523252-518225047-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\****\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2617934896-1555523252-518225047-1000_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\****\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\FileSyncApi.dll (Microsoft Corporation)
==================== Restore Points =========================
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {1057E1E9-A7C6-40EC-9C97-98B085418D4C} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-03-09] (Google Inc.)
Task: {109DB9FD-C5DA-4AC5-97C8-64C81FF09899} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {7F8FC30F-E287-4AFD-83D6-11A9216CA36D} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-03-09] (Google Inc.)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2014-02-01 16:06 - 2011-04-25 13:25 - 00024064 _____ () C:\Windows\System32\ssj1mlm.dll
2014-04-02 17:09 - 2009-03-02 13:02 - 00026624 _____ () C:\Windows\System32\ssp4ml3.dll
2012-03-09 10:58 - 2012-03-09 10:58 - 00350072 _____ () C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
2012-03-09 10:58 - 2012-03-09 10:58 - 00056696 _____ () C:\Program Files\Common Files\Common Desktop Agent\CDASrvPS.dll
2014-04-02 17:10 - 2009-08-14 10:10 - 00614400 _____ () C:\Windows\Samsung\PanelMgr\SSMMgr.exe
2014-08-31 21:10 - 2006-09-20 08:35 - 00020480 _____ () C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe
2014-08-31 21:10 - 2006-09-19 16:05 - 00024576 _____ () C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe
2014-09-25 01:15 - 2014-09-25 01:15 - 03715184 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\Users\****\Cookies:Zwc0xkRjmlSgFnwJeOMjsVlgcV8y
AlternateDataStreams: C:\Users\****\AppData\Local\Temp:y9Pb0Bu49nAlGq1CALe202n9sQ
AlternateDataStreams: C:\Users\****\AppData\Local\Temporary Internet Files:AJqZGtp5m2bGRqe1QiSgE
AlternateDataStreams: C:\Users\****\AppData\Local\Temporary Internet Files:mvTFqdfCoe9DtlaUxOnRAQ
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
========================= Accounts: ==========================
Administrator (S-1-5-21-2617934896-1555523252-518225047-500 - Administrator - Disabled)
Gast (S-1-5-21-2617934896-1555523252-518225047-501 - Limited - Enabled) => C:\Users\Gast
**** (S-1-5-21-2617934896-1555523252-518225047-1000 - Administrator - Enabled) => C:\Users\****
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (10/19/2014 05:08:59 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (10/19/2014 04:39:19 PM) (Source: Application Error) (EventID: 1005) (User: )
Description: Aus einem der folgenden Gründe kann nicht auf die Datei "" zugegriffen werden:
Es besteht ein Problem mit der Netzwerkverbindung, dem Datenträger mit der gespeicherten Datei bzw. den auf dem Computer installierten
Speichertreibern, oder der Datenträger fehlt.
Das Programm Hostprozess für Windows-Dienste wurde wegen dieses Fehlers geschlossen.
Programm: Hostprozess für Windows-Dienste
Datei:
Der Fehlerwert ist im Abschnitt "Zusätzliche Dateien" aufgelistet.
Benutzeraktion
1. Öffnen Sie die Datei erneut.
Diese Situation ist eventuell ein temporäres Problem, das selbstständig behoben wird, wenn das Programm erneut ausgeführt wird.
2.
Wenn Sie weiterhin nicht auf die Datei zugreifen können und
- diese sich im Netzwerk befindet,
dann sollte der Netzwerkadministrator überprüfen, dass kein Netzwerkproblem besteht und dass eine Verbindung mit dem Server hergestellt werden kann.
- diese sich auf einem Wechseldatenträger, wie z. B. einer Diskette oder einer CD, befindet, überprüfen Sie, ob der Datenträger richtig in den Computer eingelegt ist.
3. Überprüfen und reparieren Sie das Dateisystem, indem Sie CHKDSK ausführen. Klicken Sie dazu im Menü "Start" auf "Ausführen", geben Sie CMD ein, und klicken Sie auf "OK". Geben Sie an der Eingabeaufforderung CHKDSK /F ein, und drücken Sie die EINGABETASTE.
4. Stellen Sie die Datei von einer Sicherungskopie wieder her, wenn das Problem weiterhin besteht.
5. Überprüfen Sie, ob andere Dateien auf demselben Datenträger geöffnet werden können. Falls dies nicht möglich ist, ist der Datenträger eventuell beschädigt.
Wenden Sie sich an den Administrator oder den Hersteller der Computerhardware, um weitere Unterstützung zu erhalten, wenn es sich um eine Festplatte handelt.
Zusätzliche Daten
Fehlerwert: C0000185
Datenträgertyp: 0
Error: (10/19/2014 04:39:19 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: svchost.exe_MpsSvc, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bc100
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea91c
Ausnahmecode: 0xc0000006
Fehleroffset: 0x0006f29a
ID des fehlerhaften Prozesses: 0x5a0
Startzeit der fehlerhaften Anwendung: 0xsvchost.exe_MpsSvc0
Pfad der fehlerhaften Anwendung: svchost.exe_MpsSvc1
Pfad des fehlerhaften Moduls: svchost.exe_MpsSvc2
Berichtskennung: svchost.exe_MpsSvc3
Error: (10/19/2014 04:25:12 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (10/18/2014 11:00:17 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (10/18/2014 03:32:10 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (10/18/2014 03:03:49 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (10/18/2014 00:47:50 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (10/17/2014 00:23:01 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (10/16/2014 07:30:51 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (10/19/2014 05:07:19 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (10/19/2014 05:07:01 PM) (Source: volsnap) (EventID: 29) (User: )
Description: Die Schattenkopien von Volume "C:" wurde während der Ermittlung abgebrochen.
Error: (10/19/2014 04:45:31 PM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden des Dienstes "Basisfiltermodul" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen, ist fehlgeschlagen. Fehler:
%%1056
Error: (10/19/2014 04:43:31 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows-Firewall" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (10/19/2014 04:43:31 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Diagnoserichtliniendienst" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (10/19/2014 04:43:31 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Basisfiltermodul" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (10/19/2014 04:40:24 PM) (Source: volsnap) (EventID: 14) (User: )
Description: Die Schattenkopien von Volume "C:" wurden aufgrund eines E/A-Fehlers auf Volume "C:" abgebrochen.
Error: (10/19/2014 04:35:59 PM) (Source: atapi) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort0 gefunden.
Error: (10/19/2014 04:35:59 PM) (Source: atapi) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort0 gefunden.
Error: (10/19/2014 04:35:59 PM) (Source: atapi) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Ide\IdePort0 gefunden.
Microsoft Office Sessions:
=========================
Error: (10/19/2014 05:08:59 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (10/19/2014 04:39:19 PM) (Source: Application Error) (EventID: 1005) (User: )
Description: Hostprozess für Windows-DiensteC00001850
Error: (10/19/2014 04:39:19 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: svchost.exe_MpsSvc6.1.7600.163854a5bc100ntdll.dll6.1.7601.18247521ea91cc00000060006f29a5a001cfeba84269bc05C:\Windows\system32\svchost.exeC:\Windows\SYSTEM32\ntdll.dllb515ee01-579d-11e4-b0b3-c80aa95f0bfd
Error: (10/19/2014 04:25:12 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (10/18/2014 11:00:17 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (10/18/2014 03:32:10 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (10/18/2014 03:03:49 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (10/18/2014 00:47:50 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (10/17/2014 00:23:01 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\Samsung\samsung ml-2160 series\Setup\Setup\bin\wiainst64.exe
Error: (10/16/2014 07:30:51 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
==================== Memory info ===========================
Processor: Pentium(R) Dual-Core CPU T4500 @ 2.30GHz
Percentage of memory in use: 41%
Total physical RAM: 2972.93 MB
Available physical RAM: 1741.63 MB
Total Pagefile: 5944.15 MB
Available Pagefile: 4379.94 MB
Total Virtual: 2047.88 MB
Available Virtual: 1893.57 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:465.66 GB) (Free:380.39 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: DE548313)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=465.7 GB) - (Type=07 NTFS)
==================== End Of Log ============================
|
|
20.10.2014, 10:58
| #4 |
| /// the machine /// TB-Ausbilder | Win7: SUPERAntiSpyware findet 80 Objekte Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
20.10.2014, 12:20
| #5 |
| | Win7: SUPERAntiSpyware findet 80 Objekte O.K., also viel scheinen die Programme nicht gefunden zu haben. Hier die Logs: MBAM: Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 20.10.2014 Suchlauf-Zeit: 12:08:03 Logdatei: mbam.txt Administrator: Ja Version: 2.00.2.1012 Malware Datenbank: v2014.10.20.03 Rootkit Datenbank: v2014.10.17.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Self-protection: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x86 Dateisystem: NTFS Benutzer: **** Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 346361 Verstrichene Zeit: 26 Min, 4 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Aktiviert Heuristics: Aktiviert PUP: Warnen PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 0 (No malicious items detected) Registrierungswerte: 0 (No malicious items detected) Registrierungsdaten: 0 (No malicious items detected) Ordner: 0 (No malicious items detected) Dateien: 0 (No malicious items detected) Physische Sektoren: 0 (No malicious items detected) (end) Code:
ATTFilter # AdwCleaner v4.000 - Bericht erstellt am 20/10/2014 um 12:42:52
# DB v2014-10-19.11
# Aktualisiert 12/10/2014 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (32 bits)
# Benutzername : **** - XY-PC
# Gestartet von : C:\Users\****\Desktop\AdwCleaner_4.000.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\Users\****\AppData\Roaming\pdfforge
Datei Gelöscht : C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\wn4xmaye.default\invalidprefs.js
***** [ Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\bopakagnckmlgajfccecajhnimjiiedh
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\FindRight_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\FindRight_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\NewPlayer_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\NewPlayer_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\updateFindRight_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\updateFindRight_RASMANCS
Schlüssel Gelöscht : HKCU\Software\Softonic
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17344
-\\ Mozilla Firefox v32.0.3 (x86 de)
[2w39fb8y.default] - Zeile gelöscht : user_pref("browser.newtab.url", "chrome://unitedtb/content/newtab/newtab-page.xhtml");
[wn4xmaye.default] - Zeile gelöscht : user_pref("browser.newtab.url", "chrome://unitedtb/content/newtab/newtab-page.xhtml");
-\\ Google Chrome v38.0.2125.104
*************************
AdwCleaner[R0].txt - [1870 octets] - [20/10/2014 12:38:22]
AdwCleaner[S0].txt - [1783 octets] - [20/10/2014 12:42:52]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1843 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.3.3 (10.14.2014:1)
OS: Windows 7 Professional x86
Ran by **** on 20.10.2014 at 12:54:51,52
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
~~~ FireFox
Successfully deleted: [Folder] C:\Users\****\AppData\Roaming\mozilla\firefox\profiles\wn4xmaye.default\extensions\toolbar@gmx.net
Emptied folder: C:\Users\****\AppData\Roaming\mozilla\firefox\profiles\wn4xmaye.default\minidumps [58 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 20.10.2014 at 12:57:00,28
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 20-10-2014
Ran by **** (administrator) on XY-PC on 20-10-2014 12:58:33
Running from C:\Users\****\Desktop
Loaded Profile: **** (Available profiles: **** & Gast)
Platform: Microsoft Windows 7 Professional Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware1\SASCORE.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(McAfee, Inc.) C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
(pdfforge GmbH) C:\Program Files\PDF Architect\HelperService.exe
(pdfforge GmbH) C:\Program Files\PDF Architect\ConversionService.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Google Inc.) C:\Program Files\Google\Update\1.3.24.15\GoogleCrashHandler.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
() C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
() C:\Windows\Samsung\PanelMgr\SSMMgr.exe
(ScanSoft, Inc.) C:\Program Files\ScanSoft\OmniPageSE4.0\OpWareSE4.exe
() C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe
(SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware1\SUPERANTISPYWARE.EXE
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
() C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(McAfee, Inc.) C:\Program Files\McAfee\SiteAdvisor\saUI.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(McAfee, Inc.) C:\Program Files\McAfee\SiteAdvisor\saUI.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [703736 2014-10-07] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [CDAServer] => C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe [350072 2012-03-09] ()
HKLM\...\Run: [Samsung PanelMgr] => C:\Windows\Samsung\PanelMgr\ssmmgr.exe [614400 2009-08-14] ()
HKLM\...\Run: [SSBkgdUpdate] => C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [185896 2006-09-28] (Nuance Communications, Inc.)
HKLM\...\Run: [OpwareSE4] => C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe [75304 2006-10-11] (ScanSoft, Inc.)
HKLM\...\Run: [WrtMon.exe] => C:\Windows\system32\spool\drivers\w32x86\3\WrtMon.exe [20480 2006-09-20] ()
HKLM\...\Run: [Avira Systray] => C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe [165168 2014-09-23] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-2617934896-1555523252-518225047-1000\...\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware1\SUPERAntiSpyware.exe [6692632 2014-10-19] (SUPERAntiSpyware)
HKU\S-1-5-21-2617934896-1555523252-518225047-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [22041192 2014-08-27] (Skype Technologies S.A.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
SearchScopes: HKCU - {5C746BA8-B2BA-4D72-83F1-138EC0C5FB3C} URL = https://de.search.yahoo.com/search?fr=mcafee&type=B010DE0D20140710&p={SearchTerms}
BHO: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO: PDF Architect Helper -> {3A2D5EBA-F86D-4BD3-A177-019765996711} -> C:\Program Files\PDF Architect\PDFIEHelper.dll (pdfforge GmbH)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: McAfee SiteAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 8.8.8.8 208.67.220.220
FireFox:
========
FF ProfilePath: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\wn4xmaye.default
FF NewTab: chrome://unitedtb/content/newtab/newtab-page.xhtml
FF DefaultSearchEngine: Sichere Suche
FF SearchEngineOrder.1: Sichere Suche
FF SelectedSearchEngine: Sichere Suche
FF Keyword.URL: https://de.search.yahoo.com/search?fr=mcafee&type=B110DE0D20140710&p=
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_189.dll ()
FF Plugin: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\McSiteAdvisor.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Avira Browser Safety - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\wn4xmaye.default\Extensions\abs@avira.com [2014-10-01]
FF Extension: WOT - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\wn4xmaye.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2014-03-25]
FF Extension: Adblock Edge - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\wn4xmaye.default\Extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi [2014-03-25]
FF HKLM\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files\PDF Architect\FFPDFArchitectExt [2014-01-24]
FF HKLM\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files\McAfee\SiteAdvisor
FF Extension: McAfee SiteAdvisor - C:\Program Files\McAfee\SiteAdvisor [2014-05-17]
FF HKCU\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
Chrome:
=======
CHR DefaultSearchKeyword: Default -> mcafee
CHR DefaultSearchURL: Default -> https://de.search.yahoo.com/search?fr=mcafee&type=A210DE0&p={searchTerms}
CHR DefaultSuggestURL: Default ->
CHR Profile: C:\Users\****\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\****\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-14]
CHR Extension: (Avira Browser Safety) - C:\Users\****\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-09-14]
CHR Extension: (Google Wallet) - C:\Users\****\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-03-09]
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 !SASCORE; C:\Program Files\SUPERAntiSpyware1\SASCORE.EXE [142648 2014-10-19] (SUPERAntiSpyware.com)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [431920 2014-10-07] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [431920 2014-10-07] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [160560 2014-09-23] (Avira Operations GmbH & Co. KG)
R2 McAfee SiteAdvisor Service; c:\Program Files\McAfee\SiteAdvisor\McSACore.exe [133696 2014-09-23] (McAfee, Inc.)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [235696 2014-04-09] (McAfee, Inc.)
R2 PDF Architect Helper Service; C:\Program Files\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
R2 PDF Architect Service; C:\Program Files\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98160 2014-10-07] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-10-07] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-12-18] (Avira Operations GmbH & Co. KG)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-10-20] (Malwarebytes Corporation)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware1\SASDIFSV.SYS [12880 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware1\SASKUTIL.SYS [67664 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-12-18] (Avira GmbH)
R2 SSPORT; C:\Windows\system32\Drivers\SSPORT.sys [5120 2013-04-10] (Samsung Electronics) [File not signed]
R0 TPkd; C:\Windows\system32\Drivers\TPkd.sys [93336 2012-11-17] (PACE Anti-Piracy, Inc.)
S3 catchme; \??\C:\Users\NIKLAS~1\AppData\Local\Temp\catchme.sys [X]
S2 DgiVecp; \??\C:\Windows\system32\Drivers\DgiVecp.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-20 12:57 - 2014-10-20 12:57 - 00000928 _____ () C:\Users\****\Desktop\JRT.txt
2014-10-20 12:53 - 2014-10-20 12:54 - 01705698 _____ (Thisisu) C:\Users\****\Desktop\JRT.exe
2014-10-20 12:37 - 2014-10-20 12:42 - 00000000 ____D () C:\AdwCleaner
2014-10-20 12:36 - 2014-10-20 12:36 - 01976320 _____ () C:\Users\****\Desktop\AdwCleaner_4.000.exe
2014-10-20 12:34 - 2014-10-20 12:34 - 00001166 _____ () C:\Users\****\Desktop\mbam.txt
2014-10-19 18:00 - 2014-10-19 18:00 - 00024686 _____ () C:\Users\****\Desktop\Addition.txt
2014-10-19 17:59 - 2014-10-20 12:58 - 00012458 _____ () C:\Users\****\Desktop\FRST.txt
2014-10-19 17:59 - 2014-10-20 12:58 - 00000000 ____D () C:\FRST
2014-10-19 17:58 - 2014-10-20 12:58 - 01102848 _____ (Farbar) C:\Users\****\Desktop\FRST.exe
2014-10-19 17:04 - 2014-10-20 12:44 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware1
2014-10-19 17:04 - 2014-10-19 17:04 - 00001970 _____ () C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
2014-10-19 17:04 - 2014-10-19 17:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
2014-10-15 23:16 - 2014-10-10 03:44 - 00396288 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-10-15 23:16 - 2014-10-10 03:44 - 00230912 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-10-15 23:16 - 2014-10-10 03:39 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-10-15 23:16 - 2014-09-29 02:41 - 02379264 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-10-15 23:15 - 2014-10-07 04:04 - 00331448 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-10-15 23:15 - 2014-09-26 00:46 - 00365056 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-10-15 23:15 - 2014-09-26 00:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-10-15 23:15 - 2014-09-26 00:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-10-15 23:15 - 2014-09-26 00:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-10-15 23:15 - 2014-09-26 00:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-10-15 23:15 - 2014-09-19 03:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-10-15 23:15 - 2014-09-19 03:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-10-15 23:15 - 2014-09-19 03:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-10-15 23:15 - 2014-09-19 03:14 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-10-15 23:15 - 2014-09-19 03:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-10-15 23:15 - 2014-09-19 03:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-10-15 23:15 - 2014-09-19 03:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-10-15 23:15 - 2014-09-19 02:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-10-15 23:15 - 2014-09-19 02:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-10-15 23:15 - 2014-09-19 02:54 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-10-15 23:15 - 2014-09-19 02:53 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-10-15 23:15 - 2014-09-19 02:51 - 00440320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-10-15 23:15 - 2014-09-19 02:50 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-10-15 23:15 - 2014-09-19 02:50 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-10-15 23:15 - 2014-09-19 02:49 - 00597504 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-10-15 23:15 - 2014-09-19 02:44 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-10-15 23:15 - 2014-09-19 02:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-10-15 23:15 - 2014-09-19 02:32 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-10-15 23:15 - 2014-09-19 02:20 - 00677888 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-10-15 23:15 - 2014-09-19 02:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-10-15 23:15 - 2014-09-19 02:18 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-10-15 23:15 - 2014-09-19 01:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-10-15 23:15 - 2014-09-19 01:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-10-15 23:15 - 2014-09-19 01:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-10-15 23:15 - 2014-09-18 03:32 - 02363904 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-10-15 23:15 - 2014-09-13 03:40 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-10-15 23:15 - 2014-09-04 07:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2014-10-15 23:15 - 2014-07-17 03:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll
2014-10-15 23:15 - 2014-07-17 03:39 - 03221504 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-10-15 23:15 - 2014-07-17 03:39 - 01051136 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2014-10-15 23:15 - 2014-07-17 03:39 - 00523264 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-10-15 23:15 - 2014-07-17 03:39 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-10-15 23:15 - 2014-07-17 03:39 - 00131584 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll
2014-10-15 23:15 - 2014-07-17 03:39 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll
2014-10-15 23:15 - 2014-07-17 03:39 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-10-15 23:15 - 2014-07-17 03:39 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-10-15 23:15 - 2014-07-17 03:03 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2014-10-15 23:15 - 2014-07-17 03:02 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2014-10-15 23:15 - 2014-06-19 00:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2014-10-15 23:15 - 2014-06-19 00:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2014-10-15 23:15 - 2014-06-19 00:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2014-10-13 23:46 - 2014-10-13 23:46 - 00007575 _____ () C:\Users\****\Downloads\Synthese.zip
2014-10-13 23:45 - 2014-10-13 23:45 - 01956125 _____ () C:\Users\****\Downloads\01-Additive_Synthese.zip
2014-10-13 23:43 - 2014-10-13 23:43 - 00000000 ____D () C:\Users\****\Documents\Max
2014-10-13 23:43 - 2014-10-13 23:43 - 00000000 ____D () C:\Users\****\AppData\Roaming\PACE Anti-Piracy
2014-10-13 23:43 - 2014-10-13 23:43 - 00000000 ____D () C:\Users\****\AppData\Roaming\Cycling '74
2014-10-13 23:43 - 2014-10-13 23:43 - 00000000 ____D () C:\Users\****\AppData\Local\PACE Anti-Piracy
2014-10-13 23:43 - 2014-10-13 23:43 - 00000000 ____D () C:\ProgramData\PACE Anti-Piracy
2014-10-13 23:36 - 2014-10-13 23:36 - 00001951 _____ () C:\Users\Public\Desktop\Max Runtime 6.1.lnk
2014-10-13 23:36 - 2014-10-13 23:36 - 00001935 _____ () C:\Users\Public\Desktop\Max 6.1.lnk
2014-10-13 23:36 - 2014-10-13 23:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cycling '74
2014-10-13 23:36 - 2014-10-13 23:36 - 00000000 ____D () C:\Program Files\Cycling '74
2014-10-12 19:18 - 2014-10-12 19:18 - 00004255 _____ () C:\Users\****\Documents\Es geht ein' dunkle Wolk' herein.aup
2014-10-12 19:18 - 2014-10-12 19:18 - 00000000 ____D () C:\Users\****\Documents\Es geht ein' dunkle Wolk' herein_data
2014-10-10 02:56 - 2014-10-17 19:02 - 00000000 ____D () C:\Program Files\Convar
2014-10-10 02:55 - 2014-10-10 02:55 - 03462033 _____ () C:\Users\****\Downloads\pci_filerecovery.exe
2014-10-10 02:18 - 2014-10-10 02:19 - 02679080 _____ (SharpNight Co,Ltd ) C:\Users\****\Downloads\7data-softonic.exe
2014-10-10 01:42 - 2014-10-10 01:43 - 04210920 _____ (Piriform Ltd) C:\Users\****\Downloads\rcsetup_28329.exe
2014-10-03 15:11 - 2014-10-03 15:26 - 00000000 ____D () C:\Users\****\Documents\Litauen_2014
2014-10-01 17:41 - 2014-10-01 17:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator
2014-10-01 17:41 - 2014-09-23 09:43 - 01070152 _____ (Microsoft Corporation) C:\Windows\system32\MSCOMCTL.OCX
2014-10-01 17:41 - 2014-09-23 09:43 - 00662288 _____ (Microsoft Corporation) C:\Windows\system32\MSCOMCT2.OCX
2014-10-01 17:41 - 2014-09-23 09:43 - 00137000 _____ (Microsoft Corporation) C:\Windows\system32\MSMAPI32.OCX
2014-10-01 17:40 - 2014-10-01 17:41 - 00000000 ____D () C:\Program Files\PDFCreator
2014-10-01 17:40 - 2014-09-23 09:43 - 00095416 _____ (pdfforge GmbH) C:\Windows\system32\pdfcmon.dll
2014-10-01 17:40 - 2014-09-23 09:43 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\MSMPIDE.DLL
2014-10-01 17:40 - 1998-07-06 18:56 - 00125712 _____ (Microsoft Corporation) C:\Windows\system32\VB6DE.DLL
2014-10-01 17:40 - 1998-07-06 18:55 - 00158208 _____ (Microsoft Corporation) C:\Windows\system32\MSCMCDE.DLL
2014-10-01 17:40 - 1998-07-06 18:55 - 00064512 _____ (Microsoft Corporation) C:\Windows\system32\MSCC2DE.DLL
2014-10-01 14:52 - 2014-10-01 14:52 - 27855352 _____ (pdfforge ) C:\Users\****\Downloads\PDFCreator-1_7_3_setup.exe
2014-09-30 23:59 - 2014-09-25 03:40 - 00519680 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2014-09-30 17:02 - 2014-09-30 17:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice 4.2
2014-09-30 16:57 - 2014-09-30 16:57 - 07421952 _____ () C:\Users\****\Downloads\LibreOffice_4.2.6-secfix_Win_x86_helppack_de.msi
2014-09-30 16:55 - 2014-09-30 16:56 - 220827648 _____ () C:\Users\****\Downloads\LibreOffice_4.2.6-secfix_Win_x86.msi
2014-09-26 23:10 - 2014-09-26 23:10 - 00015472 _____ () C:\Users\Gast\Desktop\interviu matti carlos.xml
2014-09-26 21:56 - 2014-09-26 16:35 - 33400954 ____N () C:\Users\Gast\Desktop\Balsas 040.m4a
2014-09-26 16:43 - 2014-09-26 16:43 - 00000653 _____ () C:\Users\Gast\Desktop\ežys.choras.sąrašas.txt
2014-09-26 13:56 - 2014-09-26 13:56 - 00000000 ____D () C:\Users\Gast\AppData\Roaming\LibreOffice
2014-09-25 01:15 - 2014-09-25 01:15 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-09-24 13:25 - 2014-09-24 13:25 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2014-09-24 13:04 - 2014-09-09 23:47 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-09-23 14:20 - 2014-09-23 14:20 - 00000000 ____D () C:\Users\Gast\AppData\Local\Scansoft
2014-09-23 12:37 - 2014-09-23 12:37 - 00040805 _____ () C:\Users\****\Documents\Viola Köster Gedichte.odt
2014-09-22 22:31 - 2014-09-22 22:39 - 00000000 ____D () C:\Users\****\Desktop\Mysteriöse SD-Card
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-20 12:58 - 2014-03-09 22:54 - 00000000 ____D () C:\Users\****\Desktop\FRST-OlderVersion
2014-10-20 12:51 - 2009-07-14 06:34 - 00031872 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-20 12:51 - 2009-07-14 06:34 - 00031872 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-20 12:44 - 2014-03-09 23:12 - 00001118 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-20 12:44 - 2014-01-27 02:41 - 00000000 ____D () C:\Users\****\AppData\Roaming\Skype
2014-10-20 12:44 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-20 12:44 - 2009-07-14 06:39 - 00128291 _____ () C:\Windows\setupact.log
2014-10-20 12:43 - 2014-01-14 20:40 - 01244788 _____ () C:\Windows\WindowsUpdate.log
2014-10-20 12:43 - 2010-11-20 23:48 - 00714176 _____ () C:\Windows\PFRO.log
2014-10-20 12:35 - 2014-03-09 23:12 - 00001122 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-20 12:07 - 2014-04-14 01:58 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-10-17 19:08 - 2014-02-07 03:10 - 00000000 ____D () C:\Users\****\Desktop\web_of_trust_wot-20131118-fx
2014-10-17 15:44 - 2014-01-14 20:48 - 00000000 ____D () C:\Users\****
2014-10-17 12:01 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-10-16 20:54 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-10-16 04:04 - 2009-07-14 06:53 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-10-16 04:04 - 2009-07-14 06:33 - 00348800 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-10-16 04:03 - 2014-05-06 02:53 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-10-16 04:03 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-10-16 03:07 - 2014-01-16 02:40 - 00000000 ____D () C:\Windows\system32\MRT
2014-10-16 03:03 - 2014-01-16 02:40 - 100290944 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-10-15 19:45 - 2014-08-20 23:37 - 00000000 ____D () C:\Users\****\AppData\Local\Adobe
2014-10-15 19:45 - 2014-01-14 21:21 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-10-15 19:45 - 2014-01-14 21:21 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-10-13 23:43 - 2012-10-26 22:12 - 00000000 ___HD () C:\Users\****\AppData\Local\oeevpRqo9D
2014-10-13 23:17 - 2014-08-08 15:33 - 00000000 ____D () C:\ProgramData\Package Cache
2014-10-13 23:17 - 2014-01-16 01:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-10-13 23:17 - 2014-01-16 01:34 - 00000000 ____D () C:\Program Files\Avira
2014-10-10 02:31 - 2010-11-20 23:01 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-10-10 02:21 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public
2014-10-07 13:43 - 2014-02-18 19:58 - 00037384 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-10-07 13:43 - 2014-01-16 01:34 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-10-07 13:43 - 2014-01-16 01:34 - 00098160 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-10-01 14:13 - 2014-05-17 18:01 - 00000000 ____D () C:\Program Files\McAfee
2014-09-30 17:02 - 2014-01-24 21:30 - 00000000 ____D () C:\Program Files\LibreOffice 4
2014-09-30 03:11 - 2014-09-04 00:22 - 00085999 _____ () C:\Users\****\Documents\Unbenannt 2.odt
2014-09-26 22:03 - 2009-07-14 04:37 - 00000000 __RHD () C:\Users\Public\Libraries
2014-09-25 12:19 - 2014-03-10 23:03 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-09-23 14:20 - 2014-04-19 14:23 - 00083456 _____ () C:\Users\Gast\AppData\Local\GDIPFONTCACHEV1.DAT
2014-09-23 12:31 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\NDF
2014-09-20 14:44 - 2014-01-15 01:03 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
Some content of TEMP:
====================
C:\Users\Gast\AppData\Local\Temp\avgnt.exe
C:\Users\****\AppData\Local\Temp\avgnt.exe
C:\Users\****\AppData\Local\Temp\Quarantine.exe
C:\Users\****\AppData\Local\Temp\SAS6_Update.exe
C:\Users\****\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-10-17 11:50
==================== End Of Log ============================
Zwei Sachen, die mir noch aufgefallen sind (vielleicht belanglos, aber zur Sicherheit frage ich besser nach): 1. Wenn ich jetzt (nach allen durchgeführten Scans) in Firefox einen neuen Tab öffne, erscheint in der Adresszeile des leeren Fensters: "chrome://unitedtb/content/newtab/newtab-page.xhtml". Ist das normal? Soweit ich mich erinnern kann, stand immer gar nichts in der Zeile oder vielleicht höchstens "about:blank". Mich irritiert nur, dass da "Chrome" dabei steht, da ich ja eigentlich in Firefox bin... 2. Dieses "a.akamaihd.net" ist immer noch nicht weg. Allerdings kommt es anscheinend auch nur, wenn ich auf Facebook gehe. Sowohl beim Aufrufen der Fb-Startseite als auch beim Ein- und Ausloggen steht während des Ladens der Seiten unten rechts im Browserfenster kurz: "fbstatic-a.akamaihd.net gelesen". Wie gesagt, dieses "a.akamaihd.net" kommt mir daher bekannt vor, wie mein Computer mal richtig voll war mit Adware. Oder kann ich das ignorieren? Geändert von anonym1 (20.10.2014 um 12:26 Uhr) |
|
21.10.2014, 08:08
| #6 |
| /// the machine /// TB-Ausbilder | Win7: SUPERAntiSpyware findet 80 ObjekteESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ --> Win7: SUPERAntiSpyware findet 80 Objekte |
|
21.10.2014, 21:49
| #7 |
| | Win7: SUPERAntiSpyware findet 80 Objekte Wow, ich hätte nicht gedacht, dass Eset nach all den Scans, die ich schon mit Malwarebytes & Co. durchgeführt habe, noch 27 Elemente findet. Hier das Logfile: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=c1d5b1003fdfb544af4c13cc0244621f
# engine=20703
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-10-21 06:43:44
# local_time=2014-10-21 08:43:44 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 100 74031 26565049 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 26251 165548215 0 0
# scanned=267076
# found=27
# cleaned=0
# scan_time=20758
sh=4638BF9CFD9E0B8B4B7C613B83297AC0AC7C5701 ft=1 fh=f91c1fdc7b2e0c90 vn="Variante von Win32/Bundled.Toolbar.Ask.G potenziell unsichere Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-2617934896-1555523252-518225047-1000\$R5QE0PU.exe"
sh=B9A96D9AE94C4B42CA5499933F6DF218B3903768 ft=1 fh=966b3592656dc188 vn="Variante von Win32/Bundled.Toolbar.Ask.D potenziell unsichere Anwendung" ac=I fn="C:\Program Files\Avira\AntiVir Desktop\offercast_avirav7_.exe"
sh=5BBF9B45DD93E3F6708CCC745E60AE167CBE261D ft=0 fh=0000000000000000 vn="JS/Exploit.Agent.NHK Trojaner" ac=I fn="C:\Users\****\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L10NKGKQ\e6hh1a5el5[1].htm"
sh=076FAA48A6EB07D64F822A8A8ACA82B73F03EA89 ft=1 fh=aa6499f6a9e138d7 vn="Variante von Win32/Bundled.Toolbar.Ask.G potenziell unsichere Anwendung" ac=I fn="C:\Users\****\Documents\***_Sich20131231\Program Files (x86)\Ask.com\AviraBrowserSecurity.exe"
sh=8DA177E47518A20E39DC4291A6D1816781168C7E ft=1 fh=0f2b0524b41d8428 vn="Variante von Win32/Bundled.Toolbar.Ask.G potenziell unsichere Anwendung" ac=I fn="C:\Users\****\Documents\***_Sich20131231\Program Files (x86)\Ask.com\GenericAskToolbar.dll"
sh=27EDEDAFA3EC17D9B57A3488FCB3490AD0858848 ft=1 fh=ad721b6852df4da2 vn="Variante von Win32/Bundled.Toolbar.Ask.G potenziell unsichere Anwendung" ac=I fn="C:\Users\****\Documents\***_Sich20131231\Program Files (x86)\Ask.com\precache.exe"
sh=BFB118CAD3F2A5F3943E93D80C2A0E212011218E ft=1 fh=2acc1891c394650b vn="Variante von Win32/Bundled.Toolbar.Ask.G potenziell unsichere Anwendung" ac=I fn="C:\Users\****\Documents\***_Sich20131231\Program Files (x86)\Ask.com\SaUpdate.exe"
sh=A9BDE7AB25BF0BA0F018BB871BABBA8522A892C5 ft=1 fh=5e632be339892fa4 vn="Variante von Win32/Bundled.Toolbar.Ask.G potenziell unsichere Anwendung" ac=I fn="C:\Users\****\Documents\***_Sich20131231\Program Files (x86)\Ask.com\UpdateTask.exe"
sh=FF01775CF3FF714F22955597C1B0A6A053433C2A ft=1 fh=219e9a3fce253d49 vn="Variante von Win32/Bundled.Toolbar.Ask.G potenziell unsichere Anwendung" ac=I fn="C:\Users\****\Documents\***_Sich20131231\Program Files (x86)\Ask.com\Updater\Updater.exe"
sh=71435DDB11E00D0243380C4902324853FE4ECE8F ft=1 fh=12b0cd2dde452d65 vn="Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung" ac=I fn="C:\Users\****\Documents\***_Sich20131231\Program Files (x86)\Avira\AntiVir Desktop\apnic.dll"
sh=FFA8B6510D624A55F3EB7FFD6D5221A44944681C ft=1 fh=3386eb0d6ed0e5e1 vn="Variante von Win32/Bundled.Toolbar.Ask.G potenziell unsichere Anwendung" ac=I fn="C:\Users\****\Documents\***_Sich20131231\Program Files (x86)\Avira\AntiVir Desktop\apnstub.exe"
sh=1A3F14C0A66F9AF050D1F34FBACBAADC31751A07 ft=1 fh=2704a03a0f47b728 vn="Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung" ac=I fn="C:\Users\****\Documents\***_Sich20131231\Program Files (x86)\Avira\AntiVir Desktop\apntoolbarinstaller.exe"
sh=4B553651EF610C0614F8393D6C25ABA0A8F09ECA ft=1 fh=92ef1bb072edf568 vn="Variante von Win32/Bundled.Toolbar.Ask.D potenziell unsichere Anwendung" ac=I fn="C:\Users\****\Documents\***_Sich20131231\Program Files (x86)\Avira\AntiVir Desktop\Offercast_AVIRAV7_.exe"
sh=C323F6E51273CCAFCC42773D027A4C4B89006B1D ft=1 fh=b6863365366e75f9 vn="Variante von Win32/Bundled.Toolbar.Ask.G potenziell unsichere Anwendung" ac=I fn="C:\Users\****\Documents\***_Sich20131231\Users\*****\AppData\Local\AskToolbar\Downloaded Program Files\AviraBrowserSecurity.dll"
sh=0B721092D2B67397D9406788D4DF4DA87CD5A6F4 ft=1 fh=82fa0b549d14e9bf vn="Variante von Win32/Bundled.Toolbar.Ask.G potenziell unsichere Anwendung" ac=I fn="C:\Users\****\Documents\***_Sich20131231\Users\*****\AppData\Local\AskToolbar\Downloaded Program Files\AviraWidget.dll"
sh=9D730A0B6235C8599C076B277AD8754247587E6A ft=1 fh=399d76fdebda03ad vn="Variante von Win32/Bundled.Toolbar.Ask.G potenziell unsichere Anwendung" ac=I fn="C:\Users\****\Documents\***_Sich20131231\Users\*****\AppData\Local\Temp\ApnStub.exe"
sh=4E8A8E380D1A77BA431D61FF87CB4F3ABD9C02B4 ft=1 fh=d813df953ad1d4f7 vn="Variante von Win32/Bundled.Toolbar.Ask.G potenziell unsichere Anwendung" ac=I fn="C:\Users\****\Documents\***_Sich20131231\Users\*****\AppData\Local\Temp\ASK8C09.tmp"
sh=4E8A8E380D1A77BA431D61FF87CB4F3ABD9C02B4 ft=1 fh=d813df953ad1d4f7 vn="Variante von Win32/Bundled.Toolbar.Ask.G potenziell unsichere Anwendung" ac=I fn="C:\Users\****\Documents\***_Sich20131231\Users\*****\AppData\Local\Temp\ASKCB98.tmp"
sh=71435DDB11E00D0243380C4902324853FE4ECE8F ft=1 fh=12b0cd2dde452d65 vn="Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung" ac=I fn="C:\Users\****\Documents\***_Sich20131231\Users\*****\AppData\Local\Temp\AskSLib.dll"
sh=893A0271B302AE6206C052D2AF67DF6B1022BD0E ft=1 fh=4ac3fd3801b7978e vn="Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung" ac=I fn="C:\Users\****\Documents\***_Sich20131231\Users\*****\AppData\Local\Temp\setup.exe"
sh=6A886BF0B40DCF84D5EFAD8F94FF12B339EDD5E5 ft=0 fh=0000000000000000 vn="Variante von Win32/Bundled.Toolbar.Ask.G potenziell unsichere Anwendung" ac=I fn="C:\Users\****\Documents\***_Sich20131231\Users\*****\AppData\LocalLow\AskToolbar\avira.cab"
sh=893A0271B302AE6206C052D2AF67DF6B1022BD0E ft=1 fh=4ac3fd3801b7978e vn="Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung" ac=I fn="C:\Users\****\Documents\***_Sich20131231\Users\*****\AppData\LocalLow\AskToolbar\setup.exe"
sh=591222CAA5655F4DA850A49F8295CEB894EB2637 ft=1 fh=cd652877764c4f5e vn="Variante von Win32/Bundled.Toolbar.Ask.D potenziell unsichere Anwendung" ac=I fn="C:\Users\****\Downloads\avira_free_antivirus_de(1).exe"
sh=08BF6F871199BCDB95F0361EC920DF406BD3597A ft=1 fh=c0776f02905eb6da vn="Variante von Win32/Bundled.Toolbar.Ask.G potenziell unsichere Anwendung" ac=I fn="C:\Users\****\Downloads\avira_free_antivirus_de.exe"
sh=FBBE31F08E493A8B0702FE72F3ABA6DF996E20C6 ft=1 fh=1055b3d0ea15ac02 vn="Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung" ac=I fn="C:\Users\****\Downloads\PDFCreator-1_7_2_setup.exe"
sh=534999ED85CB0AE3C21385B37B538044EA2AB339 ft=1 fh=28e16a9d033375cd vn="Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung" ac=I fn="C:\Users\****\Downloads\PDFCreator-1_7_3_setup.exe"
sh=85C2E758DADB8A93064CA5CEDF96BC69C021B84C ft=1 fh=1f9bbc275addc6d3 vn="Win32/Bundled.Toolbar.Google.D potenziell unsichere Anwendung" ac=I fn="C:\Users\****\Downloads\rcsetup_28329.exe"
Code:
ATTFilter Results of screen317's Security Check version 0.99.89
Windows 7 Service Pack 1 x86 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Avira Desktop
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
SUPERAntiSpyware
McAfee SiteAdvisor
Adobe Flash Player 10 Flash Player out of Date!
Adobe Flash Player 15.0.0.189
Adobe Reader XI
Mozilla Firefox 32.0.3 Firefox out of Date!
Google Chrome 37.0.2062.124
Google Chrome 38.0.2125.104
````````Process Check: objlist.exe by Laurent````````
Avira Antivir avgnt.exe
Avira Antivir avguard.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 21-10-2014
Ran by **** (administrator) on XY-PC on 21-10-2014 22:44:25
Running from C:\Users\****\Desktop
Loaded Profile: **** (Available profiles: **** & Gast)
Platform: Microsoft Windows 7 Professional Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware1\SASCORE.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(McAfee, Inc.) C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
(pdfforge GmbH) C:\Program Files\PDF Architect\HelperService.exe
(pdfforge GmbH) C:\Program Files\PDF Architect\ConversionService.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
() C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
() C:\Windows\Samsung\PanelMgr\SSMMgr.exe
(ScanSoft, Inc.) C:\Program Files\ScanSoft\OmniPageSE4.0\OpWareSE4.exe
() C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe
(SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware1\SUPERANTISPYWARE.EXE
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
() C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\System32\UI0Detect.exe
(Google Inc.) C:\Program Files\Google\Update\1.3.25.5\GoogleCrashHandler.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(McAfee, Inc.) C:\Program Files\McAfee\SiteAdvisor\saUI.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [703736 2014-10-07] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [CDAServer] => C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe [350072 2012-03-09] ()
HKLM\...\Run: [Samsung PanelMgr] => C:\Windows\Samsung\PanelMgr\ssmmgr.exe [614400 2009-08-14] ()
HKLM\...\Run: [SSBkgdUpdate] => C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [185896 2006-09-28] (Nuance Communications, Inc.)
HKLM\...\Run: [OpwareSE4] => C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe [75304 2006-10-11] (ScanSoft, Inc.)
HKLM\...\Run: [WrtMon.exe] => C:\Windows\system32\spool\drivers\w32x86\3\WrtMon.exe [20480 2006-09-20] ()
HKLM\...\Run: [Avira Systray] => C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe [165168 2014-09-23] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-2617934896-1555523252-518225047-1000\...\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware1\SUPERAntiSpyware.exe [6692632 2014-10-19] (SUPERAntiSpyware)
HKU\S-1-5-21-2617934896-1555523252-518225047-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [22066272 2014-10-01] (Skype Technologies S.A.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
SearchScopes: HKCU - {5C746BA8-B2BA-4D72-83F1-138EC0C5FB3C} URL = https://de.search.yahoo.com/search?fr=mcafee&type=B010DE0D20140710&p={SearchTerms}
BHO: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO: PDF Architect Helper -> {3A2D5EBA-F86D-4BD3-A177-019765996711} -> C:\Program Files\PDF Architect\PDFIEHelper.dll (pdfforge GmbH)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: McAfee SiteAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 8.8.8.8 208.67.220.220
FireFox:
========
FF ProfilePath: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\wn4xmaye.default
FF NewTab: chrome://unitedtb/content/newtab/newtab-page.xhtml
FF DefaultSearchEngine: Sichere Suche
FF SearchEngineOrder.1: Sichere Suche
FF SelectedSearchEngine: Sichere Suche
FF Keyword.URL: https://de.search.yahoo.com/search?fr=mcafee&type=B110DE0D20140710&p=
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_189.dll ()
FF Plugin: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\McSiteAdvisor.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Avira Browser Safety - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\wn4xmaye.default\Extensions\abs@avira.com [2014-10-01]
FF Extension: WOT - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\wn4xmaye.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2014-03-25]
FF Extension: Adblock Edge - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\wn4xmaye.default\Extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi [2014-03-25]
FF HKLM\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files\PDF Architect\FFPDFArchitectExt [2014-01-24]
FF HKLM\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files\McAfee\SiteAdvisor
FF Extension: McAfee SiteAdvisor - C:\Program Files\McAfee\SiteAdvisor [2014-05-17]
FF HKCU\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
Chrome:
=======
CHR DefaultSearchKeyword: Default -> mcafee
CHR DefaultSearchURL: Default -> https://de.search.yahoo.com/search?fr=mcafee&type=A210DE0&p={searchTerms}
CHR DefaultSuggestURL: Default ->
CHR Profile: C:\Users\****\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\****\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-14]
CHR Extension: (Avira Browser Safety) - C:\Users\****\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-09-14]
CHR Extension: (Google Wallet) - C:\Users\****\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-03-09]
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 !SASCORE; C:\Program Files\SUPERAntiSpyware1\SASCORE.EXE [142648 2014-10-19] (SUPERAntiSpyware.com)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [431920 2014-10-07] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [431920 2014-10-07] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [160560 2014-09-23] (Avira Operations GmbH & Co. KG)
R2 McAfee SiteAdvisor Service; c:\Program Files\McAfee\SiteAdvisor\McSACore.exe [133696 2014-09-23] (McAfee, Inc.)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [235696 2014-04-09] (McAfee, Inc.)
R2 PDF Architect Helper Service; C:\Program Files\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
R2 PDF Architect Service; C:\Program Files\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98160 2014-10-07] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-10-07] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-12-18] (Avira Operations GmbH & Co. KG)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-10-20] (Malwarebytes Corporation)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware1\SASDIFSV.SYS [12880 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware1\SASKUTIL.SYS [67664 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-12-18] (Avira GmbH)
R2 SSPORT; C:\Windows\system32\Drivers\SSPORT.sys [5120 2013-04-10] (Samsung Electronics) [File not signed]
R0 TPkd; C:\Windows\system32\Drivers\TPkd.sys [93336 2012-11-17] (PACE Anti-Piracy, Inc.)
S3 catchme; \??\C:\Users\NIKLAS~1\AppData\Local\Temp\catchme.sys [X]
S2 DgiVecp; \??\C:\Windows\system32\Drivers\DgiVecp.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-21 22:32 - 2014-10-21 22:32 - 00854448 _____ () C:\Users\****\Desktop\SecurityCheck.exe
2014-10-21 14:55 - 2014-10-21 14:55 - 00000000 ____D () C:\Program Files\ESET
2014-10-21 14:53 - 2014-10-21 14:53 - 02347384 _____ (ESET) C:\Users\****\Desktop\esetsmartinstaller_deu.exe
2014-10-20 19:03 - 2014-10-20 19:03 - 00007149 _____ () C:\Users\****\Desktop\record.maxpat
2014-10-20 12:57 - 2014-10-20 12:57 - 00000928 _____ () C:\Users\****\Desktop\JRT.txt
2014-10-20 12:53 - 2014-10-20 12:54 - 01705698 _____ (Thisisu) C:\Users\****\Desktop\JRT.exe
2014-10-20 12:37 - 2014-10-20 12:42 - 00000000 ____D () C:\AdwCleaner
2014-10-20 12:36 - 2014-10-20 12:36 - 01976320 _____ () C:\Users\****\Desktop\AdwCleaner_4.000.exe
2014-10-20 12:34 - 2014-10-20 12:34 - 00001166 _____ () C:\Users\****\Desktop\mbam.txt
2014-10-19 18:00 - 2014-10-19 18:00 - 00024686 _____ () C:\Users\****\Desktop\Addition.txt
2014-10-19 17:59 - 2014-10-21 22:44 - 00012511 _____ () C:\Users\****\Desktop\FRST.txt
2014-10-19 17:59 - 2014-10-21 22:44 - 00000000 ____D () C:\FRST
2014-10-19 17:58 - 2014-10-21 22:44 - 01102336 _____ (Farbar) C:\Users\****\Desktop\FRST.exe
2014-10-19 17:04 - 2014-10-21 13:20 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware1
2014-10-19 17:04 - 2014-10-19 17:04 - 00001970 _____ () C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
2014-10-19 17:04 - 2014-10-19 17:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
2014-10-15 23:16 - 2014-10-10 03:44 - 00396288 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-10-15 23:16 - 2014-10-10 03:44 - 00230912 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-10-15 23:16 - 2014-10-10 03:39 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-10-15 23:16 - 2014-09-29 02:41 - 02379264 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-10-15 23:15 - 2014-10-07 04:04 - 00331448 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-10-15 23:15 - 2014-09-26 00:46 - 00365056 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-10-15 23:15 - 2014-09-26 00:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-10-15 23:15 - 2014-09-26 00:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-10-15 23:15 - 2014-09-26 00:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-10-15 23:15 - 2014-09-26 00:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-10-15 23:15 - 2014-09-19 03:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-10-15 23:15 - 2014-09-19 03:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-10-15 23:15 - 2014-09-19 03:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-10-15 23:15 - 2014-09-19 03:14 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-10-15 23:15 - 2014-09-19 03:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-10-15 23:15 - 2014-09-19 03:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-10-15 23:15 - 2014-09-19 03:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-10-15 23:15 - 2014-09-19 02:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-10-15 23:15 - 2014-09-19 02:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-10-15 23:15 - 2014-09-19 02:54 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-10-15 23:15 - 2014-09-19 02:53 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-10-15 23:15 - 2014-09-19 02:51 - 00440320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-10-15 23:15 - 2014-09-19 02:50 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-10-15 23:15 - 2014-09-19 02:50 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-10-15 23:15 - 2014-09-19 02:49 - 00597504 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-10-15 23:15 - 2014-09-19 02:44 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-10-15 23:15 - 2014-09-19 02:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-10-15 23:15 - 2014-09-19 02:32 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-10-15 23:15 - 2014-09-19 02:20 - 00677888 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-10-15 23:15 - 2014-09-19 02:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-10-15 23:15 - 2014-09-19 02:18 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-10-15 23:15 - 2014-09-19 01:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-10-15 23:15 - 2014-09-19 01:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-10-15 23:15 - 2014-09-19 01:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-10-15 23:15 - 2014-09-18 03:32 - 02363904 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-10-15 23:15 - 2014-09-13 03:40 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-10-15 23:15 - 2014-09-04 07:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2014-10-15 23:15 - 2014-07-17 03:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll
2014-10-15 23:15 - 2014-07-17 03:39 - 03221504 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-10-15 23:15 - 2014-07-17 03:39 - 01051136 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2014-10-15 23:15 - 2014-07-17 03:39 - 00523264 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-10-15 23:15 - 2014-07-17 03:39 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-10-15 23:15 - 2014-07-17 03:39 - 00131584 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll
2014-10-15 23:15 - 2014-07-17 03:39 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll
2014-10-15 23:15 - 2014-07-17 03:39 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-10-15 23:15 - 2014-07-17 03:39 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-10-15 23:15 - 2014-07-17 03:03 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2014-10-15 23:15 - 2014-07-17 03:02 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2014-10-15 23:15 - 2014-06-19 00:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2014-10-15 23:15 - 2014-06-19 00:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2014-10-15 23:15 - 2014-06-19 00:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2014-10-13 23:46 - 2014-10-13 23:46 - 00007575 _____ () C:\Users\****\Downloads\Synthese.zip
2014-10-13 23:45 - 2014-10-13 23:45 - 01956125 _____ () C:\Users\****\Downloads\01-Additive_Synthese.zip
2014-10-13 23:43 - 2014-10-13 23:43 - 00000000 ____D () C:\Users\****\Documents\Max
2014-10-13 23:43 - 2014-10-13 23:43 - 00000000 ____D () C:\Users\****\AppData\Roaming\PACE Anti-Piracy
2014-10-13 23:43 - 2014-10-13 23:43 - 00000000 ____D () C:\Users\****\AppData\Roaming\Cycling '74
2014-10-13 23:43 - 2014-10-13 23:43 - 00000000 ____D () C:\Users\****\AppData\Local\PACE Anti-Piracy
2014-10-13 23:43 - 2014-10-13 23:43 - 00000000 ____D () C:\ProgramData\PACE Anti-Piracy
2014-10-13 23:36 - 2014-10-13 23:36 - 00001951 _____ () C:\Users\Public\Desktop\Max Runtime 6.1.lnk
2014-10-13 23:36 - 2014-10-13 23:36 - 00001935 _____ () C:\Users\Public\Desktop\Max 6.1.lnk
2014-10-13 23:36 - 2014-10-13 23:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cycling '74
2014-10-13 23:36 - 2014-10-13 23:36 - 00000000 ____D () C:\Program Files\Cycling '74
2014-10-12 19:18 - 2014-10-12 19:18 - 00004255 _____ () C:\Users\****\Documents\Es geht ein' dunkle Wolk' herein.aup
2014-10-12 19:18 - 2014-10-12 19:18 - 00000000 ____D () C:\Users\****\Documents\Es geht ein' dunkle Wolk' herein_data
2014-10-10 02:56 - 2014-10-17 19:02 - 00000000 ____D () C:\Program Files\Convar
2014-10-10 02:55 - 2014-10-10 02:55 - 03462033 _____ () C:\Users\****\Downloads\pci_filerecovery.exe
2014-10-10 02:18 - 2014-10-10 02:19 - 02679080 _____ (SharpNight Co,Ltd ) C:\Users\****\Downloads\7data-softonic.exe
2014-10-10 01:42 - 2014-10-10 01:43 - 04210920 _____ (Piriform Ltd) C:\Users\****\Downloads\rcsetup_28329.exe
2014-10-03 15:11 - 2014-10-03 15:26 - 00000000 ____D () C:\Users\****\Documents\Litauen_2014
2014-10-01 17:41 - 2014-10-01 17:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator
2014-10-01 17:41 - 2014-09-23 09:43 - 01070152 _____ (Microsoft Corporation) C:\Windows\system32\MSCOMCTL.OCX
2014-10-01 17:41 - 2014-09-23 09:43 - 00662288 _____ (Microsoft Corporation) C:\Windows\system32\MSCOMCT2.OCX
2014-10-01 17:41 - 2014-09-23 09:43 - 00137000 _____ (Microsoft Corporation) C:\Windows\system32\MSMAPI32.OCX
2014-10-01 17:40 - 2014-10-01 17:41 - 00000000 ____D () C:\Program Files\PDFCreator
2014-10-01 17:40 - 2014-09-23 09:43 - 00095416 _____ (pdfforge GmbH) C:\Windows\system32\pdfcmon.dll
2014-10-01 17:40 - 2014-09-23 09:43 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\MSMPIDE.DLL
2014-10-01 17:40 - 1998-07-06 18:56 - 00125712 _____ (Microsoft Corporation) C:\Windows\system32\VB6DE.DLL
2014-10-01 17:40 - 1998-07-06 18:55 - 00158208 _____ (Microsoft Corporation) C:\Windows\system32\MSCMCDE.DLL
2014-10-01 17:40 - 1998-07-06 18:55 - 00064512 _____ (Microsoft Corporation) C:\Windows\system32\MSCC2DE.DLL
2014-10-01 14:52 - 2014-10-01 14:52 - 27855352 _____ (pdfforge ) C:\Users\****\Downloads\PDFCreator-1_7_3_setup.exe
2014-09-30 23:59 - 2014-09-25 03:40 - 00519680 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2014-09-30 17:02 - 2014-09-30 17:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice 4.2
2014-09-30 16:57 - 2014-09-30 16:57 - 07421952 _____ () C:\Users\****\Downloads\LibreOffice_4.2.6-secfix_Win_x86_helppack_de.msi
2014-09-30 16:55 - 2014-09-30 16:56 - 220827648 _____ () C:\Users\****\Downloads\LibreOffice_4.2.6-secfix_Win_x86.msi
2014-09-26 23:10 - 2014-09-26 23:10 - 00015472 _____ () C:\Users\Gast\Desktop\interviu matti carlos.xml
2014-09-26 21:56 - 2014-09-26 16:35 - 33400954 ____N () C:\Users\Gast\Desktop\Balsas 040.m4a
2014-09-26 16:43 - 2014-09-26 16:43 - 00000653 _____ () C:\Users\Gast\Desktop\ežys.choras.sąrašas.txt
2014-09-26 13:56 - 2014-09-26 13:56 - 00000000 ____D () C:\Users\Gast\AppData\Roaming\LibreOffice
2014-09-25 01:15 - 2014-09-25 01:15 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-09-24 13:25 - 2014-09-24 13:25 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2014-09-24 13:04 - 2014-09-09 23:47 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-09-23 14:20 - 2014-09-23 14:20 - 00000000 ____D () C:\Users\Gast\AppData\Local\Scansoft
2014-09-23 12:37 - 2014-09-23 12:37 - 00040805 _____ () C:\Users\****\Documents\Viola Köster Gedichte.odt
2014-09-22 22:31 - 2014-09-22 22:39 - 00000000 ____D () C:\Users\****\Desktop\Mysteriöse SD-Card
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-21 22:44 - 2014-03-09 22:54 - 00000000 ____D () C:\Users\****\Desktop\FRST-OlderVersion
2014-10-21 22:23 - 2014-01-14 20:40 - 01318644 _____ () C:\Windows\WindowsUpdate.log
2014-10-21 22:21 - 2014-03-09 23:12 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-21 19:57 - 2009-07-14 06:39 - 00129523 _____ () C:\Windows\setupact.log
2014-10-21 19:50 - 2014-03-09 23:12 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-21 13:27 - 2009-07-14 06:34 - 00031872 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-21 13:27 - 2009-07-14 06:34 - 00031872 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-21 13:20 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-20 22:51 - 2014-01-27 02:41 - 00000000 ____D () C:\Users\****\AppData\Roaming\Skype
2014-10-20 13:40 - 2014-09-18 00:01 - 00000000 ___RD () C:\Program Files\Skype
2014-10-20 13:40 - 2014-01-27 02:41 - 00000000 ____D () C:\ProgramData\Skype
2014-10-20 12:43 - 2010-11-20 23:48 - 00714176 _____ () C:\Windows\PFRO.log
2014-10-20 12:07 - 2014-04-14 01:58 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-10-17 19:08 - 2014-02-07 03:10 - 00000000 ____D () C:\Users\****\Desktop\web_of_trust_wot-20131118-fx
2014-10-17 15:44 - 2014-01-14 20:48 - 00000000 ____D () C:\Users\****
2014-10-17 12:01 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-10-16 20:54 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-10-16 04:04 - 2009-07-14 06:53 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-10-16 04:04 - 2009-07-14 06:33 - 00348800 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-10-16 04:03 - 2014-05-06 02:53 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-10-16 04:03 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-10-16 03:07 - 2014-01-16 02:40 - 00000000 ____D () C:\Windows\system32\MRT
2014-10-16 03:03 - 2014-01-16 02:40 - 100290944 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-10-15 19:45 - 2014-08-20 23:37 - 00000000 ____D () C:\Users\****\AppData\Local\Adobe
2014-10-15 19:45 - 2014-01-14 21:21 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-10-15 19:45 - 2014-01-14 21:21 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-10-13 23:43 - 2012-10-26 22:12 - 00000000 ___HD () C:\Users\****\AppData\Local\oeevpRqo9D
2014-10-13 23:17 - 2014-08-08 15:33 - 00000000 ____D () C:\ProgramData\Package Cache
2014-10-13 23:17 - 2014-01-16 01:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-10-13 23:17 - 2014-01-16 01:34 - 00000000 ____D () C:\Program Files\Avira
2014-10-10 02:31 - 2010-11-20 23:01 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-10-10 02:21 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public
2014-10-07 13:43 - 2014-02-18 19:58 - 00037384 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-10-07 13:43 - 2014-01-16 01:34 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-10-07 13:43 - 2014-01-16 01:34 - 00098160 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-10-02 15:53 - 2014-01-14 21:15 - 00231568 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-10-01 14:13 - 2014-05-17 18:01 - 00000000 ____D () C:\Program Files\McAfee
2014-09-30 17:02 - 2014-01-24 21:30 - 00000000 ____D () C:\Program Files\LibreOffice 4
2014-09-30 03:11 - 2014-09-04 00:22 - 00085999 _____ () C:\Users\****\Documents\Unbenannt 2.odt
2014-09-26 22:03 - 2009-07-14 04:37 - 00000000 __RHD () C:\Users\Public\Libraries
2014-09-25 12:19 - 2014-03-10 23:03 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-09-23 14:20 - 2014-04-19 14:23 - 00083456 _____ () C:\Users\Gast\AppData\Local\GDIPFONTCACHEV1.DAT
2014-09-23 12:31 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\NDF
Some content of TEMP:
====================
C:\Users\Gast\AppData\Local\Temp\avgnt.exe
C:\Users\****\AppData\Local\Temp\avgnt.exe
C:\Users\****\AppData\Local\Temp\Quarantine.exe
C:\Users\****\AppData\Local\Temp\SAS6_Update.exe
C:\Users\****\AppData\Local\Temp\SkypeSetup.exe
C:\Users\****\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-10-17 11:50
==================== End Of Log ============================
"Probleme", die meine Arbeit am Computer einschränken, gibt es in diesem Sinne keine mehr. Leider ist aber dieses "a.akamaihd.net" bei Facebook immer noch da (siehe meine Frage im letzten Post). Ist das ein "Problem" oder kann ich das ignorieren? |
|
22.10.2014, 18:16
| #8 |
| /// the machine /// TB-Ausbilder | Win7: SUPERAntiSpyware findet 80 Objekte Das ist normal. Das gehört zu Facebook. Flash Player updaten. Funde von ESET sind alles nur Avira Funde. Also Avira ansich wird angemeckert. Fertig Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
22.10.2014, 22:21
| #9 |
| | Win7: SUPERAntiSpyware findet 80 Objekte Alles klar, weiß ich Bescheid. O.K., wenn jetzt sogar schon ein Scanner Avira in seiner Eigenschaft als Antivirenprogramm anmeckert, spricht das ja nicht mehr wirklich für Avira, welches ja auch bei euch Fachleuten wohl nicht besonders gut wegkommt. Vielleicht ein willkommener Anlass, endlich auf ein anderes Antivirenprogramm umzusteigen (was ich schon länger vorhabe). Hoffe, ich finde ein gutes kostenloses. Was kannst du empfehlen? A propos Antimalwareprogramm: Kanntest du schon "SUPERAntiSpyware", was mich überhaupt erst so verunsichert hat? Wenn ja, was hältst du davon? Nach all meinen Erfahrungen mit Programmen vertraue ich fast nur noch denen, die mir von Fachleuten empfohlen werden (was bei diesem nicht der Fall war)... Sollte dieses Programm nicht unbedingt nötig sein, kann ich es auch wieder löschen. Ja, dann hätten wir es soweit. Mein Computer läuft wie geschmiert, alles in bester Ordnung. Alles dank deiner Hilfe, die ich hier schon zum zweiten Mal erhalten habe. In diesem Sinne: Ein herzliches  |
|
23.10.2014, 19:37
| #10 |
| /// the machine /// TB-Ausbilder | Win7: SUPERAntiSpyware findet 80 Objekte Nee kannste entfernen. Behal Malwarebytes als Freeversion zum Scannen. Ich empfehle immer Emsisoft, ist aber nicht kostenlos.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
23.10.2014, 21:11
| #11 |
| | Win7: SUPERAntiSpyware findet 80 Objekte O.K., alles klar. Dann wäre alles geklärt. Nochmals danke! |
|
24.10.2014, 16:38
| #12 |
| /// the machine /// TB-Ausbilder | Win7: SUPERAntiSpyware findet 80 Objekte Gern Geschehen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Win7: SUPERAntiSpyware findet 80 Objekte |
| appdata, browser-fenster, code, detected, entfernen, fehlercode 0xc0000006, fehlercode windows, gen, google, js/exploit.agent.nhk, malwarebytes, microsoft, nicht mehr, popups, programme, roaming, superantispyware, surfen, warnung, win, win32/bundled.toolbar.ask, win32/bundled.toolbar.ask.d, win32/bundled.toolbar.ask.g, win32/bundled.toolbar.google.d, win32/installmonetizer.aq |
Linear-Darstellung
