| |
| |||||||
Log-Analyse und Auswertung: Bundestrojaner in neuer Form eingefangenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
27.10.2014, 15:40
| #1 |
 |  Bundestrojaner in neuer Form eingefangen Hallo Trojaner-Spezialisten ich benötigte Eure geschätzte Hilfe, denn ich habe mir irgendwie den neuen "Bundestrojaner" eingefangen. Neu, weil alte Reparaturmaßnahmen wie Starten im abgesicherten Modus, Löschen der neuen exe.-Dateien und Einsatz des Windows Unlockers nicht greifen. Abgesicherter Modus funktioniert nicht, System startet jedes Mal gleich wieder neu. Zudem sind alle Wiederherstellungspunkte anscheinend gelöscht. Da haben diese miesen Abzocker volle Arbeit geleistet. Habt Ihr Trojaner-Spezialisten schon ein "Gegengift" entwickelt? Bitte um Hilfe, insbesondere um überhaupt wieder in den PC zu kommen. Bei weiteren Maßnahmen mit Maybytes, Adaware etc. bin ich dann wieder etwas fitter (was mich nicht davor geschützt hat, mir dieses neue Teil einzufangen. Infektionszeit 27.10.2014 ca. 10-12 Uhr Zudem hatte ich vom 24.-27.10. einen Virus namens BOO/cidox.B, den ich dann mit TDSS-Killer entfernt habe. Zwecks Bundestrojaner habe mit FRST ein Log erstellt: Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-11-2013 (ATTENTION: ====> FRST version is 337 days old and could be outdated)
Ran by SYSTEM on MININT-7AM5CBC on 27-10-2014 14:51:06
Running from J:\
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Recovery
The current controlset is ControlSet002
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11545192 2010-11-02] (Realtek Semiconductor)
HKLM\...\Run: [AtherosBtStack] - C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [613536 2010-10-27] (Atheros Communications)
HKLM\...\Run: [AthBtTray] - C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [379040 2010-10-27] (Atheros Commnucations)
HKLM\...\Run: [Acronis Scheduler2 Service] - C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [377640 2009-05-15] (Acronis)
HKLM\...\Run: [SpywareTerminatorShield] - C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe [2774936 2014-05-13] (Crawler.com)
HKLM\...\Run: [SpywareTerminatorUpdater] - C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe [3681688 2014-05-13] (Crawler.com)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [ISUSScheduler] - C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe [69632 2004-04-13] (InstallShield Software Corporation)
HKLM-x32\...\Run: [WinampAgent] - C:\Program Files (x86)\Winamp\winampa.exe [74752 2011-12-09] (Nullsoft, Inc.)
HKLM-x32\...\Run: [TrueImageMonitor.exe] - C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe [4393112 2009-05-15] (Acronis)
HKLM-x32\...\Run: [AcronisTimounterMonitor] - C:\Program Files (x86)\Acronis\TrueImageHome\TimounterMonitor.exe [962640 2009-05-15] (Acronis)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642808 2012-12-19] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [162856 2013-06-10] (Geek Software GmbH)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [703736 2014-10-01] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] - C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Avira Systray] - C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [165168 2014-09-23] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation)
HKU\michl\...\Run: [ISUSPM Startup] - C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe [196608 2004-04-17] (InstallShield Software Corporation)
HKU\michl\...\Run: [SpybotSD TeaTimer] - C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2260480 2009-03-05] (Safer-Networking Ltd.)
HKU\michl\...\Run: [HydraVisionDesktopManager] - C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe [393216 2011-07-28] (AMD)
HKU\michl\...\Run: [rfxsrvtray] - "d:\Radio Streams\Tobit Radio.fx\Client\rfx-tray.exe"
HKU\michl\...\Run: [AdobeBridge] - [x]
HKU\michl\...\Run: [CCleaner Monitoring] - C:\Program Files\CCleaner\CCleaner64.exe [6501656 2014-10-23] (Piriform Ltd)
Startup: C:\Users\michl\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\program.lnk
ShortcutTarget: program.lnk -> C:\PROGRA~3\E9DDD8AA.cpp (Sun Microsystems, Inc.)
Startup: C:\Users\michl\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Officejet 4620 series.lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Officejet 4620 series.lnk -> C:\Program Files\HP\HP Officejet 4620 series\bin\HPStatusBL.dll (Hewlett-Packard Co.)
==================== Services (Whitelisted) =================
S2 ADExchange; C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe [43624 2012-08-14] (ArcSoft, Inc.)
S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-10-01] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-10-01] (Avira Operations GmbH & Co. KG)
S2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [160560 2014-09-23] (Avira Operations GmbH & Co. KG)
S2 ClickToRunSvc; C:\PROGRAM FILES\MICROSOFT OFFICE 15\CLIENTX64\OFFICECLICKTORUN.EXE [2436280 2014-09-25] (Microsoft Corporation)
S2 PSI_SVC_2_x64; c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe [337776 2014-04-30] (arvato digital services llc)
S3 SandraAgentSrv; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2013.SP6\RpcAgentSrv.exe [71832 2008-10-02] (SiSoftware)
S2 ST2012_Svc; C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe [1146304 2014-05-13] (Crawler.com)
S2 Winmgmt; C:\ProgramData\AA8DDD9E.dot [332800 2014-10-27] ()
S2 Radio.fx; d:\Radio Streams\Tobit Radio.fx\Server\rfx-server.exe [x]
==================== Drivers (Whitelisted) ====================
S3 Apowersoft_AudioDevice; C:\Windows\System32\drivers\Apowersoft_AudioDevice.sys [31920 2013-06-01] (Wondershare)
S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-01] (Avira Operations GmbH & Co. KG)
S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-01] (Avira Operations GmbH & Co. KG)
S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-05-27] (Avira Operations GmbH & Co. KG)
S3 LGDDCDevice; C:\Windows\SysWow64\LGI2CDriver.sys [16384 2010-08-04] (LG Soft India)
S3 LGII2CDevice; C:\Windows\SysWow64\LGPII2CDriver.sys [19968 2011-02-11] ()
S2 sp_rsdrv2; C:\Windows\System32\DRIVERS\stflt.sys [51496 2013-02-04] (Windows (R) Win 7 DDK provider)
S0 tdrpman228; C:\Windows\System32\DRIVERS\tdrpm228.sys [1462304 2012-01-18] (Acronis)
S3 SANDRA; \??\C:\PROGRAM FILES\SISOFTWARE\SISOFTWARE SANDRA LITE 2013.SP4\WNT500X64\Sandra.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-10-27 14:50 - 2014-10-27 14:50 - 00000000 ____D C:\FRST
2014-10-27 12:10 - 2014-10-27 14:43 - 00000840 _____ C:\Windows\setupact.log
2014-10-27 12:10 - 2014-10-27 12:10 - 00000000 _____ C:\Windows\setuperr.log
2014-10-27 11:48 - 2014-10-27 11:48 - 00208896 _____ (Sun Microsystems, Inc.) C:\ProgramData\E9DDD8AA.cpp
2014-10-27 11:17 - 2014-10-27 11:17 - 00000000 ____D C:\Users\michl\AppData\Local\{0D64FD04-F4DA-4F52-92B3-2CB3E74AA9C2}
2014-10-27 01:05 - 2014-10-27 01:05 - 00332800 ____T C:\ProgramData\AA8DDD9E.dot
2014-10-26 22:56 - 2014-10-26 22:56 - 04974864 _____ (Piriform Ltd) C:\Users\michl\Downloads\ccsetup419.exe
2014-10-26 22:51 - 2014-10-26 22:51 - 00000000 ____D C:\TDSSKiller_Quarantine
2014-10-26 22:39 - 2014-10-26 22:39 - 00000593 _____ C:\Users\michl\Desktop\PC-Notfallklinik • Virus BOO-Cidox.B.website
2014-10-26 18:36 - 2014-07-10 12:38 - 04181856 _____ (Kaspersky Lab ZAO) C:\Users\michl\Downloads\TDSSKiller.exe
2014-10-26 18:33 - 2014-10-26 18:34 - 04161313 _____ C:\Users\michl\Downloads\tdsskiller.zip
2014-10-26 13:48 - 2014-10-26 13:48 - 00000000 ____D C:\Users\michl\AppData\Local\{E5D20496-6275-4418-A52F-470413C61203}
2014-10-26 01:06 - 2014-10-26 22:52 - 00000000 ___HD C:\Users\michl\AppData\Roaming\1A828502
2014-10-25 11:59 - 2014-10-25 12:00 - 00000000 ____D C:\Users\michl\AppData\Local\{028D5695-5ED2-430D-9F60-8B581DA6C9EB}
2014-10-24 23:39 - 2014-10-24 23:39 - 00000419 _____ C:\Users\michl\Desktop\Wie verwende ich das Avira Rescue System.website
2014-10-24 21:35 - 2014-10-24 21:35 - 00000000 ____D C:\Users\michl\AppData\Local\{BABB6C3B-26D6-4191-BC15-1EEE451F1DA2}
2014-10-24 09:16 - 2014-10-24 09:16 - 00000000 ____D C:\Users\michl\AppData\Local\{A11D2BD3-0A90-4F19-9045-B8F22017233A}
2014-10-23 21:08 - 2014-10-23 21:09 - 00000000 ____D C:\Users\michl\AppData\Local\{1B3EC223-131F-4F84-8B41-74792648F5D1}
2014-10-23 09:08 - 2014-10-23 09:08 - 00000000 ____D C:\Users\michl\AppData\Local\{0EDC8143-207C-4048-B7B4-1E1E5A2246F8}
2014-10-22 13:45 - 2014-10-22 13:45 - 00000000 ____D C:\Users\michl\AppData\Local\{C9408D38-4DC0-4441-8DE1-6B3031363FF4}
2014-10-21 19:35 - 2014-10-21 19:35 - 00000000 ____D C:\Users\michl\AppData\Local\{8D4BC65C-2277-4196-B6FD-E40853D133A1}
2014-10-21 06:52 - 2014-10-21 06:52 - 00000000 ____D C:\Users\michl\AppData\Local\{6AB32BAE-7B3E-4E76-B78E-455E97D8973B}
2014-10-20 16:44 - 2014-10-20 16:44 - 00000435 _____ C:\Users\michl\Desktop\Paper Cutout Vectors, Photos and PSD files Free Download.website
2014-10-20 11:33 - 2014-10-20 11:34 - 00000000 ____D C:\Users\michl\AppData\Local\{AE9085D3-17B8-488F-B6BF-E7109C4278F1}
2014-10-19 23:33 - 2014-10-19 23:33 - 00000000 ____D C:\Users\michl\AppData\Local\{AF6F6B46-A921-452D-852C-E4436C77120D}
2014-10-19 11:32 - 2014-10-19 11:32 - 00000000 ____D C:\Users\michl\AppData\Local\{A659E336-53F7-45A1-891C-B9ED3F31EFA7}
2014-10-18 16:29 - 2014-10-18 16:29 - 00000000 ____D C:\Users\michl\AppData\Local\{686A0D5E-42D4-4D4E-AC74-B4ED210205B5}
2014-10-18 01:42 - 2014-10-18 01:43 - 00000000 ____D C:\Users\michl\AppData\Local\{DB3D0EFA-4ADB-4F06-AA23-5763E4B99C06}
2014-10-17 13:05 - 2014-10-17 13:05 - 00000000 ____D C:\Users\michl\AppData\Local\{89B744C7-FD8D-4372-B71D-A2F6DC5085AF}
2014-10-17 01:04 - 2014-10-17 01:04 - 00000000 ____D C:\Users\michl\AppData\Local\{078C211E-18D0-43F8-BEFA-83401FF48F79}
2014-10-16 13:00 - 2014-10-16 13:01 - 00000000 ____D C:\Users\michl\AppData\Local\{BAEA00D7-0493-4E8B-9A2A-8CEB2F868687}
2014-10-16 00:02 - 2014-10-16 00:03 - 00000000 ____D C:\Users\michl\AppData\Local\{28A0704E-D785-4CEE-8973-80E8C83EE2D6}
2014-10-15 22:49 - 2014-10-15 22:49 - 00319912 _____ (Oracle Corporation) C:\Windows\System32\javaws.exe
2014-10-15 22:49 - 2014-10-15 22:49 - 00189352 _____ (Oracle Corporation) C:\Windows\System32\javaw.exe
2014-10-15 22:49 - 2014-10-15 22:49 - 00189352 _____ (Oracle Corporation) C:\Windows\System32\java.exe
2014-10-15 22:49 - 2014-10-15 22:49 - 00111016 _____ (Oracle Corporation) C:\Windows\System32\WindowsAccessBridge-64.dll
2014-10-15 22:30 - 2014-10-10 03:05 - 00507392 _____ (Microsoft Corporation) C:\Windows\System32\aepdu.dll
2014-10-15 22:30 - 2014-10-10 03:05 - 00276480 _____ (Microsoft Corporation) C:\Windows\System32\generaltel.dll
2014-10-15 22:30 - 2014-10-10 03:00 - 00424448 _____ (Microsoft Corporation) C:\Windows\System32\aeinv.dll
2014-10-15 22:30 - 2014-10-07 03:54 - 00378552 _____ (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2014-10-15 22:30 - 2014-10-07 03:04 - 00331448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-10-15 22:30 - 2014-09-29 01:58 - 03198976 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys
2014-10-15 22:30 - 2014-09-25 23:50 - 13619200 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2014-10-15 22:30 - 2014-09-25 23:46 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-10-15 22:30 - 2014-09-25 23:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-10-15 22:30 - 2014-09-25 23:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-10-15 22:30 - 2014-09-25 23:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-10-15 22:30 - 2014-09-25 23:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-10-15 22:30 - 2014-09-25 23:31 - 02108416 _____ (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2014-10-15 22:30 - 2014-09-19 03:25 - 23631360 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2014-10-15 22:30 - 2014-09-19 02:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2014-10-15 22:30 - 2014-09-19 02:55 - 00004096 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollectorres.dll
2014-10-15 22:30 - 2014-09-19 02:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-10-15 22:30 - 2014-09-19 02:41 - 02796032 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2014-10-15 22:30 - 2014-09-19 02:40 - 00547328 _____ (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2014-10-15 22:30 - 2014-09-19 02:40 - 00066048 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2014-10-15 22:30 - 2014-09-19 02:39 - 00048640 _____ (Microsoft Corporation) C:\Windows\System32\ieetwproxystub.dll
2014-10-15 22:30 - 2014-09-19 02:38 - 00083968 _____ (Microsoft Corporation) C:\Windows\System32\MshtmlDac.dll
2014-10-15 22:30 - 2014-09-19 02:36 - 05829632 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2014-10-15 22:30 - 2014-09-19 02:31 - 00051200 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2014-10-15 22:30 - 2014-09-19 02:30 - 00033792 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2014-10-15 22:30 - 2014-09-19 02:27 - 00595968 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2014-10-15 22:30 - 2014-09-19 02:26 - 00139264 _____ (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2014-10-15 22:30 - 2014-09-19 02:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-10-15 22:30 - 2014-09-19 02:25 - 00758272 _____ (Microsoft Corporation) C:\Windows\System32\jscript9diag.dll
2014-10-15 22:30 - 2014-09-19 02:25 - 00111616 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollector.exe
2014-10-15 22:30 - 2014-09-19 02:18 - 00940032 _____ (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2014-10-15 22:30 - 2014-09-19 02:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-10-15 22:30 - 2014-09-19 02:14 - 00446464 _____ (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2014-10-15 22:30 - 2014-09-19 02:06 - 00072704 _____ (Microsoft Corporation) C:\Windows\System32\JavaScriptCollectionAgent.dll
2014-10-15 22:30 - 2014-09-19 02:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-10-15 22:30 - 2014-09-19 02:01 - 00195584 _____ (Microsoft Corporation) C:\Windows\System32\msrating.dll
2014-10-15 22:30 - 2014-09-19 02:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-10-15 22:30 - 2014-09-19 02:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-10-15 22:30 - 2014-09-19 02:00 - 00085504 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2014-10-15 22:30 - 2014-09-19 01:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-10-15 22:30 - 2014-09-19 01:58 - 00289280 _____ (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2014-10-15 22:30 - 2014-09-19 01:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-10-15 22:30 - 2014-09-19 01:54 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-10-15 22:30 - 2014-09-19 01:53 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-10-15 22:30 - 2014-09-19 01:51 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-10-15 22:30 - 2014-09-19 01:50 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-10-15 22:30 - 2014-09-19 01:49 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-10-15 22:30 - 2014-09-19 01:42 - 00731136 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2014-10-15 22:30 - 2014-09-19 01:42 - 00710656 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2014-10-15 22:30 - 2014-09-19 01:40 - 01249280 _____ (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll
2014-10-15 22:30 - 2014-09-19 01:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-10-15 22:30 - 2014-09-19 01:33 - 02309632 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2014-10-15 22:30 - 2014-09-19 01:32 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-10-15 22:30 - 2014-09-19 01:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-10-15 22:30 - 2014-09-19 01:18 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-10-15 22:30 - 2014-09-19 01:14 - 01447936 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2014-10-15 22:30 - 2014-09-19 00:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-10-15 22:30 - 2014-09-19 00:59 - 00775168 _____ (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2014-10-15 22:30 - 2014-09-19 00:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-10-15 22:30 - 2014-09-19 00:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-10-15 22:30 - 2014-06-18 23:23 - 01943696 _____ (Microsoft Corporation) C:\Windows\System32\dfshim.dll
2014-10-15 22:30 - 2014-06-18 23:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfshim.dll
2014-10-15 22:30 - 2014-06-18 23:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscorier.dll
2014-10-15 22:30 - 2014-06-18 23:23 - 00156312 _____ (Microsoft Corporation) C:\Windows\System32\mscorier.dll
2014-10-15 22:30 - 2014-06-18 23:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscories.dll
2014-10-15 22:30 - 2014-06-18 23:23 - 00073880 _____ (Microsoft Corporation) C:\Windows\System32\mscories.dll
2014-10-15 22:28 - 2014-09-18 03:00 - 03241472 _____ (Microsoft Corporation) C:\Windows\System32\msi.dll
2014-10-15 22:28 - 2014-09-18 02:32 - 02363904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-10-15 22:28 - 2014-09-13 02:58 - 00077312 _____ (Microsoft Corporation) C:\Windows\System32\packager.dll
2014-10-15 22:28 - 2014-09-13 02:40 - 00067072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2014-10-15 22:28 - 2014-09-04 06:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\System32\rastls.dll
2014-10-15 22:28 - 2014-09-04 06:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll
2014-10-15 22:28 - 2014-08-29 03:07 - 05780480 _____ (Microsoft Corporation) C:\Windows\System32\mstscax.dll
2014-10-15 22:28 - 2014-08-29 03:07 - 03179520 _____ (Microsoft Corporation) C:\Windows\System32\rdpcorets.dll
2014-10-15 22:28 - 2014-08-29 03:07 - 00322560 _____ (Microsoft Corporation) C:\Windows\System32\aaclient.dll
2014-10-15 22:28 - 2014-08-29 03:07 - 00044032 _____ (Microsoft Corporation) C:\Windows\System32\tsgqec.dll
2014-10-15 22:28 - 2014-08-29 03:06 - 01125888 _____ (Microsoft Corporation) C:\Windows\System32\mstsc.exe
2014-10-15 22:28 - 2014-08-29 02:44 - 04922368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-10-15 22:28 - 2014-08-29 02:44 - 01050112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2014-10-15 22:28 - 2014-08-29 02:44 - 00269312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2014-10-15 22:28 - 2014-08-29 02:44 - 00037376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2014-10-15 22:28 - 2014-07-17 03:07 - 00681984 _____ (Microsoft Corporation) C:\Windows\System32\termsrv.dll
2014-10-15 22:28 - 2014-07-17 03:07 - 00455168 _____ (Microsoft Corporation) C:\Windows\System32\winlogon.exe
2014-10-15 22:28 - 2014-07-17 03:07 - 00235520 _____ (Microsoft Corporation) C:\Windows\System32\winsta.dll
2014-10-15 22:28 - 2014-07-17 03:07 - 00150528 _____ (Microsoft Corporation) C:\Windows\System32\rdpcorekmts.dll
2014-10-15 22:28 - 2014-07-17 03:07 - 00086528 _____ (Microsoft Corporation) C:\Windows\System32\TSpkg.dll
2014-10-15 22:28 - 2014-07-17 03:07 - 00022016 _____ (Microsoft Corporation) C:\Windows\System32\credssp.dll
2014-10-15 22:28 - 2014-07-17 02:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winsta.dll
2014-10-15 22:28 - 2014-07-17 02:39 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-10-15 22:28 - 2014-07-17 02:39 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-10-15 22:28 - 2014-07-17 02:21 - 00212480 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\rdpwd.sys
2014-10-15 22:28 - 2014-07-17 02:21 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tssecsrv.sys
2014-10-15 11:54 - 2014-10-15 11:54 - 00000000 ____D C:\Users\michl\AppData\Local\{62161E35-5DC5-4575-B160-AD89DAC8D8A4}
2014-10-14 17:59 - 2014-10-14 17:59 - 00000515 _____ C:\Users\michl\Desktop\The Artist Website Template WIX.website
2014-10-14 15:05 - 2014-10-14 15:05 - 00000000 ____D C:\Users\michl\AppData\Local\{DC9B42E5-77D0-41B6-A6DD-F835571B279C}
2014-10-14 03:04 - 2014-10-14 03:05 - 00000000 ____D C:\Users\michl\AppData\Local\{D78B6E71-6DC8-407A-8D53-351FF0BD84B6}
2014-10-13 11:41 - 2014-10-13 11:41 - 00000000 ____D C:\Users\michl\AppData\Local\{4C26007E-A97C-4BAD-9773-DD6D6F1E7006}
2014-10-12 23:08 - 2014-10-12 23:08 - 00000000 ____D C:\Users\michl\AppData\Local\{FFF8E011-33E3-4902-BCBC-9D9851714F07}
2014-10-12 11:03 - 2014-10-12 11:03 - 00000000 ____D C:\Users\michl\AppData\Local\{9DE33F2C-6968-421C-ACDB-D051B176E009}
2014-10-11 22:57 - 2014-10-11 22:57 - 00000000 ____D C:\Users\michl\AppData\Local\{DA5FC6E2-1640-4A40-8667-B6E23234C0EA}
2014-10-11 10:22 - 2014-10-11 10:23 - 00000000 ____D C:\Users\michl\AppData\Local\{1156B1E8-48A9-46A4-AE60-1F811E4749EF}
2014-10-10 12:04 - 2014-10-10 12:04 - 00000000 ____D C:\Users\michl\AppData\Local\{D1E70BD4-BB8E-4E83-BD85-91AEE44EE666}
2014-10-09 23:28 - 2014-10-09 23:28 - 00000000 ____D C:\Users\michl\AppData\Local\{440EFE67-3A90-4274-9696-53824B076F19}
2014-10-09 11:27 - 2014-10-09 11:27 - 00000000 ____D C:\Users\michl\AppData\Local\{5F5546EE-B590-485E-9612-EBC357245E71}
2014-10-09 01:38 - 2014-10-09 01:38 - 00000537 _____ C:\Users\michl\Desktop\Venedig im Herbst Biennale und la dolce vita in der Lagunenstadt - TRAVELBOOK.de.website
2014-10-08 23:26 - 2014-10-08 23:26 - 00000000 ____D C:\Users\michl\AppData\Local\{827FFF84-208D-4443-A34B-FB15EDD8CFEE}
2014-10-08 20:58 - 2014-10-08 20:58 - 00000840 _____ C:\Users\michl\Desktop\Website des Jahres 2014.website
2014-10-08 11:25 - 2014-10-08 11:25 - 00000000 ____D C:\Users\michl\AppData\Local\{DF4ADCEB-D100-4F25-9BF9-DBEEDC26C4B6}
2014-10-07 23:25 - 2014-10-07 23:25 - 00000000 ____D C:\Users\michl\AppData\Local\{A39AD201-B863-4C2E-8FF2-269CC88AD3EF}
2014-10-07 11:24 - 2014-10-07 11:24 - 00000000 ____D C:\Users\michl\AppData\Local\{E0CE4AC2-33A4-41E6-AC31-E09F63A3EB7B}
2014-10-06 23:20 - 2014-10-06 23:21 - 00000000 ____D C:\Users\michl\AppData\Local\{5B5C60EF-E055-4606-8074-6A25C2DA4ACE}
2014-10-06 11:20 - 2014-10-06 11:20 - 00000000 ____D C:\Users\michl\AppData\Local\{946969FF-462B-42FA-A8B0-1F6BE651C554}
2014-10-05 22:58 - 2014-10-05 22:58 - 00000000 ____D C:\Users\michl\AppData\Local\{AAA7BB37-3FD0-4E22-959C-0B9A176FAC9A}
2014-10-05 10:47 - 2014-10-05 10:47 - 00000000 ____D C:\Users\michl\AppData\Local\{8D708B1A-1C45-429A-9DAC-98EB56BDE186}
2014-10-04 15:17 - 2014-10-04 15:17 - 00000000 ____D C:\Users\michl\AppData\Local\{3E301C69-E57A-47D8-A971-6442FB02B293}
2014-10-04 02:27 - 2014-10-16 01:30 - 00000478 _____ C:\Users\michl\Desktop\Download Facebook, Youtube Videos.website
2014-10-03 22:30 - 2014-10-03 22:30 - 00000000 ____D C:\Users\michl\AppData\Local\{DF7439C3-9574-44EF-9910-8F8B618B24E8}
2014-10-03 18:14 - 2014-10-04 03:27 - 00000494 _____ C:\Users\michl\Desktop\corel draw randanschnitt - Google-Suche.website
2014-10-03 14:18 - 2014-10-03 14:18 - 00001243 _____ C:\Users\michl\Desktop\TreeSize.lnk
2014-10-03 10:29 - 2014-10-03 10:29 - 00000000 ____D C:\Users\michl\AppData\Local\{18CBB337-E2BB-47EA-9D3F-802F1D854F7A}
2014-10-02 21:26 - 2014-10-02 21:27 - 00000000 ____D C:\Users\michl\AppData\Local\{0692D679-121E-45CB-A351-DA02B5042D8A}
2014-10-02 09:26 - 2014-10-02 09:26 - 00000000 ____D C:\Users\michl\AppData\Local\{88AF46EA-78EE-4C02-8F53-257C33141769}
2014-10-01 20:39 - 2014-10-01 20:39 - 00000000 ____D C:\Users\michl\AppData\Local\{8CA17510-4CDA-4DA4-B28C-E6CD7D5D6B86}
2014-10-01 06:48 - 2014-10-01 06:49 - 00000000 ____D C:\Users\michl\AppData\Local\{AB1C24AD-2A7D-46E9-9C2F-DF0AB75C14B5}
2014-10-01 06:33 - 2014-09-25 03:08 - 00371712 _____ (Microsoft Corporation) C:\Windows\System32\qdvd.dll
2014-10-01 06:33 - 2014-09-25 02:40 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2014-09-30 10:58 - 2014-09-30 10:58 - 00000000 ____D C:\Users\michl\AppData\Local\{2A012B63-C483-4781-8FB3-A9FB8AC2E374}
2014-09-29 22:57 - 2014-09-29 22:57 - 00000000 ____D C:\Users\michl\AppData\Local\{B34C39C2-A003-44B7-91A4-FAC2FCD494D0}
2014-09-29 10:56 - 2014-09-29 10:56 - 00000000 ____D C:\Users\michl\AppData\Local\{0821A00D-F454-473B-AD07-CA07ABE16B61}
2014-09-28 11:52 - 2014-09-28 11:52 - 00000000 ____D C:\Users\michl\AppData\Local\{5A59412C-DAE3-4631-8F26-BCB5D52F1D0D}
2014-09-27 23:25 - 2014-09-27 23:25 - 00000000 ____D C:\Users\michl\AppData\Local\{0EEA0510-AA4F-4064-9EA0-44B50C6FDAB6}
2014-09-27 11:06 - 2014-09-27 11:06 - 00000000 ____D C:\Users\michl\AppData\Local\{FCB3FCEC-F8BA-4E0C-BC84-9DD330DACDA6}
2014-09-27 02:46 - 2014-10-08 10:51 - 00000600 _____ C:\Users\michl\Desktop\Mercedes-Benz C 180 KOMPRESSOR T-MODELL - HSN-TSN 0999-AKO - Typklassen Autoversicherung - Autoampel.website
==================== One Month Modified Files and Folders =======
2014-10-27 14:50 - 2014-10-27 14:50 - 00000000 ____D C:\FRST
2014-10-27 14:43 - 2014-10-27 12:10 - 00000840 _____ C:\Windows\setupact.log
2014-10-27 14:43 - 2014-04-16 00:58 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-27 14:43 - 2013-02-04 02:04 - 00000000 ____D C:\ProgramData\Spyware Terminator
2014-10-27 14:43 - 2012-01-13 23:06 - 00000035 _____ C:\Users\Public\Documents\AtherosServiceConfig.ini
2014-10-27 14:43 - 2012-01-13 22:59 - 00000000 ____D C:\Users\michl\Documents\Bluetooth Folder
2014-10-27 14:43 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-10-27 12:10 - 2014-10-27 12:10 - 00000000 _____ C:\Windows\setuperr.log
2014-10-27 12:10 - 2014-02-16 13:46 - 01358009 _____ C:\Windows\WindowsUpdate.log
2014-10-27 12:10 - 2012-01-16 17:19 - 00093608 _____ C:\Users\michl\Desktop\offene2+++.txt
2014-10-27 11:48 - 2014-10-27 11:48 - 00208896 _____ (Sun Microsystems, Inc.) C:\ProgramData\E9DDD8AA.cpp
2014-10-27 11:32 - 2014-04-16 00:58 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-27 11:17 - 2014-10-27 11:17 - 00000000 ____D C:\Users\michl\AppData\Local\{0D64FD04-F4DA-4F52-92B3-2CB3E74AA9C2}
2014-10-27 11:16 - 2013-06-25 07:14 - 00000863 _____ C:\Users\michl\Desktop\Abendzeitung München.website
2014-10-27 11:02 - 2009-07-14 05:45 - 00028912 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-27 11:02 - 2009-07-14 05:45 - 00028912 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-27 11:01 - 2011-04-12 08:43 - 00717444 _____ C:\Windows\System32\perfh007.dat
2014-10-27 11:01 - 2011-04-12 08:43 - 00155004 _____ C:\Windows\System32\perfc007.dat
2014-10-27 11:01 - 2009-07-14 06:13 - 01656676 _____ C:\Windows\System32\PerfStringBackup.INI
2014-10-27 01:05 - 2014-10-27 01:05 - 00332800 ____T C:\ProgramData\AA8DDD9E.dot
2014-10-27 01:05 - 2013-03-08 17:28 - 00000000 ____D C:\Users\michl\AppData\Local\CrashDumps
2014-10-26 23:00 - 2013-02-04 02:25 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2014-10-26 22:56 - 2014-10-26 22:56 - 04974864 _____ (Piriform Ltd) C:\Users\michl\Downloads\ccsetup419.exe
2014-10-26 22:56 - 2013-02-04 01:55 - 00000822 _____ C:\Users\Public\Desktop\CCleaner.lnk
2014-10-26 22:56 - 2013-02-04 01:55 - 00000000 ____D C:\Program Files\CCleaner
2014-10-26 22:52 - 2014-10-26 01:06 - 00000000 ___HD C:\Users\michl\AppData\Roaming\1A828502
2014-10-26 22:51 - 2014-10-26 22:51 - 00000000 ____D C:\TDSSKiller_Quarantine
2014-10-26 22:39 - 2014-10-26 22:39 - 00000593 _____ C:\Users\michl\Desktop\PC-Notfallklinik • Virus BOO-Cidox.B.website
2014-10-26 18:34 - 2014-10-26 18:33 - 04161313 _____ C:\Users\michl\Downloads\tdsskiller.zip
2014-10-26 13:48 - 2014-10-26 13:48 - 00000000 ____D C:\Users\michl\AppData\Local\{E5D20496-6275-4418-A52F-470413C61203}
2014-10-25 12:00 - 2014-10-25 11:59 - 00000000 ____D C:\Users\michl\AppData\Local\{028D5695-5ED2-430D-9F60-8B581DA6C9EB}
2014-10-25 12:00 - 2013-02-04 14:31 - 00000072 _____ C:\Users\Public\LMDebug.log
2014-10-24 23:58 - 2014-07-23 12:06 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\MBAMSwissArmy.sys
2014-10-24 23:39 - 2014-10-24 23:39 - 00000419 _____ C:\Users\michl\Desktop\Wie verwende ich das Avira Rescue System.website
2014-10-24 23:35 - 2013-05-16 22:37 - 00000000 ____D C:\Program Files\Microsoft Office 15
2014-10-24 23:28 - 2014-07-23 12:05 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-10-24 23:28 - 2013-02-04 02:01 - 00001066 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-10-24 23:16 - 2012-01-03 02:52 - 00000000 ____D C:\users\michl
2014-10-24 23:15 - 2014-05-22 22:36 - 00000000 ____D C:\ProgramData\Protexis64
2014-10-24 23:15 - 2013-06-17 06:57 - 00000000 ____D C:\Users\Public\Documents\NetObjects Fusion 12.0
2014-10-24 23:15 - 2012-01-18 15:55 - 00000000 ____D C:\Users\michl\AppData\Roaming\vlc
2014-10-24 23:14 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\registration
2014-10-24 21:35 - 2014-10-24 21:35 - 00000000 ____D C:\Users\michl\AppData\Local\{BABB6C3B-26D6-4191-BC15-1EEE451F1DA2}
2014-10-24 09:16 - 2014-10-24 09:16 - 00000000 ____D C:\Users\michl\AppData\Local\{A11D2BD3-0A90-4F19-9045-B8F22017233A}
2014-10-24 00:49 - 2013-02-07 14:09 - 00000493 _____ C:\Users\michl\Desktop\Wortschatz.website
2014-10-23 21:09 - 2014-10-23 21:08 - 00000000 ____D C:\Users\michl\AppData\Local\{1B3EC223-131F-4F84-8B41-74792648F5D1}
2014-10-23 20:04 - 2013-11-11 23:52 - 00000514 _____ C:\Users\michl\Desktop\Zattoo -webTV.website
2014-10-23 09:08 - 2014-10-23 09:08 - 00000000 ____D C:\Users\michl\AppData\Local\{0EDC8143-207C-4048-B7B4-1E1E5A2246F8}
2014-10-22 18:01 - 2013-05-22 23:24 - 00000000 ____D C:\Users\michl\Documents\Benutzerdefinierte Office-Vorlagen
2014-10-22 13:58 - 2012-01-18 14:12 - 00000000 ____D C:\Users\michl\AppData\Roaming\FileZilla
2014-10-22 13:45 - 2014-10-22 13:45 - 00000000 ____D C:\Users\michl\AppData\Local\{C9408D38-4DC0-4441-8DE1-6B3031363FF4}
2014-10-21 22:17 - 2009-07-14 03:34 - 00000448 _____ C:\Windows\win.ini
2014-10-21 19:35 - 2014-10-21 19:35 - 00000000 ____D C:\Users\michl\AppData\Local\{8D4BC65C-2277-4196-B6FD-E40853D133A1}
2014-10-21 16:59 - 2009-07-14 06:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2014-10-21 06:52 - 2014-10-21 06:52 - 00000000 ____D C:\Users\michl\AppData\Local\{6AB32BAE-7B3E-4E76-B78E-455E97D8973B}
2014-10-20 16:56 - 2013-02-14 01:18 - 00427846 _____ C:\Windows\FontData.fdb
2014-10-20 16:44 - 2014-10-20 16:44 - 00000435 _____ C:\Users\michl\Desktop\Paper Cutout Vectors, Photos and PSD files Free Download.website
2014-10-20 11:58 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2014-10-20 11:34 - 2014-10-20 11:33 - 00000000 ____D C:\Users\michl\AppData\Local\{AE9085D3-17B8-488F-B6BF-E7109C4278F1}
2014-10-20 00:00 - 2013-11-04 01:27 - 00000631 _____ C:\Users\michl\Desktop\LOTTO Bayern - Meine Daten.website
2014-10-19 23:33 - 2014-10-19 23:33 - 00000000 ____D C:\Users\michl\AppData\Local\{AF6F6B46-A921-452D-852C-E4436C77120D}
2014-10-19 21:27 - 2014-04-16 00:58 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-10-19 21:27 - 2014-04-16 00:58 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-10-19 11:32 - 2014-10-19 11:32 - 00000000 ____D C:\Users\michl\AppData\Local\{A659E336-53F7-45A1-891C-B9ED3F31EFA7}
2014-10-18 16:29 - 2014-10-18 16:29 - 00000000 ____D C:\Users\michl\AppData\Local\{686A0D5E-42D4-4D4E-AC74-B4ED210205B5}
2014-10-18 01:43 - 2014-10-18 01:42 - 00000000 ____D C:\Users\michl\AppData\Local\{DB3D0EFA-4ADB-4F06-AA23-5763E4B99C06}
2014-10-17 13:05 - 2014-10-17 13:05 - 00000000 ____D C:\Users\michl\AppData\Local\{89B744C7-FD8D-4372-B71D-A2F6DC5085AF}
2014-10-17 01:04 - 2014-10-17 01:04 - 00000000 ____D C:\Users\michl\AppData\Local\{078C211E-18D0-43F8-BEFA-83401FF48F79}
2014-10-16 13:01 - 2014-10-16 13:00 - 00000000 ____D C:\Users\michl\AppData\Local\{BAEA00D7-0493-4E8B-9A2A-8CEB2F868687}
2014-10-16 12:58 - 2009-07-14 05:45 - 07546560 _____ C:\Windows\System32\FNTCACHE.DAT
2014-10-16 02:08 - 2014-05-06 22:48 - 00000000 ___SD C:\Windows\System32\CompatTel
2014-10-16 02:02 - 2013-07-24 00:30 - 00000000 ____D C:\Windows\System32\MRT
2014-10-16 02:00 - 2013-02-05 19:19 - 103265616 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2014-10-16 01:30 - 2014-10-04 02:27 - 00000478 _____ C:\Users\michl\Desktop\Download Facebook, Youtube Videos.website
2014-10-16 00:03 - 2014-10-16 00:02 - 00000000 ____D C:\Users\michl\AppData\Local\{28A0704E-D785-4CEE-8973-80E8C83EE2D6}
2014-10-15 22:52 - 2013-10-22 01:07 - 00000000 ____D C:\ProgramData\Oracle
2014-10-15 22:51 - 2014-08-26 12:21 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-10-15 22:51 - 2013-07-03 09:18 - 00000000 ____D C:\Program Files (x86)\Java
2014-10-15 22:49 - 2014-10-15 22:49 - 00319912 _____ (Oracle Corporation) C:\Windows\System32\javaws.exe
2014-10-15 22:49 - 2014-10-15 22:49 - 00189352 _____ (Oracle Corporation) C:\Windows\System32\javaw.exe
2014-10-15 22:49 - 2014-10-15 22:49 - 00189352 _____ (Oracle Corporation) C:\Windows\System32\java.exe
2014-10-15 22:49 - 2014-10-15 22:49 - 00111016 _____ (Oracle Corporation) C:\Windows\System32\WindowsAccessBridge-64.dll
2014-10-15 22:49 - 2012-01-18 17:17 - 00000000 ____D C:\Program Files\Java
2014-10-15 11:54 - 2014-10-15 11:54 - 00000000 ____D C:\Users\michl\AppData\Local\{62161E35-5DC5-4575-B160-AD89DAC8D8A4}
2014-10-14 17:59 - 2014-10-14 17:59 - 00000515 _____ C:\Users\michl\Desktop\The Artist Website Template WIX.website
2014-10-14 15:05 - 2014-10-14 15:05 - 00000000 ____D C:\Users\michl\AppData\Local\{DC9B42E5-77D0-41B6-A6DD-F835571B279C}
2014-10-14 13:09 - 2014-09-10 23:37 - 00001097 _____ C:\Users\Public\Desktop\Avira.lnk
2014-10-14 13:09 - 2014-06-22 19:52 - 00000000 ____D C:\Program Files (x86)\Avira
2014-10-14 13:09 - 2014-05-22 22:35 - 00000000 ____D C:\ProgramData\Package Cache
2014-10-14 03:05 - 2014-10-14 03:04 - 00000000 ____D C:\Users\michl\AppData\Local\{D78B6E71-6DC8-407A-8D53-351FF0BD84B6}
2014-10-13 23:27 - 2012-01-18 14:33 - 00000000 ____D C:\Users\michl\AppData\Roaming\Winamp
2014-10-13 11:41 - 2014-10-13 11:41 - 00000000 ____D C:\Users\michl\AppData\Local\{4C26007E-A97C-4BAD-9773-DD6D6F1E7006}
2014-10-12 23:08 - 2014-10-12 23:08 - 00000000 ____D C:\Users\michl\AppData\Local\{FFF8E011-33E3-4902-BCBC-9D9851714F07}
2014-10-12 11:03 - 2014-10-12 11:03 - 00000000 ____D C:\Users\michl\AppData\Local\{9DE33F2C-6968-421C-ACDB-D051B176E009}
2014-10-11 22:57 - 2014-10-11 22:57 - 00000000 ____D C:\Users\michl\AppData\Local\{DA5FC6E2-1640-4A40-8667-B6E23234C0EA}
2014-10-11 10:23 - 2014-10-11 10:22 - 00000000 ____D C:\Users\michl\AppData\Local\{1156B1E8-48A9-46A4-AE60-1F811E4749EF}
2014-10-10 12:04 - 2014-10-10 12:04 - 00000000 ____D C:\Users\michl\AppData\Local\{D1E70BD4-BB8E-4E83-BD85-91AEE44EE666}
2014-10-10 03:05 - 2014-10-15 22:30 - 00507392 _____ (Microsoft Corporation) C:\Windows\System32\aepdu.dll
2014-10-10 03:05 - 2014-10-15 22:30 - 00276480 _____ (Microsoft Corporation) C:\Windows\System32\generaltel.dll
2014-10-10 03:00 - 2014-10-15 22:30 - 00424448 _____ (Microsoft Corporation) C:\Windows\System32\aeinv.dll
2014-10-09 23:28 - 2014-10-09 23:28 - 00000000 ____D C:\Users\michl\AppData\Local\{440EFE67-3A90-4274-9696-53824B076F19}
2014-10-09 11:27 - 2014-10-09 11:27 - 00000000 ____D C:\Users\michl\AppData\Local\{5F5546EE-B590-485E-9612-EBC357245E71}
2014-10-09 01:38 - 2014-10-09 01:38 - 00000537 _____ C:\Users\michl\Desktop\Venedig im Herbst Biennale und la dolce vita in der Lagunenstadt - TRAVELBOOK.de.website
2014-10-08 23:26 - 2014-10-08 23:26 - 00000000 ____D C:\Users\michl\AppData\Local\{827FFF84-208D-4443-A34B-FB15EDD8CFEE}
2014-10-08 20:58 - 2014-10-08 20:58 - 00000840 _____ C:\Users\michl\Desktop\Website des Jahres 2014.website
2014-10-08 11:25 - 2014-10-08 11:25 - 00000000 ____D C:\Users\michl\AppData\Local\{DF4ADCEB-D100-4F25-9BF9-DBEEDC26C4B6}
2014-10-08 10:51 - 2014-09-27 02:46 - 00000600 _____ C:\Users\michl\Desktop\Mercedes-Benz C 180 KOMPRESSOR T-MODELL - HSN-TSN 0999-AKO - Typklassen Autoversicherung - Autoampel.website
2014-10-07 23:25 - 2014-10-07 23:25 - 00000000 ____D C:\Users\michl\AppData\Local\{A39AD201-B863-4C2E-8FF2-269CC88AD3EF}
2014-10-07 11:24 - 2014-10-07 11:24 - 00000000 ____D C:\Users\michl\AppData\Local\{E0CE4AC2-33A4-41E6-AC31-E09F63A3EB7B}
2014-10-07 03:54 - 2014-10-15 22:30 - 00378552 _____ (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2014-10-07 03:04 - 2014-10-15 22:30 - 00331448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-10-06 23:21 - 2014-10-06 23:20 - 00000000 ____D C:\Users\michl\AppData\Local\{5B5C60EF-E055-4606-8074-6A25C2DA4ACE}
2014-10-06 11:20 - 2014-10-06 11:20 - 00000000 ____D C:\Users\michl\AppData\Local\{946969FF-462B-42FA-A8B0-1F6BE651C554}
2014-10-05 22:58 - 2014-10-05 22:58 - 00000000 ____D C:\Users\michl\AppData\Local\{AAA7BB37-3FD0-4E22-959C-0B9A176FAC9A}
2014-10-05 10:47 - 2014-10-05 10:47 - 00000000 ____D C:\Users\michl\AppData\Local\{8D708B1A-1C45-429A-9DAC-98EB56BDE186}
2014-10-04 15:17 - 2014-10-04 15:17 - 00000000 ____D C:\Users\michl\AppData\Local\{3E301C69-E57A-47D8-A971-6442FB02B293}
2014-10-04 03:27 - 2014-10-03 18:14 - 00000494 _____ C:\Users\michl\Desktop\corel draw randanschnitt - Google-Suche.website
2014-10-03 22:30 - 2014-10-03 22:30 - 00000000 ____D C:\Users\michl\AppData\Local\{DF7439C3-9574-44EF-9910-8F8B618B24E8}
2014-10-03 16:45 - 2013-02-19 01:10 - 00000638 _____ C:\Users\michl\Desktop\Webmaster-Tools.website
2014-10-03 14:18 - 2014-10-03 14:18 - 00001243 _____ C:\Users\michl\Desktop\TreeSize.lnk
2014-10-03 14:14 - 2014-03-21 20:44 - 00000538 _____ C:\Users\michl\Desktop\Schoener-Fernsehen.website
2014-10-03 10:29 - 2014-10-03 10:29 - 00000000 ____D C:\Users\michl\AppData\Local\{18CBB337-E2BB-47EA-9D3F-802F1D854F7A}
2014-10-02 21:27 - 2014-10-02 21:26 - 00000000 ____D C:\Users\michl\AppData\Local\{0692D679-121E-45CB-A351-DA02B5042D8A}
2014-10-02 17:27 - 2014-08-24 17:11 - 00000559 _____ C:\Users\michl\Desktop\freisteller clipping Magic +++++++
2014-10-02 14:53 - 2010-11-21 04:27 - 00278152 ____N (Microsoft Corporation) C:\Windows\System32\MpSigStub.exe
2014-10-02 09:26 - 2014-10-02 09:26 - 00000000 ____D C:\Users\michl\AppData\Local\{88AF46EA-78EE-4C02-8F53-257C33141769}
2014-10-01 20:39 - 2014-10-01 20:39 - 00000000 ____D C:\Users\michl\AppData\Local\{8CA17510-4CDA-4DA4-B28C-E6CD7D5D6B86}
2014-10-01 12:53 - 2014-06-22 19:52 - 00131608 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avipbb.sys
2014-10-01 12:53 - 2014-06-22 19:52 - 00119272 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avgntflt.sys
2014-10-01 12:53 - 2013-05-06 13:02 - 00043064 _____ (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avnetflt.sys
2014-10-01 12:18 - 2014-08-17 18:26 - 00000855 _____ C:\Users\michl\Desktop\Corel Praxis - Broschüren erstellen.website
2014-10-01 12:18 - 2014-07-02 02:38 - 00000476 _____ C:\Users\michl\Desktop\VITAL Print-Mediadaten der Zeitschrift VITAL - Brand Media.website
2014-10-01 10:22 - 2013-02-07 14:07 - 00000000 ____D C:\Users\michl\Desktop\grafik + webdesign + fusion
2014-10-01 10:21 - 2013-11-03 19:04 - 00000000 ____D C:\Users\michl\Desktop\wordpress infos++
2014-10-01 10:21 - 2013-02-07 14:07 - 00000000 ____D C:\Users\michl\Desktop\++ jetzt anschauen +++
2014-10-01 10:19 - 2014-08-17 12:54 - 00000000 ____D C:\Users\michl\Desktop\reise 2014
2014-10-01 10:19 - 2013-10-15 00:22 - 00000000 ____D C:\Users\michl\Desktop\wok + abnehmen
2014-10-01 10:11 - 2014-07-23 12:05 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbamchameleon.sys
2014-10-01 10:11 - 2014-07-23 12:05 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\mwac.sys
2014-10-01 10:11 - 2013-02-04 02:01 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2014-10-01 06:49 - 2014-10-01 06:48 - 00000000 ____D C:\Users\michl\AppData\Local\{AB1C24AD-2A7D-46E9-9C2F-DF0AB75C14B5}
2014-09-30 17:10 - 2013-02-07 14:08 - 00008654 _____ C:\Users\michl\Desktop\bayern fußball2.txt
2014-09-30 10:58 - 2014-09-30 10:58 - 00000000 ____D C:\Users\michl\AppData\Local\{2A012B63-C483-4781-8FB3-A9FB8AC2E374}
2014-09-29 23:14 - 2012-01-03 03:14 - 00801184 _____ C:\Users\michl\AppData\Local\GDIPFONTCACHEV1.DAT
2014-09-29 22:57 - 2014-09-29 22:57 - 00000000 ____D C:\Users\michl\AppData\Local\{B34C39C2-A003-44B7-91A4-FAC2FCD494D0}
2014-09-29 10:56 - 2014-09-29 10:56 - 00000000 ____D C:\Users\michl\AppData\Local\{0821A00D-F454-473B-AD07-CA07ABE16B61}
2014-09-29 01:58 - 2014-10-15 22:30 - 03198976 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys
2014-09-28 22:59 - 2013-07-31 16:41 - 00000808 _____ C:\Users\michl\Desktop\kölner EXPRESS.website
2014-09-28 11:52 - 2014-09-28 11:52 - 00000000 ____D C:\Users\michl\AppData\Local\{5A59412C-DAE3-4631-8F26-BCB5D52F1D0D}
2014-09-27 23:25 - 2014-09-27 23:25 - 00000000 ____D C:\Users\michl\AppData\Local\{0EEA0510-AA4F-4064-9EA0-44B50C6FDAB6}
2014-09-27 11:06 - 2014-09-27 11:06 - 00000000 ____D C:\Users\michl\AppData\Local\{FCB3FCEC-F8BA-4E0C-BC84-9DD330DACDA6}
Files to move or delete:
====================
C:\Users\michl\AppData\Roaming\Camdata.ini
C:\Users\michl\AppData\Roaming\CamLayout.ini
C:\Users\michl\AppData\Roaming\CamShapes.ini
C:\ProgramData\eqqol.pad
C:\ProgramData\rjoof.pad
Some content of TEMP:
====================
C:\Users\michl\AppData\Local\Temp\avgnt.exe
C:\Users\michl\AppData\Local\Temp\jhZT.dll
==================== Known DLLs (Whitelisted) ================
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe
[2014-10-15 22:28] - [2014-07-17 03:07] - 0455168 ____A (Microsoft Corporation) 8CEBD9D0A0A879CDE9F36F4383B7CAEA
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== EXE ASSOCIATION =====================
HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK
==================== Restore Points =========================
==================== BCD ================================
Windows-Start-Manager
---------------------
Bezeichner {bootmgr}
device partition=D:
description Windows Boot Manager
locale de-DE
inherit {globalsettings}
default {default}
resumeobject {a0b40205-35aa-11e1-bfd2-db9403c27f7d}
displayorder {default}
toolsdisplayorder {memdiag}
timeout 30
Windows-Startladeprogramm
-------------------------
Bezeichner {default}
device partition=C:
path \Windows\system32\winload.exe
description Windows 7
locale de-DE
inherit {bootloadersettings}
recoverysequence {current}
recoveryenabled Yes
osdevice partition=C:
systemroot \Windows
resumeobject {a0b40205-35aa-11e1-bfd2-db9403c27f7d}
nx OptIn
Windows-Startladeprogramm
-------------------------
Bezeichner {current}
device ramdisk=[C:]\Recovery\a0b40207-35aa-11e1-bfd2-db9403c27f7d\Winre.wim,{a0b40208-35aa-11e1-bfd2-db9403c27f7d}
path \windows\system32\winload.exe
description Windows Recovery Environment
inherit {bootloadersettings}
osdevice ramdisk=[C:]\Recovery\a0b40207-35aa-11e1-bfd2-db9403c27f7d\Winre.wim,{a0b40208-35aa-11e1-bfd2-db9403c27f7d}
systemroot \windows
nx OptIn
winpe Yes
Wiederaufnahme aus dem Ruhezustand
----------------------------------
Bezeichner {a0b40205-35aa-11e1-bfd2-db9403c27f7d}
device partition=C:
path \Windows\system32\winresume.exe
description Windows Resume Application
locale de-DE
inherit {resumeloadersettings}
filedevice partition=C:
filepath \hiberfil.sys
debugoptionenabled No
Windows-Speichertestprogramm
----------------------------
Bezeichner {memdiag}
device partition=D:
path \boot\memtest.exe
description Windows-Speicherdiagnose
locale de-DE
inherit {globalsettings}
badmemoryaccess Yes
EMS-Einstellungen
-----------------
Bezeichner {emssettings}
bootems Yes
Debuggereinstellungen
---------------------
Bezeichner {dbgsettings}
debugtype Serial
debugport 1
baudrate 115200
RAM-Defekte
-----------
Bezeichner {badmemory}
Globale Einstellungen
---------------------
Bezeichner {globalsettings}
inherit {dbgsettings}
{emssettings}
{badmemory}
Startladeprogramm-Einstellungen
-------------------------------
Bezeichner {bootloadersettings}
inherit {globalsettings}
{hypervisorsettings}
Hypervisoreinstellungen
-------------------
Bezeichner {hypervisorsettings}
hypervisordebugtype Serial
hypervisordebugport 1
hypervisorbaudrate 115200
Einstellungen zur Ladeprogrammfortsetzung
-----------------------------------------
Bezeichner {resumeloadersettings}
inherit {globalsettings}
Ger„teoptionen
--------------
Bezeichner {a0b40208-35aa-11e1-bfd2-db9403c27f7d}
description Ramdisk Options
ramdisksdidevice partition=C:
ramdisksdipath \Recovery\a0b40207-35aa-11e1-bfd2-db9403c27f7d\boot.sdi
==================== Memory info ===========================
Percentage of memory in use: 7%
Total physical RAM: 16360.76 MB
Available physical RAM: 15159.6 MB
Total Pagefile: 16358.96 MB
Available Pagefile: 15168.01 MB
Total Virtual: 8192 MB
Available Virtual: 8191.87 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:74.43 GB) (Free:12.54 GB) NTFS
Drive d: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (Volume) (Fixed) (Total:69.14 GB) (Free:0.62 GB) NTFS
Drive f: (Geschäft) (Fixed) (Total:298.83 GB) (Free:26.41 GB) NTFS
Drive g: (sicherung) (Fixed) (Total:97.66 GB) (Free:16.15 GB) NTFS
Drive j: () (Removable) (Total:7.46 GB) (Free:7.46 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (Bilder) (Fixed) (Total:465.88 GB) (Free:14.53 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 932 GB) (Disk ID: B0400252)
Partition 1: (Active) - (Size=466 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=299 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=98 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=69 GB) - (Type=OF Extended)
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 75 GB) (Disk ID: 25836908)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=74 GB) - (Type=07 NTFS)
========================================================
Disk: 2 (Size: 7 GB) (Disk ID: 00000000)
Partition 1: (Not Active) - (Size=7 GB) - (Type=0B)
LastRegBack: 2014-10-20 11:51
==================== End Of Log ============================
Grüße Mayer |
|
27.10.2014, 15:53
| #2 |
| /// the machine /// TB-Ausbilder    | Bundestrojaner in neuer Form eingefangen hi,
__________________Drücke bitte die  + R Taste und schreibe notepad in das Ausführen Fenster.Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter Startup: C:\Users\michl\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\program.lnk
ShortcutTarget: program.lnk -> C:\PROGRA~3\E9DDD8AA.cpp (Sun Microsystems, Inc.)
S2 Winmgmt; C:\ProgramData\AA8DDD9E.dot [332800 2014-10-27] ()
2014-10-27 11:48 - 2014-10-27 11:48 - 00208896 _____ (Sun Microsystems, Inc.) C:\ProgramData\E9DDD8AA.cpp
2014-10-27 11:17 - 2014-10-27 11:17 - 00000000 ____D C:\Users\michl\AppData\Local\{0D64FD04-F4DA-4F52-92B3-2CB3E74AA9C2}
C:\ProgramData\AA8DDD9E.dot
Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.
__________________ |
|
27.10.2014, 16:30
| #3 |
| | Computer wieder offen... Hallo
__________________herzlichen Dank für den Code und die Hilfe. Der infizierte PC ist wieder frei und ich kann die üblichen Programme laufen lassen, wie z.B. Malwarebytes (hat einen Trojaner gefunden und zig Pub..dingens). Anbei die Fixlog-Datei wie gewünscht: Code:
ATTFilter
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 24-11-2013
Ran by SYSTEM at 2014-10-27 16:02:53 Run:1
Running from J:\
Boot Mode: Recovery
==============================================
Content of fixlist:
*****************
Startup: C:\Users\michl\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\program.lnk
ShortcutTarget: program.lnk -> C:\PROGRA~3\E9DDD8AA.cpp (Sun Microsystems, Inc.)
S2 Winmgmt; C:\ProgramData\AA8DDD9E.dot [332800 2014-10-27] ()
2014-10-27 11:48 - 2014-10-27 11:48 - 00208896 _____ (Sun Microsystems, Inc.) C:\ProgramData\E9DDD8AA.cpp
2014-10-27 11:17 - 2014-10-27 11:17 - 00000000 ____D C:\Users\michl\AppData\Local\{0D64FD04-F4DA-4F52-92B3-2CB3E74AA9C2}
C:\ProgramData\AA8DDD9E.dot
*****************
C:\Users\michl\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\program.lnk => Moved successfully.
C:\PROGRA~3\E9DDD8AA.cpp => Moved successfully.
Winmgmt => Service restored successfully.
"C:\ProgramData\E9DDD8AA.cpp" => File/Directory not found.
C:\Users\michl\AppData\Local\{0D64FD04-F4DA-4F52-92B3-2CB3E74AA9C2} => Moved successfully.
C:\ProgramData\AA8DDD9E.dot => Moved successfully.
==== End of Fixlog ====
|
|
28.10.2014, 10:16
| #4 |
| /// the machine /// TB-Ausbilder | Bundestrojaner in neuer Form eingefangen Nicht einfach irgendwas laufen lassen, wir sind noch nit fertig  Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Bundestrojaner in neuer Form eingefangen |
| abgesicherter modus fährt automatisch herunter, antivir, avg, avira, bootmgr, bundestrojaner, ccsetup, desktop, explorer, explorer.exe, home, kaspersky, log, löschen, malwarebytes, microsoft, neue, officejet, opera, realtek, registry, server, services.exe, software, spyware, starten, svchost.exe, system, virus, wickel, windows |
Linear-Darstellung
