|
Plagegeister aller Art und deren Bekämpfung: Windows Vista: Adware und anderes ZeugsWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
03.12.2014, 10:51 | #31 |
| Windows Vista: Adware und anderes Zeugs Na da hab ich keine Ahnung von, hab mich erst die Tage mal informiert was ein Proxy überhaupt ist. Haben die Störungen der Internetverbindung damit was zu tun? Ich hab hier nämlich schon lange keine Verbindung über WLAN mehr, geht nur mit Kabel und ist dann auch öfter mal unterbrochen. War aber schon vor dem Malwareproblem so. Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 02-12-2014 01 Ran by Herrin at 2014-12-03 10:28:48 Run:4 Running from C:\Users\Herrin\Desktop\Sicherheit Loaded Profile: Herrin (Available profiles: Herrin) Boot Mode: Normal ============================================== Content of fixlist: ***************** CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled. ProxyServer: [.DEFAULT] => http=127.0.0.1:52644;https=127.0.0.1:52644; AlternateDataStreams: C:\ProgramData\TEMP:5C321E34 Emptytemp: ***************** "HKLM\SOFTWARE\Policies\Google" => Key deleted successfully. HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => value deleted successfully. HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value deleted successfully. C:\ProgramData\TEMP => ":5C321E34" ADS removed successfully. EmptyTemp: => Removed 399 MB temporary data. The system needed a reboot. ==== End of Fixlog ==== FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 02-12-2014 01 Ran by Herrin (administrator) on HERRIN-PC on 03-12-2014 10:20:18 Running from C:\Users\Herrin\Desktop\Sicherheit Loaded Profile: Herrin (Available profiles: Herrin) Platform: Microsoft® Windows Vista™ Ultimate Service Pack 2 (X86) OS Language: Deutsch (Deutschland) Internet Explorer Version 8 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Microsoft Corporation) C:\Windows\System32\SLsvc.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\afwServ.exe (Yahoo! Inc.) C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Intel Corporation) C:\Windows\System32\igfxsrvc.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation) C:\Windows\ehome\ehtray.exe (Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe (Microsoft Corporation) C:\Windows\ehome\ehmsas.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe (Microsoft Corporation) C:\Windows\System32\wuauclt.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Microsoft Corporation) C:\Windows\System32\conime.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5225064 2014-11-14] (AVAST Software) HKLM\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated) HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated) HKU\S-1-5-21-2708201434-1965334668-4040377041-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation) HKU\S-1-5-21-2708201434-1965334668-4040377041-1000\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-19] (Microsoft Corporation) HKU\S-1-5-21-2708201434-1965334668-4040377041-1000\...\Run: [WinPatrol] => C:\Users\Herrin\Desktop\Sicherheit\winpatrol.exe -expressboot Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk ShortcutTarget: Microsoft Office.lnk -> C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation) ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software) CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled. ProxyServer: [.DEFAULT] => http=127.0.0.1:52644;https=127.0.0.1:52644; HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\S-1-5-21-2708201434-1965334668-4040377041-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\S-1-5-21-2708201434-1965334668-4040377041-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.yahoo.com/?fr=mkg029 URLSearchHook: HKLM - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046} URLSearchHook: HKLM - (No Name) - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - No File SearchScopes: HKLM -> DefaultScope {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search SearchScopes: HKU\S-1-5-21-2708201434-1965334668-4040377041-1000 -> DefaultScope {2AEA96DD-CC4B-45F3-97D0-65FBC2888F47} URL = https://www.google.com/search?q={searchTerms} SearchScopes: HKU\S-1-5-21-2708201434-1965334668-4040377041-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search SearchScopes: HKU\S-1-5-21-2708201434-1965334668-4040377041-1000 -> {2AEA96DD-CC4B-45F3-97D0-65FBC2888F47} URL = https://www.google.com/search?q={searchTerms} SearchScopes: HKU\S-1-5-21-2708201434-1965334668-4040377041-1000 -> {4F6CF4C1-C88D-44C8-97FB-821F288D0212} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=foxysecurity SearchScopes: HKU\S-1-5-21-2708201434-1965334668-4040377041-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={sear BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\Herrin\AppData\Roaming\Mozilla\Firefox\Profiles\apekw9zh.default FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_223.dll () FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.) FF Plugin: @java.com/DTPlugin -> C:\Program Files\Java\jre6\bin\npDeployJava1.dll (Sun Microsystems, Inc.) FF Plugin: @java.com/JavaPlugin -> C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Extension: Adblock Plus - C:\Users\Herrin\AppData\Roaming\Mozilla\Firefox\Profiles\apekw9zh.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-11-19] FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-12-29] FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-11-14] FF Extension: No Name - wrc@avast.com [Not Found] Chrome: ======= CHR HomePage: Default -> https://www.google.de/ CHR Profile: C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Slides) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-11-14] CHR Extension: (Google Docs) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-11-14] CHR Extension: (Google Drive) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-11-14] CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-11-14] CHR Extension: (WOT) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhmmomiinigofkjcapegjjndpbikblnp [2014-11-17] CHR Extension: (YouTube) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-11-14] CHR Extension: (Google Search) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-11-14] CHR Extension: (Google Sheets) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-11-14] CHR Extension: (AdBlock) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-11-15] CHR Extension: (Avast Online Security) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-11-14] CHR Extension: (Google Wallet) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-11-14] CHR Extension: (NotScripts) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\odjhifogjcknibkahlpidmdajjpkkcfn [2014-11-17] CHR Extension: (Gmail) - C:\Users\Herrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-11-14] CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-11-14] ========================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-11-14] (AVAST Software) R2 avast! Firewall; C:\Program Files\AVAST Software\Avast\afwServ.exe [104416 2014-11-14] (AVAST Software) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24184 2014-11-14] () R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [26136 2014-11-14] (AVAST Software) R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [70384 2014-11-14] (AVAST Software) R0 aswNdis; C:\Windows\System32\DRIVERS\aswNdis.sys [12112 2014-11-14] (ALWIL Software) R0 aswNdis2; C:\Windows\system32\Drivers\aswNdis2.sys [253640 2014-11-14] (AVAST Software) R1 aswRdr; C:\Windows\system32\drivers\aswRdr.sys [55240 2014-11-14] (AVAST Software) R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49944 2014-11-14] () R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [787800 2014-11-14] (AVAST Software) R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [422760 2014-11-14] (AVAST Software) R1 aswTdi; C:\Windows\system32\drivers\aswTdi.sys [57928 2014-11-14] (AVAST Software) R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [206248 2014-11-14] () S3 PROCEXP113; C:\Windows\system32\Drivers\PROCEXP113.SYS [12568 2014-11-13] (Sysinternals - www.sysinternals.com) [File not signed] S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X] S3 catchme; \??\C:\ComboFix\catchme.sys [X] S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X] S3 IpInIp; system32\DRIVERS\ipinip.sys [X] S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X] S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-12-02 02:13 - 2014-12-02 02:13 - 00000870 _____ () C:\Users\Herrin\AppData\Local\recently-used.xbel 2014-12-01 11:14 - 2014-12-01 11:15 - 01109504 _____ (Farbar) C:\Users\Herrin\Downloads\FRST (1).exe 2014-11-28 11:06 - 2014-11-28 11:06 - 00000104 _____ () C:\Users\Herrin\Desktop\Papierkorb - Verknüpfung.lnk 2014-11-28 02:35 - 2014-11-28 02:35 - 00000000 ____D () C:\Users\Herrin\.thumbnails 2014-11-27 22:31 - 2014-11-27 07:16 - 00981504 _____ () C:\Users\Herrin\Documents\~WRL1067.tmp 2014-11-24 07:23 - 2014-11-24 07:23 - 00001576 _____ () C:\Windows\PFRO.log 2014-11-23 22:41 - 2014-11-23 22:41 - 00055088 _____ () C:\Users\Herrin\AppData\Local\GDIPFONTCACHEV1.DAT 2014-11-23 20:58 - 2014-11-23 20:59 - 08676128 _____ (Microsoft Corporation) C:\Users\Herrin\Downloads\Windows7UpgradeAdvisorSetup.exe 2014-11-23 20:09 - 2014-11-23 20:09 - 00000000 ____D () C:\Users\Herrin\AppData\Local\Macromedia 2014-11-22 16:12 - 2014-11-22 16:13 - 00250352 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-11-22 03:20 - 2014-12-02 02:13 - 00000000 ____D () C:\Users\Herrin\AppData\Local\gtk-2.0 2014-11-21 00:55 - 2014-11-21 00:55 - 00000000 ____D () C:\Users\Herrin\AppData\Local\webkit 2014-11-20 15:38 - 2014-11-20 15:38 - 00000000 ____D () C:\Program Files\VS Revo Group 2014-11-20 15:27 - 2014-11-20 15:27 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2014-11-20 15:19 - 2014-11-20 15:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinPatrol 2014-11-20 15:19 - 2014-11-20 15:19 - 00000000 ____D () C:\ProgramData\InstallMate 2014-11-20 15:19 - 2014-11-20 15:19 - 00000000 ____D () C:\Program Files\Ruiware 2014-11-20 03:03 - 2014-10-24 02:03 - 00499200 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2014-11-19 17:15 - 2014-11-19 17:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpywareBlaster 2014-11-19 17:15 - 2014-11-19 17:15 - 00000000 ____D () C:\ProgramData\Licenses 2014-11-19 17:01 - 2014-11-19 17:01 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\WinPatrol 2014-11-19 16:13 - 2014-12-03 10:20 - 00000000 ____D () C:\FRST 2014-11-18 23:02 - 2014-12-02 05:37 - 00000000 ____D () C:\Users\Herrin\.gimp-2.8 2014-11-18 23:01 - 2014-11-18 23:02 - 00000834 _____ () C:\Users\Herrin\Desktop\Gimp 2.8.lnk 2014-11-18 22:49 - 2014-11-18 22:49 - 00000842 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIMP 2.lnk 2014-11-18 22:38 - 2014-11-18 22:47 - 00000000 ____D () C:\Program Files\GIMP 2 2014-11-18 17:51 - 2014-11-11 20:04 - 00979456 _____ () C:\Users\Herrin\Documents\~WRL2275.tmp 2014-11-18 15:16 - 2014-11-18 15:16 - 00001662 _____ () C:\Users\Public\Desktop\Defraggler.lnk 2014-11-18 15:12 - 2014-11-18 15:17 - 00000000 ____D () C:\Program Files\Defraggler 2014-11-17 19:32 - 2014-11-18 13:44 - 00000000 ____D () C:\ProgramData\DataCardService 2014-11-17 19:32 - 2014-11-17 19:33 - 00000000 ____D () C:\ProgramData\Mobile Partner 2014-11-17 15:51 - 2014-11-17 15:53 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Mozilla 2014-11-17 15:51 - 2014-11-17 15:51 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Mozilla 2014-11-17 15:49 - 2014-11-17 15:49 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\AVAST Software 2014-11-17 15:49 - 2014-11-17 15:49 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Adobe 2014-11-17 15:48 - 2014-11-17 15:48 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Google 2014-11-17 15:46 - 2014-11-18 13:44 - 00000000 ____D () C:\Users\Administrator 2014-11-17 00:56 - 2014-11-17 01:04 - 00000000 ____D () C:\AdwCleaner 2014-11-17 00:42 - 2014-11-17 00:42 - 00000000 ____D () C:\Users\Herrin\AppData\Local\Secunia PSI 2014-11-17 00:32 - 2014-12-01 09:16 - 00000000 ____D () C:\ProgramData\TEMP 2014-11-17 00:32 - 2014-11-18 13:03 - 00000000 ____D () C:\Program Files\SpywareBlaster 2014-11-16 23:17 - 2014-11-16 23:35 - 00000972 _____ () C:\DelFix.txt 2014-11-16 20:52 - 2014-11-16 20:52 - 00000000 ____D () C:\Program Files\Common Files\Java 2014-11-16 20:48 - 2014-11-16 20:48 - 00000000 ____D () C:\ProgramData\Oracle 2014-11-16 20:21 - 2014-11-16 20:22 - 00638888 _____ (Oracle Corporation) C:\Users\Herrin\Desktop\chromeinstall-8u25.exe 2014-11-16 19:35 - 2014-11-16 19:39 - 00002425 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader 9.lnk 2014-11-16 19:25 - 2014-12-03 09:56 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-11-16 19:24 - 2014-11-16 19:27 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe 2014-11-16 01:42 - 2014-11-16 01:42 - 00000000 ____D () C:\Users\Herrin\AppData\Local\fontconfig 2014-11-16 01:41 - 2014-11-16 01:41 - 00000000 ____D () C:\Users\Herrin\AppData\Local\gegl-0.2 2014-11-15 17:33 - 2014-11-15 17:33 - 00000806 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk 2014-11-15 17:32 - 2014-11-15 17:33 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service 2014-11-15 17:32 - 2014-11-15 17:32 - 00000000 ____D () C:\ProgramData\Mozilla 2014-11-15 17:32 - 2014-11-15 17:32 - 00000000 ____D () C:\Program Files\Mozilla Firefox 2014-11-14 22:23 - 2007-06-26 15:57 - 00192512 _____ (Intel Corporation) C:\Windows\system32\igfxres.dll 2014-11-14 22:05 - 2014-11-16 23:17 - 00000000 ____D () C:\Windows\ERUNT 2014-11-14 20:44 - 2014-11-26 04:11 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-11-14 20:42 - 2014-11-20 15:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-11-14 20:41 - 2014-11-14 20:41 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-11-14 20:41 - 2014-10-01 11:11 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-11-14 20:41 - 2014-10-01 11:11 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-11-14 20:41 - 2014-10-01 11:11 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-11-14 19:18 - 2014-11-14 19:18 - 00001837 _____ () C:\Users\Public\Desktop\Avast Internet Security.lnk 2014-11-14 19:13 - 2014-11-14 19:12 - 00026136 _____ (AVAST Software) C:\Windows\system32\Drivers\aswKbd.sys 2014-11-14 19:13 - 2014-11-14 19:11 - 00253640 _____ (AVAST Software) C:\Windows\system32\Drivers\aswNdis2.sys 2014-11-14 19:13 - 2014-11-14 18:35 - 00291352 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe 2014-11-14 19:11 - 2014-11-14 19:11 - 00012112 _____ (ALWIL Software) C:\Windows\system32\Drivers\aswNdis.sys 2014-11-14 19:07 - 2014-11-14 19:07 - 00000000 ____D () C:\Program Files\Dropbox 2014-11-14 19:05 - 2014-11-14 19:05 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox 2014-11-14 18:54 - 2014-11-14 19:08 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\Dropbox 2014-11-14 18:40 - 2014-11-14 18:40 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\AVAST Software 2014-11-14 18:39 - 2014-11-14 19:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software 2014-11-14 18:36 - 2014-11-14 18:36 - 00422760 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys 2014-11-14 18:36 - 2014-11-14 18:36 - 00206248 _____ () C:\Windows\system32\Drivers\aswVmm.sys 2014-11-14 18:36 - 2014-11-14 18:36 - 00070384 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys 2014-11-14 18:36 - 2014-11-14 18:36 - 00057928 _____ (AVAST Software) C:\Windows\system32\Drivers\aswTdi.sys 2014-11-14 18:36 - 2014-11-14 18:36 - 00055240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr.sys 2014-11-14 18:36 - 2014-11-14 18:36 - 00049944 _____ () C:\Windows\system32\Drivers\aswRvrt.sys 2014-11-14 18:36 - 2014-11-14 18:36 - 00024184 _____ () C:\Windows\system32\Drivers\aswHwid.sys 2014-11-14 18:36 - 2014-11-14 18:34 - 00787800 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys 2014-11-14 18:35 - 2014-11-14 18:35 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr 2014-11-14 18:31 - 2014-11-14 18:31 - 00000000 ____D () C:\Program Files\AVAST Software 2014-11-14 18:20 - 2014-11-14 18:31 - 00000000 ____D () C:\ProgramData\AVAST Software 2014-11-14 14:37 - 2014-11-26 19:37 - 00001923 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2014-11-14 14:37 - 2014-11-14 14:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome 2014-11-13 20:10 - 2014-12-03 10:20 - 00000000 ____D () C:\Users\Herrin\Desktop\Sicherheit 2014-11-13 19:33 - 2014-11-13 19:33 - 00012568 _____ (Sysinternals - www.sysinternals.com) C:\Windows\system32\Drivers\PROCEXP113.SYS 2014-11-13 18:01 - 2014-11-13 19:22 - 00000000 ____D () C:\Windows\erdnt 2014-11-13 03:32 - 2014-10-10 02:01 - 00449536 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll 2014-11-13 03:32 - 2014-10-10 02:00 - 01259008 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2014-11-13 03:32 - 2014-10-10 02:00 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll 2014-11-13 03:32 - 2014-10-10 00:22 - 00619520 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll 2014-11-13 03:31 - 2014-08-27 01:55 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll 2014-11-13 03:31 - 2014-08-27 01:55 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll 2014-11-13 03:29 - 2014-10-24 02:04 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll 2014-11-13 03:29 - 2014-09-19 01:50 - 00278528 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2014-11-13 03:28 - 2014-08-12 03:25 - 00729600 _____ (Microsoft Corporation) C:\Windows\system32\IMJP10K.DLL 2014-11-13 03:23 - 2014-10-18 02:08 - 00564224 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll 2014-11-13 03:23 - 2014-10-03 02:18 - 00274432 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll 2014-11-13 03:23 - 2014-10-03 02:17 - 00396800 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll 2014-11-13 03:23 - 2014-10-03 02:17 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll 2014-11-13 03:23 - 2014-10-03 02:17 - 00170496 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll 2014-11-13 03:04 - 2014-10-13 00:34 - 02054656 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-11-12 18:40 - 2014-11-12 18:40 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\AdvancedSystemProtector 2014-11-12 18:27 - 2014-11-12 18:27 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\dlg 2014-11-12 11:16 - 2014-10-31 08:17 - 06004736 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-11-12 11:15 - 2014-10-31 08:17 - 11082752 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-11-12 11:15 - 2014-10-31 08:17 - 02006016 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-11-12 11:15 - 2014-10-31 08:17 - 01469440 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-11-12 11:15 - 2014-10-31 08:17 - 01214976 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-11-12 11:15 - 2014-10-31 08:17 - 00916992 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-11-12 11:15 - 2014-10-31 08:17 - 00630784 _____ (Microsoft Corporation) C:\Windows\system32\mstime.dll 2014-11-12 11:15 - 2014-10-31 08:17 - 00630272 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-11-12 11:15 - 2014-10-31 08:17 - 00387584 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-11-12 11:15 - 2014-10-31 08:17 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll 2014-11-12 11:15 - 2014-10-31 08:17 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll 2014-11-12 11:15 - 2014-10-31 08:17 - 00164352 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-11-12 11:15 - 2014-10-31 08:17 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2014-11-12 11:15 - 2014-10-31 08:17 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2014-11-12 11:15 - 2014-10-31 08:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-11-12 11:15 - 2014-10-31 08:17 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-11-12 11:15 - 2014-10-31 08:17 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-11-12 11:15 - 2014-10-31 08:17 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll 2014-11-12 11:15 - 2014-10-31 08:17 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll 2014-11-12 11:15 - 2014-10-31 08:17 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-11-12 11:15 - 2014-10-31 08:16 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\corpol.dll 2014-11-12 11:15 - 2014-10-31 03:37 - 00385024 _____ (Microsoft Corporation) C:\Windows\system32\html.iec 2014-11-12 11:15 - 2014-10-31 03:30 - 00174080 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-11-12 11:15 - 2014-10-31 03:30 - 00133632 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-11-12 11:15 - 2014-10-31 03:29 - 01638912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-11-12 11:15 - 2014-10-31 03:29 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe 2014-11-10 12:08 - 2014-11-10 12:08 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\Daichi 2014-11-10 10:28 - 2014-11-18 13:42 - 00000000 ____D () C:\Users\Herrin\Desktop\Sounds 2014-11-09 21:38 - 2014-11-09 21:38 - 00000000 ____D () C:\Program Files\Common Files\Avid 2014-11-09 21:28 - 2014-11-09 22:01 - 00000000 ____D () C:\Program Files\Common Files\VST3 2014-11-07 20:49 - 2014-11-07 20:49 - 00000000 ____D () C:\Users\Herrin\Documents\CabraProjects 2014-11-07 20:48 - 2014-11-07 20:49 - 00678093 _____ () C:\Users\Herrin\Desktop\Cabra_0.7.0.jar 2014-11-06 18:04 - 2014-11-06 18:04 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_07_00.Wdf 2014-11-06 14:41 - 2012-11-22 04:54 - 00353280 _____ (Microsoft Corporation) C:\Windows\system32\shlwapi.dll 2014-11-06 14:35 - 2014-11-06 14:35 - 00000000 ____D () C:\Users\Herrin\AppData\Local\AviraSpeedup 2014-11-06 13:20 - 2014-06-26 23:17 - 00619664 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe 2014-11-06 13:20 - 2014-06-26 23:17 - 00099480 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll 2014-11-06 13:20 - 2014-06-26 23:17 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll 2014-11-06 13:19 - 2014-06-06 05:28 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe 2014-11-06 13:16 - 2014-06-15 23:18 - 01131664 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll 2014-11-06 13:16 - 2014-06-13 19:22 - 00156824 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll 2014-11-06 13:16 - 2014-06-13 19:22 - 00081560 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll 2014-11-06 12:52 - 2014-09-09 07:24 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2014-11-06 12:22 - 2014-08-23 02:03 - 00297984 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll 2014-11-06 11:44 - 2012-11-08 04:48 - 01314816 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll 2014-11-06 11:10 - 2014-11-13 03:23 - 00000000 ____D () C:\Windows\system32\MRT 2014-11-05 21:45 - 2014-11-05 21:45 - 00000000 ____D () C:\e1bf55fb68ca2ff1452d 2014-11-05 21:44 - 2014-09-05 00:27 - 00143360 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fastfat.sys 2014-11-05 21:41 - 2012-07-26 03:46 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\Wdfres.dll 2014-11-05 21:41 - 2012-06-02 15:57 - 00000003 _____ () C:\Windows\system32\Drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf 2014-11-05 21:40 - 2012-07-26 04:39 - 00047720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdfLdr.sys 2014-11-05 21:40 - 2012-07-26 04:21 - 00196608 _____ (Microsoft Corporation) C:\Windows\system32\WUDFHost.exe 2014-11-05 21:40 - 2012-07-26 04:20 - 00613888 _____ (Microsoft Corporation) C:\Windows\system32\WUDFx.dll 2014-11-05 21:40 - 2012-07-26 04:20 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\WUDFPlatform.dll 2014-11-05 21:40 - 2012-07-26 04:20 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\WUDFSvc.dll 2014-11-05 21:40 - 2012-07-26 04:20 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\WUDFCoinstaller.dll 2014-11-05 21:40 - 2012-07-26 03:33 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WUDFPf.sys 2014-11-05 21:40 - 2012-07-26 03:32 - 00155136 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WUDFRd.sys 2014-11-05 21:40 - 2009-07-14 13:12 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\winusb.dll 2014-11-05 16:58 - 2014-06-02 11:31 - 02263552 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll 2014-11-05 16:58 - 2014-06-02 11:31 - 00332800 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll 2014-11-05 16:58 - 2014-06-02 11:30 - 01993728 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll 2014-11-05 16:58 - 2014-06-02 11:30 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll 2014-11-05 16:58 - 2014-06-02 09:56 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe 2014-11-05 16:58 - 2014-04-26 17:01 - 00502784 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll 2014-11-05 16:58 - 2014-03-25 14:26 - 11587584 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll 2014-11-05 16:58 - 2013-08-27 03:47 - 01029120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll 2014-11-05 16:58 - 2013-08-27 03:47 - 00219648 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll 2014-11-05 16:58 - 2013-08-27 03:47 - 00189952 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll 2014-11-05 16:58 - 2013-08-27 03:47 - 00160768 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll 2014-11-05 16:58 - 2013-08-27 02:52 - 01172480 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll 2014-11-05 16:58 - 2013-08-27 02:50 - 00486400 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll 2014-11-05 16:58 - 2013-08-27 02:32 - 00683008 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll 2014-11-05 16:58 - 2013-08-27 02:28 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll 2014-11-05 16:58 - 2013-08-27 02:28 - 00798208 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll 2014-11-05 16:58 - 2013-06-15 14:22 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\icaapi.dll 2014-11-05 16:58 - 2013-06-15 12:23 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys 2014-11-05 16:57 - 2014-04-05 03:42 - 00905664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys 2014-11-05 16:57 - 2013-12-22 16:42 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-11-05 16:57 - 2013-10-30 03:12 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\SysFxUI.dll 2014-11-05 16:57 - 2013-10-30 02:43 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys 2014-11-05 16:57 - 2013-10-30 01:43 - 00167936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys 2014-11-05 16:57 - 2013-07-20 11:44 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll 2014-11-05 16:57 - 2013-07-10 10:47 - 00783360 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll 2014-11-05 16:57 - 2012-11-02 11:18 - 00376320 _____ (Microsoft Corporation) C:\Windows\system32\dpnet.dll 2014-11-05 16:57 - 2012-11-02 09:26 - 00023040 _____ (Microsoft Corporation) C:\Windows\system32\dpnsvr.exe 2014-11-05 16:55 - 2014-06-14 01:44 - 00638400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys 2014-11-05 16:55 - 2014-06-14 01:33 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll 2014-11-05 16:55 - 2014-06-06 09:59 - 00506880 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll 2014-11-05 16:55 - 2012-08-21 12:47 - 00224640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volsnap.sys 2014-11-05 16:53 - 2012-11-20 05:22 - 00204288 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll 2014-11-05 16:52 - 2013-10-11 03:08 - 00444928 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL 2014-11-05 16:52 - 2013-10-11 03:07 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL 2014-11-05 16:52 - 2013-10-11 01:39 - 00218228 _____ () C:\Windows\system32\WFP.TMF 2014-11-05 16:20 - 2014-05-30 07:53 - 00273408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys 2014-11-05 16:20 - 2013-06-29 03:07 - 00226304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys 2014-11-05 16:20 - 2013-06-29 03:07 - 00197632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys 2014-11-05 16:20 - 2013-06-29 03:06 - 00006016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys 2014-11-05 16:20 - 2013-03-03 20:07 - 01082232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys 2014-11-05 16:20 - 2011-05-05 14:54 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys 2014-11-05 16:20 - 2011-05-05 14:54 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys 2014-11-05 16:19 - 2014-03-10 02:22 - 01401344 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll 2014-11-05 16:18 - 2014-11-27 23:44 - 00000000 ____D () C:\Users\Herrin\Desktop\Webdesign 2014-11-05 16:16 - 2014-11-05 16:16 - 00001596 _____ () C:\Users\Herrin\Desktop\Webocton - Scriptly.lnk 2014-11-05 16:16 - 2014-11-05 16:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Webocton - Scriptly 2014-11-05 16:15 - 2014-11-05 16:16 - 00000000 ____D () C:\Users\Herrin\Webocton - Scriptly 2014-11-05 16:15 - 2014-11-05 16:16 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\Webocton - Scriptly 2014-11-05 16:14 - 2013-05-02 05:04 - 00443904 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll 2014-11-05 16:14 - 2013-05-02 05:03 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\printcom.dll 2014-11-05 16:13 - 2013-07-09 13:10 - 01205168 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll 2014-11-05 16:13 - 2013-07-08 05:55 - 03603904 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe 2014-11-05 16:13 - 2013-07-08 05:55 - 03551680 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2014-11-05 16:13 - 2013-03-09 04:45 - 00049152 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll 2014-11-05 16:13 - 2013-03-09 02:28 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe 2014-11-05 16:13 - 2013-03-08 04:53 - 00376320 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll 2014-11-05 16:09 - 2014-12-03 10:13 - 00001656 _____ () C:\Users\Herrin\.lmmsrc.xml 2014-11-05 16:09 - 2014-11-05 16:09 - 00000726 _____ () C:\Users\Herrin\Desktop\LMMS.lnk 2014-11-05 16:08 - 2014-11-05 16:08 - 00000000 ____D () C:\Users\Herrin\lmms 2014-11-05 16:07 - 2013-10-11 03:08 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll 2014-11-05 16:07 - 2013-10-11 03:08 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx 2014-11-05 16:07 - 2013-10-11 03:08 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wshcon.dll 2014-11-05 16:07 - 2013-10-11 01:35 - 00155648 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe 2014-11-05 16:07 - 2013-10-11 01:35 - 00135168 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe 2014-11-05 16:07 - 2013-10-03 13:45 - 00993792 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll 2014-11-05 16:06 - 2014-11-05 16:07 - 00000000 ____D () C:\Program Files\LMMS 2014-11-05 16:06 - 2013-08-02 05:09 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL 2014-11-05 16:06 - 2013-04-24 05:00 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\certenc.dll 2014-11-05 16:06 - 2013-04-24 02:46 - 00812544 _____ (Microsoft Corporation) C:\Windows\system32\certutil.exe 2014-11-05 16:02 - 2014-11-05 16:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LMMS 1.0.3 2014-11-05 15:38 - 2014-02-06 02:56 - 00894464 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll 2014-11-05 15:38 - 2013-06-27 00:01 - 00527064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys 2014-11-05 15:37 - 2013-10-22 08:19 - 00158208 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll 2014-11-05 14:59 - 2013-07-16 05:35 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\themeui.dll 2014-11-05 14:58 - 2013-06-04 05:16 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll 2014-11-05 14:58 - 2013-06-04 02:49 - 00293376 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll 2014-11-05 14:57 - 2013-03-08 04:52 - 02067968 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll 2014-11-05 14:56 - 2013-07-04 05:21 - 00532480 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll 2014-11-05 14:07 - 2014-01-30 08:46 - 00876032 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll 2014-11-05 13:17 - 2013-04-17 13:30 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\cryptdlg.dll 2014-11-05 13:16 - 2013-07-03 03:33 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys 2014-11-05 13:16 - 2013-07-03 03:10 - 00025472 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys 2014-11-05 13:15 - 2013-02-12 02:57 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usb8023.sys 2014-11-05 13:14 - 2013-07-08 05:20 - 00172544 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll 2014-11-05 13:14 - 2013-07-08 05:16 - 00133120 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll 2014-11-05 13:14 - 2013-07-08 05:16 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll 2014-11-05 11:10 - 2012-09-25 17:19 - 00075776 _____ (Microsoft Corporation) C:\Windows\system32\synceng.dll ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-12-03 09:27 - 2010-07-09 14:57 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-12-03 08:31 - 2006-11-02 13:46 - 00003664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 2014-12-03 08:31 - 2006-11-02 13:46 - 00003664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 2014-12-03 08:26 - 2006-11-02 13:51 - 01611714 _____ () C:\Windows\WindowsUpdate.log 2014-12-02 22:34 - 2010-07-09 14:57 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-12-02 22:31 - 2006-11-02 14:00 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-12-02 12:13 - 2006-11-02 14:00 - 00032534 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-11-28 02:35 - 2008-12-24 09:42 - 00000000 ____D () C:\Users\Herrin 2014-11-24 14:04 - 2009-11-17 20:16 - 00229000 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe 2014-11-23 21:01 - 2006-11-02 11:33 - 01566310 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-11-23 04:29 - 2009-05-17 08:11 - 00000000 ____D () C:\ProgramData\Skype 2014-11-22 05:14 - 2009-03-29 11:59 - 00000000 ____D () C:\Windows\Minidump 2014-11-22 05:13 - 2012-01-08 10:26 - 00000000 __SHD () C:\Users\Herrin\UserData 2014-11-18 13:44 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\Msdtc 2014-11-18 13:43 - 2006-11-02 11:22 - 50331648 _____ () C:\Windows\system32\config\components_previous 2014-11-18 13:43 - 2006-11-02 11:22 - 39583744 _____ () C:\Windows\system32\config\software_previous 2014-11-18 13:43 - 2006-11-02 11:22 - 17825792 _____ () C:\Windows\system32\config\system_previous 2014-11-18 13:43 - 2006-11-02 11:22 - 00262144 _____ () C:\Windows\system32\config\security_previous 2014-11-18 13:43 - 2006-11-02 11:22 - 00262144 _____ () C:\Windows\system32\config\default_previous 2014-11-18 13:43 - 2006-11-02 11:22 - 00061440 _____ () C:\Windows\system32\config\sam_previous 2014-11-18 13:42 - 2008-12-25 09:38 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\vlc 2014-11-18 13:42 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\spool 2014-11-18 13:42 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\registration 2014-11-17 22:09 - 2008-12-24 23:16 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\Mozilla 2014-11-17 19:33 - 2009-08-22 21:27 - 00000000 ____D () C:\Program Files\Mobile Partner 2014-11-16 20:45 - 2010-08-02 14:21 - 00000000 ____D () C:\Program Files\Java 2014-11-16 20:29 - 2008-12-25 09:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN 2014-11-16 20:19 - 2008-12-24 11:39 - 00000000 ____D () C:\Users\Herrin\AppData\Local\Adobe 2014-11-16 19:35 - 2011-03-13 20:56 - 00000000 ____D () C:\Program Files\Common Files\Adobe 2014-11-16 19:35 - 2008-12-24 11:38 - 00000000 ____D () C:\ProgramData\Adobe 2014-11-16 19:27 - 2011-05-13 05:53 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl 2014-11-16 19:15 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\LogFiles 2014-11-16 12:30 - 2008-12-25 09:41 - 00000000 ____D () C:\Users\Herrin\Desktop\Büro 2014-11-14 21:52 - 2012-02-16 20:28 - 00000000 ____D () C:\temp 2014-11-14 18:34 - 2006-11-02 13:35 - 00000000 ____D () C:\Program Files\Windows Sidebar 2014-11-14 14:38 - 2009-05-17 00:15 - 00000000 ____D () C:\Users\Herrin\AppData\Local\Google 2014-11-14 14:37 - 2009-05-17 00:14 - 00000000 ____D () C:\Program Files\Google 2014-11-14 14:03 - 2011-12-15 23:36 - 00000000 ____D () C:\Users\Herrin\AppData\Roaming\Skype 2014-11-13 19:33 - 2006-11-02 12:18 - 00000000 __RHD () C:\Users\Default 2014-11-13 19:33 - 2006-11-02 12:18 - 00000000 ___RD () C:\Users\Public 2014-11-13 19:17 - 2006-11-02 11:23 - 00000215 _____ () C:\Windows\system.ini 2014-11-13 09:49 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\rescache 2014-11-13 09:01 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\Microsoft.NET 2014-11-13 08:44 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\de-DE 2014-11-13 03:08 - 2006-11-02 11:24 - 100445232 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe 2014-11-12 22:25 - 2010-07-03 07:33 - 00000000 ____D () C:\ProgramData\ICQ 2014-11-12 19:44 - 2008-12-24 09:42 - 00001356 _____ () C:\Users\Herrin\AppData\Local\d3d9caps.dat 2014-11-07 09:42 - 2012-02-20 18:54 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2014-11-06 23:25 - 2012-02-20 18:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight 2014-11-06 13:37 - 2006-11-02 13:35 - 00000000 ____D () C:\Program Files\Windows Journal 2014-11-06 13:36 - 2006-11-02 13:35 - 00000000 ____D () C:\Windows\system32\XPSViewer 2014-11-06 09:03 - 2006-11-02 16:46 - 00000000 ____D () C:\Windows\system32\Drivers\de-DE 2014-11-05 13:07 - 2009-11-11 20:02 - 00000000 ____D () C:\Program Files\Yahoo! 2014-11-05 12:55 - 2012-02-19 18:42 - 00000000 ____D () C:\ProgramData\Yahoo! ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\explorer.exe => File is digitally signed C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-12-02 22:39 ==================== End Of Log ============================ --- --- --- |
04.12.2014, 09:20 | #32 |
/// the machine /// TB-Ausbilder | Windows Vista: Adware und anderes Zeugs Nein, wenn der proxy aktiv ist geht in der Regel kein Browser mehr.
__________________Downloade Dir HitmanProauf Deinen Desktop: HitmanPro - 32 Bit HitmanPro - 64 Bit
Poste bitte den Inhalt der HitmanPro_<Datum_Uhrzeit>.txt mit Deiner nächsten Antwort.
__________________ |
05.12.2014, 06:13 | #33 |
| Windows Vista: Adware und anderes Zeugs Ok, hab das so gemacht, aber da ist keine Textdatei mit Datum Uhrzeit, nur ein Log.
__________________Da steht auch am Ende, man müsse einen Linzenzschlüssel eingeben, oder eine Lizenz für 30 Tage wählen. |
05.12.2014, 17:20 | #34 |
/// the machine /// TB-Ausbilder | Windows Vista: Adware und anderes Zeugs dann wähle die 30 Tage Testlizenz
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
08.12.2014, 13:26 | #35 |
| Windows Vista: Adware und anderes Zeugs Bin jetzt nochmal jeden Schritt durchgegangen, hab die 30 Tage Lizenz gewählt und es kam auch die Meldung, Bedrohungen wurden entfernt. Null Bedrohungen wurden gefunden, aber 16 Spuren (Conduit, Tracking Cookies). Nur hab ich wieder nur ne Log und keine txt-Datei... Geändert von Gloo (08.12.2014 um 13:41 Uhr) |
09.12.2014, 11:28 | #36 | |
/// the machine /// TB-Ausbilder | Windows Vista: Adware und anderes ZeugsZitat:
__________________ --> Windows Vista: Adware und anderes Zeugs |
11.12.2014, 17:41 | #37 |
| Windows Vista: Adware und anderes Zeugs Hallo Schrauber, danke für deine Hilfe, aber ich fürchte es hat sich erledigt Hab auf dem Laptop schon länger nen Wackelkontakt und nun bootet er seit vorgestern garnicht mehr. Hab heute erfahren, dass die Reparatur weit mehr kostet als das Gerät wert ist und werde wohl lieber in eine Neuanschaffung investieren. Es lohnt einfach nicht... Hätte ich das gewusst, sorry für die Umstände. Jedenfalls danke für die Mühe. |
12.12.2014, 17:04 | #38 |
/// the machine /// TB-Ausbilder | Windows Vista: Adware und anderes Zeugs kein Problem
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |